Cryptography: Behind the Layers of the Zodiac Killer's Deception
Exploring the overt and covert systems the Zodiac may have used to obscure his identity through cipher, code, and misdirection.
On July 31, 1969, the Zodiac Killer mailed three nearly identical letters to three newspapers, each containing one-third of a cipher. Each letter featured multiple uses of the word cipher, which also indicated, the number of errors that could be found within the letters cipher piece. In his letter to the San Francisco Chronicle, the Zodiac stated, “In this cipher is my identity.” Everyone, including the Hardens, interpreted the cipher to mean the cryptographic 408 cipher of symbols for substitution.
Why wouldn’t they?
There it was in black and white, provided by the Zodiac for decryption.
A few days later, in his August 4, 1969 letter to the Examiner, the Zodiac wrote:
“By the way, are the police having a good time with the code?”
Again, everyone interpreted the code to mean the cryptographic 408 cipher of symbols for substitution.
Why wouldn’t they?
There it was, in black and white, provided by the Zodiac for decryption.
Yes! Why wouldn’t they?
For me, the inclusion of a cipher—and the repeated use of the word—began to look more like a distraction or an attempt at priming when I reflected on these statements. When I considered this possibility, I was reminded of an article I had written titled The Decoy Effect. In that article, I discussed how one simple statement—“I will not give you my name”—swayed the public away from the obvious interpretation (self-perception) toward a literal name.
Here, we have the inclusion of a cipher and repeated emphasis on the word. Could this, once again, be enough to sway public interpretation?
For this to be true, there would have to be more to the word cipher than just the 408 image we have all come to know. To be frank, I didn’t have an answer to that at the time. I had to dive deeply into the world of cryptography—and really dig—to find it. I’m not sure if I’ve nailed the terminology or techniques perfectly, since I’m not trained in this field, but I don’t believe I’m too far off.
Here’s what I discovered:
If you ask the average person what a cipher is, you’ll almost always get the same description: cryptic symbols—like those in the 408. Ask the same person about a code, and you’ll likely get the same answer. In popular understanding, cipher and code are used interchangeably, both evoking that symbol-based substitution image.
But what the average person doesn’t know is that cryptography, as a discipline, is defined as “the science or study of the techniques of secret writing, especially code and cipher systems, methods, and the like.” In short, cryptography refers to the overall process of encrypting and decrypting a message—and the ways this can be done are numerous.
Cryptography is traditionally divided into two main branches:
Cryptography Proper (Overt) and Steganography (Covert).
Cryptography Proper hides a message in plain sight by masking it with symbols that replace the actual text. Two of the primary methods are transposition and substitution. Substitution itself has two subcategories: cipher and code.
A transposition cipher, in its simplest form, rearranges the order of the plaintext according to a specific method. The plaintext (without transformation to symbols) is laid out in a predetermined grid size (without punctuation or spacing), and then read in a specific pattern to produce the ciphertext.
A substitution cipher works at the level of individual letters or small groups of letters. A message can be hidden by replacing its letters with others—be they symbols, numbers, or different letters.
A polygraphic cipher substitutes small groups of letters. For example, the groups “ci,” “ph,” and “er” in the word cipher could be replaced by a letter “Q,” a triangle, and the number 12, respectively.
A simple substitution cipher replaces individual letters—for example, “T,” “H,” and “E” in the might become “L,” a theta symbol, and “E.”
Ciphers can also be combinations of transposition and substitution.
Looking back at Zodiac’s use of the word cipher—and considering the 408—it’s clear that this cipher falls under Cryptography Proper, and more specifically, substitution. The 408 is a simple substitution cipher, with steps taken for both encryption and decryption. The 340 also falls under Cryptography Proper and substitution, but with a twist: it is a combination transposition–substitution cipher.
As shown above, code is a separate branch within substitution. So what can we say about the Zodiac’s use of the word code?
A code is defined as a system of words, letters, figures, or other symbols substituted for other words or phrases for secrecy. It operates at the level of semantics—meaning.
Two examples of code, both likely sourced from Kahn, are shown below:
In the above image, each plaintext word or sentence maps to a single code word—some in cryptic symbols, others in standard English. A codebook would be required to track the mappings. If the codewords are listed alphabetically, it indicates a one-part code, meaning the book can be used to both encode and decode. If they’re not alphabetically ordered, it indicates a two-part code—where one codebook is needed for encoding, another for decoding.
