Breaking the Zodiac Ciphers: Z408, Z340 and the Unsolved Z13 and Z32

Between the summer of 1969 and the spring of 1970, the person who signed letters as “Zodiac” mailed four ciphers to newspapers in the San Francisco Bay Area. The letters accompanied a series of murders that have never been solved. The ciphers have had a different fate. The first was read within days by two newspaper readers. The second resisted every attack for 51 years, until three amateur codebreakers announced its solution in December 2020 and the FBI confirmed it. The last two, at 13 and 32 symbols, remain unsolved, and there are sound mathematical reasons to think they may stay that way.¹²

This is a story about cryptanalysis rather than about the crimes. Its main lesson is that neither cipher yielded to cleverness alone. Each fell when someone correctly guessed what kind of system it was, and then had a way to test that guess against the statistics of English.

Z408: a homophonic cipher read in a week

On July 31, 1969, the writer mailed a 408-symbol cipher in three parts, one each to the Vallejo Times-Herald, the San Francisco Examiner and the San Francisco Chronicle, with letters demanding that the papers print it. Police asked for help from the Navy, the FBI and the head of the American Cryptogram Association. On August 8, the Chronicle received a solution from Donald and Bettye Harden, a couple who had worked on it after seeing it in the paper.¹ Joachim von zur Gathen, a mathematician at the University of Bonn, describes Donald Harden as a teacher and says the pair solved the cipher “within a week.”³

The system was homophonic substitution. In a simple substitution cipher each plaintext letter always becomes the same symbol, so the most frequent symbol in a long message is very likely E, and the method collapses under frequency counting. A homophonic cipher gives common letters several interchangeable symbols (“homophones”), which flattens those frequencies. Z408’s key assigns several symbols to frequent letters and none to J, Q or Z, which do not occur in the message. The Hardens’ reading was helped by the encipherer’s habits: he tended to cycle through a letter’s homophones in a fixed order, so that, for example, fourteen Es were written as the same seven-symbol sequence repeated twice. The decrypted text is a boast about killing, full of misspellings, and it ends in an 18-character run whose meaning has never been settled; suggestions include filler copied from elsewhere in the grid or nulls.¹

Z408 has since become a standard test case. The solvers of the later cipher list a series of programs and papers that crack it automatically, including Bayesian, genetic-algorithm and hill-climbing methods published between 2008 and 2019.¹ One of them was a 2008 genetic-algorithm paper by David Oranchak, who would later help solve the second cipher.⁴

Z340: the cipher that broke the usual tools

Z340 was mailed to the Chronicle on November 8, 1969, and printed within days. It looked like Z408: 340 symbols arranged in 20 rows of 17, drawn from an alphabet of 63 distinct symbols, 20 of which had not appeared in the first cipher. The Z408 key produced nothing. An FBI cryptanalysis report dated December 18, 1969 records that the Bureau tried the old key, transposition combined with it, cribs (guessed words placed at likely positions), alternative reading directions and anagramming, and concluded, in the solvers’ quotation of the document, “No decryption could be affected.”¹

For the next five decades Z340 attracted a steady flow of claimed solutions, many of them based on anagrams or flexible rules that let the solver find almost any message he was looking for. Oranchak’s reference wiki keeps a list of these discredited or inconclusive attempts.⁵ The serious problem was the opposite one. Statistically, Z340 behaved like a real cipher, but solvers that easily broke artificial test ciphers built to resemble it could not break it. The solvers’ survey records several researchers concluding from this mismatch that Z340 was probably not a plain homophonic substitution, and that something such as a transposition had been added.¹

The clue that eventually guided the solution was a count of repeated symbol pairs. Read normally, left to right, Z340 contains 25 repeating bigrams, close to the average of 20 for random shuffles of its own symbols and well below the average of 34.5 for 1,000 test ciphers of the same length enciphered from ordinary English. But if one pairs each symbol with the symbol 19 positions later, the count rises to 37, the highest of any spacing tested. Z408 shows no such spike at any period other than 1. In 2015, Jarl Van Eycke and a forum user known as “daikon” independently noticed the period-19 effect, which suggested that the plaintext had been laid down in some order other than straight rows before symbols were substituted.¹

