The Zodiac Killer Ciphers: How Z340 Was Solved After 51 Years

For 51 years, a 340-character cipher sat in FBI files. The Zodiac Killer mailed it to the San Francisco Chronicle on November 8, 1969. It resisted every attempt to break it. Then in December 2020, three amateur codebreakers solved it from their homes using software they wrote themselves.

The breakthrough was not a single insight. It was a combination of homophonic substitution analysis, route transposition (reading the text diagonally instead of in rows), and a hill-climbing algorithm that tested millions of key combinations. The FBI verified the solution in January 2021.

Two of the Zodiac's four ciphers remain unsolved. You can explore all four interactively with our Zodiac Cipher Explorer.

The Zodiac Killer sent four ciphers to Bay Area newspapers between 1969 and 1970. Each has a name based on its length.

Z408 (408 characters, mailed July 31, 1969): The first cipher, sent in three parts to three newspapers (the Vallejo Times-Herald, the San Francisco Chronicle, and the San Francisco Examiner). It was solved within days by Donald and Bettye Harden, a schoolteacher couple from Salinas, California. The Harden solution used homophonic substitution, where each plaintext letter is represented by multiple cipher symbols. The decoded message began: "I like killing people because it is so much fun." The last 18 characters of Z408 did not decode cleanly under the Harden key, and this "Z18" ending remained unexplained for decades.

Z340 (340 characters, mailed November 8, 1969): The second cipher, mailed to the San Francisco Chronicle. It resisted all attempts at decryption for 51 years. It was solved in December 2020 by David Oranchak, Jarl Van Eycke, and Sam Blake. The FBI verified the solution on January 5, 2021. The decoded message contained a rambling statement about being "not afraid of the gas chamber" and collecting "slaves for the afterlife."

Z13 (13 characters, mailed April 20, 1970): A short cipher accompanied by the message "This is the Zodiac speaking. By the way have you cracked the last cipher I sent you? My name is ---." The 13-character cipher was presumed to contain the killer's name. It remains unsolved. In 2025-2026, independent investigator Alex Baber claimed to have decoded Z13 as "Marvin Merrill" (an alias for Marvin Margolis) using AI and traditional cryptanalysis, with verification by former NSA codebreaker Ed Giorgio. However, other analysts, including Steve Hodel, have pointed out that the proposed solution does not satisfy the cipher's repeating-symbol constraints under standard substitution rules. The claim remains disputed.

Z32 (32 characters, mailed June 26, 1970): A cipher accompanied by a map of the San Francisco Bay Area with a crosshair over Mount Diablo. The cipher was presumed to encode geographic coordinates for a bomb. It remains unsolved. A January 2026 paper published on Zenodo formally analyzed Z32 as a constraint satisfaction problem and argued that it is structurally undecipherable, defining it as an "anti-cipher" that encodes a terminal state rather than recoverable content.

Z340 uses the same basic technique as Z408: homophonic substitution, where each plaintext letter maps to multiple cipher symbols to flatten frequency analysis. If Z340 were a simple homophonic substitution cipher, it would have been solved years ago. The reason it resisted was that it also uses transposition.

Transposition means the ciphertext characters are rearranged from their original order. In Z340, the text is not read left-to-right, top-to-bottom. It is read diagonally, following a specific route through the 17-column by 20-row grid. This route transposition scrambles the character order before the substitution is applied, making standard frequency analysis and pattern matching ineffective.

The key insight came from David Oranchak, who had been working on Z340 for over a decade. He noticed that when the cipher text was split into certain segments and read in diagonal patterns, the statistical properties changed in ways that suggested a transposition layer. Jarl Van Eycke developed software (azdecrypt) that could test millions of substitution keys against transposed text. Sam Blake identified the specific transposition route: the text is read in a diagonal pattern across the grid, creating three distinct segments.