The first example above could have applied to the 408 or to Zodiac’s mention of code, but no connection was ever made.
But what about the second example?
If we now look at Steganography, the second main category of cryptography, we can begin to see how the second example of code could apply. It becomes clear that Zodiac wasn’t confused about the difference between cipher and code—he was likely being deceptive or misleading when he used the term code in his August 1969 letter.
Steganography, from the Greek for “concealed writing,” is one of the oldest methods for hiding messages. Unlike ciphers, it doesn’t just disguise a message—it hides the existence of the message entirely.
There are two main types of Steganography: Data Steganography and Linguistic Steganography.
Data Steganography hides messages in media such as images, audio, or video. This method is modern and, in my opinion, likely beyond Zodiac’s knowledge.
Linguistic Steganography, however, hides messages using language—words, phrases, symbols, or any other expressive medium. A carrier is anything that transmits communication. In Zodiac’s case, his carriers were his letters.
Linguistic Steganography has two further subtypes: Semagrams and Open Code.
A semagram hides messages using symbols. There are two types:
Visual semagrams use innocent-looking images to convey meaning. Examples in Zodiac’s letters may include:
Postage stamps (Related example - Quantity of Stamps and the Zodiac Dozen)
Bus bomb diagrams (article forthcoming)
- The symbols at the bottom of the Exorcist letter (January 29, 1974) (article forthcoming)
Text semagrams modify the appearance of text to conceal messages. This includes:
Font size changes
Altered spacing between letters or words
Odd capitalization
Bolded text
Spelling variations
These textual oddities are not random—they could signal a hidden message.
If you’ve read my article Writing for Print, you’ll see that I explore all of these typographic techniques. I liken them to how Zodiac crafted each letter like a publication. But in my view, these were not attempts to hide secret messages. They were expressions of meaning and perhaps tradecraft—his identity as a communicator. Thus, I see Zodiac’s modifications as visual semagrams, not text semagrams.
An open code is where certain words, phrases, or symbols in ordinary text are actually codewords. This is where the second code example earlier becomes relevant to Zodiac’s use of the term.
In that example, the word accountant secretly means “come at once. Do not delay.” It could be embedded in an ordinary sentence like:
“I paid the accountant $500.00 today.”
Without knowing the hidden meaning, no one would suspect that the real message was “come at once. Do not delay.”
Zodiac’s reference to code may have worked the same way. On the surface, it appeared he was referring to the 408 cipher—but his true intent may have been to hint at an underlying steganographic system built on open codes hidden in plain text. By using ordinary words as carriers of secret meaning, he could have embedded an invisible network of messages beneath the surface of his letters.
In this way, Zodiac presented himself as someone unschooled in cryptography—perhaps to appear primitive or dismissive of advanced methods—while actually concealing layered information. It was deception by design: a way to ensure that only those who knew to look deeper would uncover the secondary system at play.
This interpretation also reframes our understanding of Zodiac’s use of the word identity in the July 31, 1969 letter.
In The Decoy Effect, I noted how identity split interpretations:
Half believed the 408 cipher would produce a name
Half believed it would reflect self-perception
The 408 was clearly about self-perception—Zodiac’s view of himself.
But identity can also be interpreted as identification: the psychological orientation of self to a group or person. This deeper form of identity may not be visible in the 408, but it could be reflected in the names revealed through open code—such as those listed in my article Quantity of Stamps and the Zodiac Dozen.
The question is: how?
In that article, I suggested Zodiac’s passion was editing and publishing. On the surface, this seems to connect him to the twelve individuals named. But after fifteen years of examining every letter, I’ve found at least nine additional codes embedded in the July 31 letter—none of which I’ve published yet. And while these codes also reveal names, those names span a wide range of backgrounds.
Editing and publishing only appear with the first twelve.
So if editing isn’t the common link, what is?
Upon further reflection, I now believe that the plaintext names revealed through code represent only one half of a two-part code. We’ve had the first book—the Zodiac’s letters—for decades. A codebook is essential for any covert system. What we lack is the second book, the key to interpreting the names.
That second book, I believe, is genealogy.
These names aren’t just editorial idols or random figures. They are ancestral. They represent Zodiac’s lineage—a hidden form of identification tied not to what he wrote, but to who he is.
In other words, identity wasn't just a name or a reflection.
It was blood.