The Making of Hanukkah LOL, part 1: The World’s First 6000-Person, Month-Long Escape Room

How The Mystery League built the 2015 Hanukkah puzzle game for Cards Against Humanity

Sandor Weisz
The Mystery League


“You wanna build the puzzle this year?”

That was Max Temkin, in August of 2015, asking me off-handedly as we passed each other at the office we share in Chicago. “The puzzle” was shorthand for the secret layer embedded every year in the Cards Against Humanity holiday promotion. The previous year’s puzzle had beguiled and entertained thousands, and had ended, famously, with an intrepid team of solvers canoeing across a freezing Maine lake to reach Hawaii 2, an island owned and named by CAH, to find and unlock a safe that held 250,000 cards, along with an expensive bottle of Scotch.

This year there would be no safe, no island. The safe was grandiose, but a logistical nightmare for the winners, who inherited the overwhelming task of figuring out how to distribute those cards to everyone who had played. My challenge was to make this year’s puzzle even harder — with no possibility of finding the answer via hacking, or brute force solving — while also making it more accessible.

“Of course I do,” I said, entirely unaware of what I was stepping into.

By the time the puzzle concluded, at 2:00 PM on December 25, we had written several dozen puzzles, turned an unfinished basement into a makeshift puzzle prison, made 24 live broadcasts, enlisted the help of friends across the country, created and corralled four multi-thousand person communities, and, along the way, invented a new kind of interactive game.

This is the story of how we did it.

The premise

2015 had seen the rise of the escape room, and like puzzle makers everywhere, my friend Wil and I had been scheming about building our own. We sat down over coffee in late September to brainstorm. How could we fold a puzzle room into the CAH game?

We spent an hour throwing a bunch of ideas into the scrum and eventually landed on this:

A man is locked in an escape room. But the clues to solve the puzzles are not available to him — they’re embedded in and distributed across the eight Holiday Bullshit mailings. The players will congregate on Slack and collaborate on finding the solutions needed to break our hero out. But: he can only communicate to the outside world via a few minutes of live video per day. And they can only communicate to him via text.

As soon as the idea emerged, we both lit up. Because:

  1. We’d never heard of anyone doing something like this before. We were giddy about the possibility of creating a new kind of puzzle game.
  2. It focused on community solving over competition. In previous years, a small group of solvers on Reddit had barreled through the puzzle, making it intimidating for others to join, or to compete. By creating our own community, it would put everyone on equal footing.
  3. The pace of the game would be heavily throttled by the (in)frequency of the mailings and the short amount of time the captive had to broadcast. This would prevent the more advanced solvers, or those with extra time on their hands, from solving everything before more casual players had a chance. And it would give us a bit of control over the game’s pace.

We presented the idea to CAH. They loved it, and gave us the go-ahead. But, they said, most of the gifts are already settled, so you’ll have to build around what’s there.

Also, the first deadline is ten days away.

The Team

The Mystery League is myself and my wife Sarah. Sarah is the voice of reason to my voice of madness. She’s also an ace researcher and writer; without her help, all the puzzles I build would be dry skeletons of logic and wordplay. But she’s not full-time; she’s got a job, and we’ve got two young kids.

Wil also had a full-time job keeping him busy. The prospect of building this whole thing more or less alone was giving me a case of the fantods. Then I learned that my friend Jon had just quit his job—and while his reasons for doing so weren’t explicitly to spend his days building out a puzzle game, he certainly was happy to have that to fill the void. Jon’s inexperience with puzzles was a huge asset; he would be our litmus for whether any given logical step was in fact a leap too far.

Finally, we had Tom, humble Minnesotan, intern-at-large for Cards Against Humanity and, now, intern-on-loan for The Mystery League.

Jon, Wil, Sarah, Tom and Sandor

The Dad

At this point, there was just the roughest outline of a story. We had a room. Someone trapped in it. But who? Some combination of the year’s theme — Eight Sensible Gifts for Hanukkah— and the fact that I’m a father got us to this: a puzzle-loving dad, trapped by his two twenty-something kids, who, after a lifetime of getting puzzle hunts instead of proper Hanukkah gifts, turn the tables on Dad by knocking him out and locking him in a basement puzzle dungeon that will take him weeks to break out of.

We wanted Dad to be able to communicate live with the players, so we hit on the idea of using Periscope. For a while, we even thought that he should receive instructions from the crowd via the stream of messages that appear in the app in real time. How gloriously chaotic! How insane! (We eventually came to our senses and came up with a system that was a lot more measured. Later on, when I did the first live Periscope, I realized how impossible it would have been to try to focus both on solving puzzles in the room and watching a perpetual stream of comments and instructions fly by.)

But we had very little scaffolding for the puzzle itself. Normally with puzzle hunts you start at the end and work backwards. We didn’t have the luxury of time to map out the whole puzzle path, then work out the best possible puzzles to fit that path. The game was still seven weeks from starting, but we had a deadline staring us in the face: the envelopes had to go to the printer in ten days.

