New Puzzles Added to 33o1.com
📅 November 28, 2025 · ⏱️ 7 min read · ♻️ Updated
This page used to be a short announcement that more puzzles existed. That is not useful to anyone standing outside the site trying to work out whether it is worth an evening. So here is the actual description: what 33o1.com is, how the board is wired, what you do on each of the pages you can reach without solving anything, and what has been fixed since this post was first written. No answers appear below — not one key, not one decoded string, not a count of how many keys exist. Everything here is either visible on a page you can open right now or readable in the site’s own shipped JavaScript.
What 33o1 actually is
33o1 is a single-page app served from one index.html. There is no per-page HTML on disk: nginx hands back that one file for any address it cannot find, and a router in the browser decides what to draw. The router’s own source comment puts the number of public routes at seven, and sitemap.xml offers search engines only five of them — the home page, /Map, /About, /Changelog and /Privacy. That gap is deliberate. A route that is also a puzzle answer does not belong in a sitemap, and the changelog records the day two hidden puzzle pages were removed from it for exactly that reason.
The name is a scramble of 3301, the Cicada puzzles. The comparison is the site’s own framing, not a claim to the same scale.
The chain is built from its own addresses
The mechanic is the most interesting thing about the site and takes one sentence: the answer to the puzzle in front of you is the name of the page that comes next. You type it into the box marked Enter key (case-sensitive) and press Submit. A correct key opens that page; a wrong one answers Incorrect key. Try again.
Two consequences follow, and the site now states both on /About rather than leaving you to discover them. First, capitals are load-bearing: CrossRoad and crossroad are different addresses, and the lowercase one lands on a not-found screen rather than on a puzzle. Second, a puzzle’s address is its key — so pasting your current tab to a friend does not share your progress, it opens that puzzle for them and marks it solved in their copy of the map. Until September 2026 the About page claimed the opposite, advertising a sharing feature built on a URL that carried your puzzle and key. No such feature existed, and the page was rewritten to say what actually happens.
Your solved list lives in that browser’s local storage and nowhere else. There is no account, and the Privacy page has a button that empties it.
The shape of the board
The site ships an anonymised copy of its own graph in html/js/puzzleStructure.js — opaque node ids, no names — and that file is what the map draws. It holds 26 nodes and 36 edges, and the shape is not a straight line.
A four-step chain runs from the home slot to a fan-out node with five children. All five converge again on a single node. That node opens five more, one of which is a deliberate dead end with no exit at all. The remaining four branch two ways each, and those eight paths all feed one late node that leads to the finish. So there are exactly two nodes on the board with no outgoing edge: the end, and the trap.
That structure is why the map bothers drawing padlocks. A node fed by more than one arrow waits for every one of them.
What the map will not show you
Open /Map in a browser that has solved nothing and it reads 0/26 with the network line at 0% MAPPED. Every node is a grey box in a fog wash labelled ???. A node takes a label only once its puzzle is in your own solved list, and even then only some of them have a friendly name — the changelog puts it at 13 of the 26 — so the rest show the puzzle’s own id instead.
The on-screen legend has five rows and is built from the same 12-entry colour table the canvas paints with, so the swatch explaining a colour cannot drift away from the colour itself. It describes the drawing only: green box for solved, grey-in-fog for unopened, gold label with cyan corner brackets for where you are standing, arrows that turn green only when both ends are solved, and a padlock that goes red, then amber, then a green tick as the routes into a gated node complete.
/Progress now opens /Map
Older links and bookmarks may still point at /Progress. Until 2026-09-28 the menu carried PROGRESS and MAP side by side, and both opened the same canvas. The changelog entry for that day retired the duplicate: “Old /Progress links and bookmarks now land on /Map.” So there is one map, and nothing you had solved moves when you follow an old link — in the same entry’s words, “Your saved progress is untouched.”
Inside /Labyrinth
/Labyrinth is an early step and is one of the gentler ones. It shows a video, then a single line of ciphertext in a bordered panel with the word ROT13 printed faintly in the corner. The cipher is named on the page; the work is noticing what to do with the result. The page’s own closing line — that puzzles get harder from here — is accurate.
Inside /CrossRoad
/CrossRoad is the fan-out node, presented as a pentagram menu of five named challenges: Chronal Cipher, Echo Chamber, Fractal Maze, Quantum Riddle and Synced Clock. Each is a small widget of its own rather than a separate secret address, which is why these five are named openly while the rest of the chain is not. The page states that each one solved returns 5 characters of a 25-character master key.
That number does not line up with /About, which describes a growing collection “with a goal of 100”. They are different scopes — one branch’s key against a target for the whole site — and the site does not reconcile them anywhere. If you are counting characters, count the branch’s.
What changed, and when
The changelog carries 14 dated entries, running from 2025-12-16 to 2026-09-29. The substantive ones for a solver:
On 2026-08-05, three CrossRoad codes that could not be solved from the clues on the page were fixed — no correct reading of them produced an accepted answer, which dead-ended the run. On 2026-08-06, two image puzzles that returned a result disagreeing with their own solution were corrected, one audio puzzle that played only part of its answer was made audible in full, a second was rebuilt so the answer is genuinely recoverable by ear, a page that stated the wrong answer length was corrected, and a video hint that pointed at information the file never contained was repointed. That is a run of six defects any one of which would have looked, from the solver’s chair, like being bad at the puzzle.
The rest is plumbing: per-page visit counting restored, a real link preview card, a skip-to-content link, a responsive layout above 1680 pixels, a proper not-found screen, and on 2026-09-16 a fix for the key box on phones, where a 156-pixel opening had been clipping its own 227-pixel prompt down to Enter key (case-sen and hiding the warning that capitals matter.
The leak that changed how it is tested
The most instructive entry is from 2026-08-06. The printable challenges are produced by generator scripts, and those scripts — 11 of them — were sitting in the web root alongside the PDFs they made, with their answer keys in plain text. The web root has no Python execution layer, so each one was served as readable source to anyone who guessed a filename. Directory listing was off and robots.txt disallowed other paths, but neither is an access control.
The fix was not a server rule. Deployment is rsync -a --delete over the web root, so a file’s presence there is its publication; the generators were moved out of it into a tooling directory, which is what unpublished them. The site now carries a test that derives the key set from the filesystem — every view module whose name is not one of the site’s named navigational routes — and scans every other shipped byte for those strings. Media files are excluded on purpose, because digging a key out of a spectrogram or a hex editor is the challenge; a script printing key = "..." on line 18 asks nothing of anyone.
Separately, on 2026-09-13 a 32-character verification file went live at the root so the Bing-powered engines will accept URL submissions for the site. It is not linked from anywhere and is not part of the puzzle. Whether that kind of submission moves anything is a separate question, and one we tried to measure on this blog in does telling search engines about your pages do anything.
Honest limits
This is a small hand-built site, and it shows in places. The map is a canvas, so it is a poor experience with a screen reader. Node labels for steps without a friendly name are raw ids, which are not memorable. Progress is per-browser, so clearing site data loses a run with no warning and no export.
If you like cipher chains where the structure is part of the puzzle and the site does not pretend to be bigger than it is, it is worth the evening.
Follow new posts by RSS: paste dankdev.com/feed.xml into any feed reader. It is a plain XML file — no signup, no email address, no account. Posts land there the same day they go up, and there is nothing to unsubscribe from later.