The combination of homophonic substitution (many-to-one letter mapping) and route transposition (reordering) created a cipher that was individually breakable in each layer but resistant when both layers were applied together. The solution required identifying the transposition route first, then applying hill-climbing to find the substitution key.

The solution process involved three steps:

Step 1: Identify the transposition. Oranchak and Blake determined that the 340-character grid should be read diagonally rather than in rows. Specifically, the cipher splits into three segments of 78, 170, and 92 characters when read along specific diagonal paths. This transposition had not been identified in 51 years of analysis because the diagonal reading pattern is unusual and non-obvious.

Step 2: Hill-climbing search. Van Eycke's azdecrypt software uses a hill-climbing algorithm that starts with a random substitution key, decrypts the text, scores the result using English language statistics (n-gram frequencies), and iteratively modifies the key to improve the score. The algorithm tests millions of key combinations per second. When applied to the transposed text, it converged on a readable solution.

Step 3: Verification. The decrypted text was readable English, but contained misspellings and odd phrasings consistent with the Zodiac's known writing style. The team submitted their solution to the FBI, which independently verified it. The FBI announced the verification on January 5, 2021, through FBI San Francisco's Twitter account.

The decoded message read in part: "I hope you are having lots of fun in trying to catch me. I am not afraid of the gas chamber because it will send me to paradice all the sooner. I am not afraid of death because I am already dead." The misspelling "paradice" is consistent with the Zodiac's known writing habits.

Z13 and Z32 remain officially unsolved. Both are extremely short, which makes them mathematically underdetermined. Z13 has only 13 symbols, and Z32 has 32. With so few characters, many different plaintexts can be made to fit the ciphertext, making verification nearly impossible without external evidence.

In 2025-2026, Alex Baber claimed to have solved Z13 as "Marvin Merrill" (an alias for Marvin Margolis, a suspect in the 1947 Black Dahlia murder). Baber used a combination of AI, traditional cryptanalysis, and newly available Census records. Former NSA codebreaker Ed Giorgio reportedly verified the solution. A separate researcher, Thomas Hefner, applied Baber's methodology to the unsolved Z18 ending of Z408 and reported finding the same name, which Giorgio also verified.

However, these claims are disputed. Analyst Steve Hodel published a rebuttal in February 2026 arguing that the "Marvin Merrill" solution does not satisfy Z13's repeating-symbol constraints under standard substitution rules. Specifically, Z13 has symbols that repeat in positions 1/12, 3/11, 8/13, and 5/7/9. Any valid one-to-one substitution solution must follow this letter pattern. Hodel argues the Merrill reading violates these constraints.

A January 2026 Zenodo paper took a different approach to Z32, formally proving that the cipher is structurally undecipherable within the defined solution space. The paper defines Z32 as an "anti-cipher" that encodes a terminal state rather than recoverable content, and argues that no determinate decoding exists.

The FBI has not officially verified any solution for Z13 or Z32 as of August 2026. You can examine all four ciphers and test your own theories with our Zodiac Cipher Explorer.

The Z340 solution demonstrates a principle that matters for both historical cryptanalysis and modern cipher design: combining two individually breakable techniques can create a cipher that is far harder to break than either technique alone.

Homophonic substitution alone is broken by frequency analysis (as the Hardens demonstrated with Z408). Route transposition alone is broken by anagramming. But homophonic substitution applied after route transposition resists both attacks, because the transposition destroys the spatial patterns that frequency analysis relies on, and the substitution destroys the letter patterns that anagramming relies on.

This is the same principle behind modern block cipher design. AES applies multiple rounds of substitution (SubBytes) and permutation (ShiftRows, MixColumns). Neither operation alone provides security, but their combination across 14 rounds creates a cipher with no known practical attack.

For CTF competitors and cipher enthusiasts, the lesson is that when a cipher resists standard analysis, consider whether a second layer is present. Our Cipher Identifier can detect single-layer ciphers, but multi-layer ciphers require manual analysis of the type Oranchak, Van Eycke, and Blake performed.