Searching the space of transpositions

Knowing that a transposition was probably involved did not say which one. Forum researchers spent years trying columnar schemes, spirals, zigzags, quadrants, flips and rotations. In May 2020 Van Eycke proposed a rearrangement that, in hindsight, was close to correct, but errors in the original encipherment meant it did not produce readable text when run through his solver.¹

Sam Blake, an applied mathematician in Australia, joined the effort in January 2019 after watching a talk by Oranchak. He observed that the period-19 reading was really a “pseudo-period” one, and that a different mathematical object produced the same pattern: a decimation of the 20 by 17 grid, which reads it by stepping a fixed number of rows down and columns across, wrapping around both edges. Blake then enumerated billions of candidate transposition schemes, kept only those that raised the repeated-bigram count, and also allowed for the possibility that the cipher had been cut into separate horizontal or vertical sections, each transposed on its own. The resulting variants were run through two solvers: AZdecrypt, run by Oranchak, and ZKDecrypto on the Spartan supercomputer at the University of Melbourne.¹

On December 2, 2020, Blake and Oranchak began reprocessing a batch of 655,088 variants, scored with 6-gram rather than the default 5-gram statistics. The next day one candidate produced fragments that read “HOPE YOU ARE,” “TRYING TO CATCH ME” and “THE GAS CHAMBER,” surrounded by gibberish.¹ The variant had divided the grid into four sections (rows 1 to 9, rows 10 to 18, row 19 and row 20) and applied the same scheme to each: write a symbol, move one row down and two columns right, wrapping at the edges, and repeat. The solvers describe it as a “two right, one down” rule; von zur Gathen calls it a knight’s move.¹³

The first section alone was hard to solve because of its high “multiplicity,” the ratio of distinct symbols to cipher length: 63 symbols in 153 positions gives about 0.41, against 0.13 for Z408. Fewer repetitions per symbol give a solver less to work with. Oranchak fixed the three legible phrases in place as cribs, which assigned 27 of the 63 symbols, and AZdecrypt filled in the rest of a coherent first section. Because every symbol in the cipher appears in those nine rows, that key then applied to the whole message.¹

The second section still came out partly garbled. Van Eycke traced most of the damage to a single symbol the encipherer had skipped on one line, and the team found that two words, “LIFE IS,” had been left out of the transposition, while some words in the last two rows had been written backwards. With those corrections the full text read as a taunt: the writer denied being a man who had telephoned a Bay Area television program in October 1969, and repeated themes of his earlier letters about an afterlife. The team sent its report to the FBI’s Cryptanalysis and Racketeering Records Unit on December 5, 2020, and released the solution by video on December 11, after time had been allowed for families of the victims to be notified.¹⁶

The solver’s machinery: hill climbing, n-grams and annealing

The engine behind the break was AZdecrypt, a solver Van Eycke began writing in 2014 to work on Z340, building on the earlier ZKDecrypto.¹ It is a hill-climbing classical-cipher solver written in FreeBASIC, with specialized modes for substitution combined with transposition, for fixing cribs in a grid, and for testing positions as nulls or skipped symbols.⁷

The idea is simple to state. Start with a random key that maps each cipher symbol to a letter. Decrypt, and score the result by how English-like it is. Make a small random change to the key, rescore, and usually keep the change if the score improves. Repeated many times, this walk “uphill” tends toward keys that produce plausible English. The scoring uses n-gram statistics: tables of how often each run of n letters occurs in a large body of English text. Longer n-grams are more discriminating; AZdecrypt can use up to 8-grams, which demand very large tables in memory. Its score also includes an entropy term, which stops the search from settling on texts made of a few very common letters.¹

Pure hill climbing gets stuck on local peaks, keys that are better than all their neighbors but still wrong. AZdecrypt uses simulated annealing, a related method that, as generally described, sometimes accepts a worse key, with that tolerance reduced over time, so the search can escape false peaks. The solvers report that on an 8-core personal computer it can solve up to 200 homophonic test ciphers per second with a success rate above 99 percent. That speed is what made it practical to try hundreds of thousands of transposition variants, each requiring its own substitution search.¹ Another feature proved important in December 2020: automatic insertion of word spaces into a candidate plaintext, which made partial solutions far easier for a human to recognize.¹

How do we know the answer is right?

