Literal Code

One of the most fun ways to hide a secret message is to literally write out the message, but place it in a context that suggests a different meaning to the word. Take, for example, this note that players might find.

At first glance, this appears to be a useless piece of information. It just says that an access code is wrong, but it doesn’t say what the wrong or right code is.

On second glance, well, it still doesn’t help.

The trick to this puzzle is to realize that the words can be interpreted in another way. The message literally tells you that the access code is wrong. The word “wrong” is used to open a combination lock or some other access code. This leap in interpretation is difficult to make but seems so obvious in retrospect.

This hidden in plain sight code can be formulated in many ways. The main point is that the code word serves another function in the sentence it is in. There should also be at least one other distracting sentence. Here is another example.

Watch the players flail as they try to make sense of the first sentence without the letter P. Then hear them groan when they figure out the password is simply “that”. (“that” with all P’s removed is “that”.)

Red Herring

Red herring is an English idiom that refers to a clue that is misleading or distracting. The phrase is often used within the context of a mystery story where the detective collects many clues, some of which turn out to be irrelevant. Red herrings help prevent the solution of a mystery from being obvious before the reveal.

Red herrings are much less important in an escape room than in a mystery story. Most escape rooms do not have red herrings, and you should not feel obligated to add them. However, I enjoy throwing in a red herring or two to throw players off guard.

I typically make the red herrings simple clues and puzzles. As an example, a clue might be a typed letter with the following return address at top.

My family has done enough escape rooms to pay attention to numbers placed within written material. So, I expect them to try these numbers in locks around the room. But they won’t work (snicker).

All that said, you don’t want players to get too wrapped around trying to make red herrings work. To this end, it is best to provide a cue that something is a red herring. I’ve established with my family that when I use the phrase “red herring,” it signals that it will not help investigating further. In the previous example, note that the street name is “Red Herring.” In another example, in one room I had a decoy QR code (distracting from the real QR code players needed to construct).

The page has a hidden message text at the bottom:

The message uses both capital letters and highlight letters, making it easy to see and decode. The message is “red herring,” which is a signal for players to stop looking.

Of course, you could use a different signal for a red herring. You could instead say “just kidding,” place a 😜, or Rickroll the players. Whatever you choose, place it on red herring but never on legitimate clues.

Pointless Form

Online forms are a convenient mechanism to incorporate into puzzles. Enter the correct code to get the information needed for the next box or room. As soon as players see a form, they will inevitably look for clues for the right answers to get past the form.

But here is the trick of the puzzle. There is no answer to the form. Instead, players must see a link in a subtle part of the page to take them to the “right” page.

Here is a straightforward example of a (fake) online login form. The username is filled out and the players “obviously” need to find the correct password.

Players may try to guess the password or infer it from clues, but none will work. The page will just say that the password is invalid.

In fact, the users are never expected to find a password. The trick is to notice there is a link at the bottom of the form to reset the password. The players just need to find and click this link to get to the solvable form.

This example was created with online Google tools. The form itself is a simple Google form with a validation that fails for most anything. Unfortunately, you cannot place the “reset password” link directly in a Google form. Instead, I had to use a Google site in which I embedded the form and added the link below.