How the Zodiac 340 cipher was solved

The Zodiac 340, the second cipher the Zodiac Killer sent, resisted thousands of amateur and professional cryptanalysts for 51 years, and the reason is that it wasn't the cipher everyone thought it was. A team of three working in three countries solved it on December 5, 2020: the American David Oranchak, the Australian mathematician Sam Blake and the Belgian programmer Jarl Van Eycke. The FBI confirmed the solution. This page covers the 340-character cipher and how it fell. It deliberately says little about the crimes, which belong to other people's grief, and focuses on what the solution teaches: how a cipher that looks like a simple substitution can defeat a century of methods, and how patient people with a good program finally won.

The first cipher: 408 symbols, solved in days

The Zodiac Killer, who was never identified, corresponded with newspapers and police in California in 1969 and 1970. On July 31, 1969 he sent three nearly identical letters, to the Vallejo Times, the San Francisco Chronicle and the San Francisco Examiner. Each held a third of a cipher of 408 symbols and a demand that it be printed. The letters arrived on August 1, and on August 5, 1969 a couple from Salinas, Donald and Bettye Harden, neither of them a cryptologist, cracked it. The 408 was a homophonic substitution: each plain letter could be written with several different symbols, which flattens the letter counts that make a simple substitution so easy to break (al-Kindi and frequency analysis).

The second cipher: 340 characters

On November 8, 1969 the killer sent a second cipher, 340 characters long, to the San Francisco Chronicle on a card. It looked like the first, with the same style of symbols and no word breaks. Professional cryptanalysts and many thousands of amateurs tried the methods that had worked on the 408, and none of them produced words. Over the years people proposed many solutions. The FBI's cryptanalysis unit reviewed numerous ones from the public and found none had merit. Two other Zodiac ciphers remain unsolved: the 13-character cipher that came with the letter of April 20, 1970, and the 32-character cipher that ended the letter of June 26, 1970. Neither has been definitively decoded.

Why the 340 was different

The 340 looked like a homophonic substitution, so for decades people attacked it as one. The attacks didn't fail because the method was wrong. They failed because the method wasn't enough, since the 340 turned out to combine a transposition with a homophonic substitution, with several unusual properties. A transposition leaves the letters alone and rearranges their order (columnar transposition is the simplest kind). Shuffle the plaintext first, then replace each letter with one of several symbols, and the symbols that sit next to each other in the ciphertext are no longer letters that sat next to each other in the message. That undoes the main tool of every substitution solver. They work by checking how likely a letter is to follow its neighbors, and when the neighbors are the wrong ones the answer is always "nonsense". The substitution solver on this site would fail on the 340 for the same reason, whatever key it tried.

The ciphertext hides the signal in two places. Rearranging the letters changes nothing about how often each one occurs, so the counts stay what they were, but it destroys every statistic about neighbors. Replacing each letter with one of several symbols flattens the counts. Each defense hides what the other leaves visible. A solver working only on the substitution has to guess the order, a solver working on the order has to guess the substitution, and the problem becomes a search over two things at once.

A fair picture is a sentence written on strips of paper, one letter per strip. Shuffle the strips and you've lost the order but kept every letter. Now swap each letter for one of several symbols and you've lost the letter counts too. A solver that assumes the strips are still in order is working on a puzzle that doesn't exist, and that's where thousands of attempts went for five decades.

How it was solved

The team attacked both steps at the same time, with a program that could try thousands of candidate rearrangements and test each with a hill-climbing search for the substitution. Jarl Van Eycke's program, AZdecrypt, did the substitution solving. Sam Blake's contribution was the transposition: his approach focused on rearrangements of the symbols, and the team ran many experiments to test the possibilities. David Oranchak worked with them on the project and explained the solution in a video. The team submitted its solution to the FBI on December 5, 2020. The FBI confirmed the cipher had been solved, and the decryption gave no further clue to the killer's identity.

The trio later published a full account, The Solution of the Zodiac Killer's 340-Character Cipher, on arXiv on March 26, 2024. It records that the cipher had features that made it harder than ordinary ones, and that it's unclear whether some of the shifting patterns in it were deliberate or an unintended result of how it was enciphered. The paper is the place to read the technical detail, and this page doesn't reproduce the decrypted message.

What the solution teaches

• Two weak ciphers in a row aren't a strong cipher, but they can look like one. Shuffling and substituting each defeat a different analysis, and together they beat the usual ones for half a century. Modern ciphers draw a different lesson. They don't stack two weak ciphers. They make every part of the output look random, as AES does by design.
• Hill climbing is the modern analyst's tool. The solver that cracked the cipher belongs to the same family of method as the one that deciphered Mary Stuart's lost letters in 2023 (the cipher that convicted Mary): start from a random key, change it a little, and keep the change if the text looks more like language. This site's solver works the same way.
• The community matters. The solution came from people in different countries and backgrounds, building on years of shared tools, data and failed attempts that people published openly. The same is true of the AES contest and of every modern cipher that has earned trust (Kerckhoffs's principle).
• A solved cipher can say nothing. A decryption is a plain text and not a verdict, and the FBI found that this one gave no further clue to the identity of the writer. The rest of the case remains open.

Try the ideas yourself

The frequency analysis tool shows the index of coincidence, which stays the same when you shuffle a text and drops when you spread letters over several symbols. That makes it a quick way to see which of the two a cipher has done. The simple substitution page and the columnar transposition page have working versions of the two halves, and the transposition page's cracker shows how a program searches for the order. The best way to see why the 340 held out so long is to put the two together by hand: encrypt a sentence with a transposition, then a substitution, and try to read it back cold.

How cipher.ink uses this

No modern cipher leaves anything to count or an order to guess. The ciphertext of an AES-GCM message is uniformly random bytes whatever the plaintext (AES-256-GCM, AES-GCM), and a message of a thousand letters leaves nothing for a hill-climbing solver to climb. The substitution solver and the columnar cracker on this site exist to teach how the old ciphers fell. The Zodiac story is the clearest recent proof that those old methods still reward people who bring a new idea to them.