Cryptanalysts have a standard objection to claimed solutions of short or loosely defined ciphers: given enough freedom, a solver can make almost anything say almost anything. Claude Shannon’s concept of unicity distance turns that objection into a number. For a given cipher system, it estimates how many symbols of ciphertext are needed before only one key is likely to produce a meaningful plaintext. Von zur Gathen modeled the Z340 system as its components (homophonic substitution of 26 letters into 63 symbols, the choice of sections, the transposition, and allowances for irregular substitutions and misspellings) and estimated “the unicity distance of the cipher’s system is between 80 and 152.” At 340 symbols, the ciphertext is more than twice the upper figure, so under his assumptions the solution is expected to be unique.³ A journal version of his analysis appeared in Cryptologia in 2023.⁸

The FBI agreed. Its San Francisco field office said on December 11, 2020, “The FBI is aware that a cipher attributed to the Zodiac Killer was recently solved by private citizens,” and added that the case remained an open investigation.⁹⁶ A second statement, reproduced by the solvers, says that “On December 5, 2020, the FBI received the solution to a cipher popularly known as Z340 from a cryptologic researcher and independently verified the decryption,” and that over 51 years the unit had reviewed many public proposals, “none of which had merit.”¹

The text itself identifies no one. The solvers write that the plaintext “does not seem to reveal any additional information about the perpetrator’s identity or his crimes.”¹ Oranchak’s own summary at the time: “The message doesn’t really say a whole lot.”⁶ Their full account appeared as a preprint in 2024.²

Z13 and Z32: too short to prove

The two remaining ciphers are a different kind of problem. Z13 arrived in a letter of April 20, 1970, after the words “My name is.” Z32 came with a letter and a map on June 26, 1970, and the letter claimed that its solution would give the location of a hidden bomb.¹ Both are unsolved.⁵

The difficulty is mathematical rather than a matter of effort. Thirteen or thirty-two symbols drawn from a homophonic alphabet fall far below any plausible unicity distance for such a system, so many different keys will each yield readable text. As the Z340 solvers put it, “Cryptanalysis is all but impossible for such a short ciphertext, because solutions are not guaranteed to be unique,” and the many thousands of proposed answers generally cannot be tested scientifically.¹ The same short lengths make it easy to fit a cipher to a chosen name or place. The solvers note that some investigators have read Zodiac material as hidden pointers to favored suspects, and with ciphers this short, a proposed solution is hard to separate from the expectations of whoever produced it.¹

Proposals keep coming. In May 2026 Oranchak began a video series examining one recent claim to have solved both Z13 and Z32, a claim that three former NSA cryptographers had publicly endorsed.¹⁰ As of this writing, no source located for this article reports that the FBI or any police agency has confirmed a solution to either cipher, and Z340’s solution, for all the attention it drew, did not identify the person who wrote it.⁹⁵

Footnotes

1. Oranchak, Blake and Van Eycke 2024, arXiv:2403.17350, sections 1-8. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²²

2. Paul, Popular Science, April 4, 2024. ↩ ↩²

3. von zur Gathen 2022, HistoCrypt, abstract and sections 1-5. ↩ ↩² ↩³

4. Oranchak 2008, GECCO (Crossref record). ↩

5. Zodiac Killer Ciphers Wiki, Main Page. ↩ ↩² ↩³

6. The Register, December 12, 2020. ↩ ↩² ↩³

7. AZdecrypt GitHub README. ↩

8. von zur Gathen 2023, Cryptologia 47(5) (Crossref record). ↩

9. CBS News, December 12, 2020. ↩ ↩²

10. Oranchak, Zodiac Killer Ciphers, May 17, 2026. ↩