The Envelopes

Here’s what we were told by CAH:

  • Players would get 8 gifts, each delivered via USPS in an envelope.
  • The envelopes would be delivered roughly 3 days apart, from December 1 to December 22.
  • We could print something different on each night’s envelope, as long as it fit with the style: sensible.
  • We could print one line of text under the address.

The instruction to keep things sensible was actually a very helpful constraint. I worked with Amy Schwartz, CAH’s lead designer, to determine what kind of element would work well within her envelope design, which could be best described as bureaucratic. We quickly landed on bar codes, which are about the most boring and ubiquitous thing in the world, but have tons of potential as a mechanism for encryption.

The envelope spec, with a bar code that looks like it belongs there.

(Our instinct was confirmed when, on day one, one of the experienced solvers took a look at the bar code on the back of the envelope and dismissed it out of hand, sure it was just something put there by the Post Office.)

Wil, Sarah, Jon, Tom, and I took over the conference room at the office for the week, and banged our heads against the table and whiteboards, coming up with every possible way to encrypt information in bar codes. Actually, it was more than that—we had to juggle three categories of things:

  • How to encode information in bar codes.
  • What information that would be.
  • How that information would tie into things in the room.
The scribblings of a mad person.

We were starting from nothing here; the options were boundless. Were we looking to encode numbers or letters or words or codes or what? Answer: yes, sure, maybe, who knows. Whatever solutions we settled on would be set in stone, and we’d just have trust that our future selves would be smart enough to figure out what to do with them.

To make things more challenging, these eight bar code puzzles would not connect with each other. Because they were being delivered days apart, each would have to trigger a cascade of other puzzles — involving material found online, in the locked room, and in the real world — that would keep the players occupied until the next envelope arrived.

We built, tested, trashed, rebuilt, and retested. We got the last one done at the wire and sent the whole set off to the printer, praying that a) the resolution would be good enough for those slivers of black to show up and b) we didn’t screw anything up. One errant black line and the puzzle would be ruined.

Here are three of the bar code puzzles we came up with. (I’ll post the full list of puzzles at the very end of this series.)

Bar code #1: four books

Gift #1's bar code

The very first puzzle of the whole game was the bar code on the first envelope. This puzzle had the job of both confirming to players that, yes, there was a puzzle here and also telling them where to go next. (i.e. the Periscope account.) So we wanted it to be direct, but not obvious.

We concatenated four UPCs together to form the series of stripes above. This may look inscrutable to the untrained eye, but actually it’s easy to decode using any free bar code reader app. Give it a shot.

Bar code #1 solution

The bar code resolved to four books:

  • 9781434701923 — Follow: A Simple and Profound Call to Live Like Jesus
  • 9780546890648 — Periscope: Webster’s Timeline History, 1854–2006
  • 9780983493020 — Username
  • 9781602640436 — Smashed, Squashed, Splattered, Chewed, Chunked and Spewed

The book titles resolve to FOLLOW PERISCOPE USERNAME .… and then seven words that are way to long to be a username. We picked the longest title we could find, in order to build a simple indexing puzzle — taking one letter from each word in the title to form a final word. Within “Smashed, Squashed…” we found the letters for DUPEDAD, which nicely fit our theme. Satisfied, we stopped there, punting on how exactly we would clue the numbers needed for the extraction, since the clock was ticking and we had just a few more days to figure out all the rest of the bar codes.

Bar code #2: four products

Gift #2's bar code

The barcode on the back of the second envelope also resolved to four UPCs. This time they were nested, Cloud Atlas-style, with one barcode inside another inside another inside another. (I thought this would slow people down, but it didn’t, at all.) Starting in the middle and going out, they resolve to:

  • 0681706040714 — Chronicle Card Game
  • 0097368035041 — DVD of The Day Reagan Was Shot
  • 0042284744522 — CD of Chess (Original Cast Recording)
  • 0746775269456 — A Disney Snow White Doll

This puzzle was built for the second envelope out of eight, but it wouldn’t be received until people had been playing the puzzle for four days. Which felt like just about the right time to throw in a curveball. The intent here was to force players to snap out of the mentality that the whole puzzle could be solved on computers, and get them into the real world.

Bar code #2 solution

Taken together, the four items are a hint to find the SAN FRANCISCO CHRONICLE, from MARCH 30, 1981, look up the CHESS COLUMN, and take note of all the WHITE pieces. And if you’re wondering how far back the Chronicle’s online archives go, it’s 1985. I checked.

Screenshot of the microfilm reader, taken in the bowels of the Chicago Public Library

How this would all resolve to a message? Who knows. We took a note to stash a chess board in the room, and then vowed to solve that problem later.

Bar code #3: four ________

Gift #3’s bar code

Four UPCs again, though this time none of them represented actual products:

  • 0222767114169
  • 0316348814798
  • 0229111431842
  • 0131092103826

I learned a lot about bar code formats when making these puzzles. In a nutshell: UPC (the common format) is split in two halves. Each half is has a different encoding, which is a neat trick that allows a bar code scanner to read any UPC right-side-up or upside-down. Also, the final digit of a UPC is a check-sum, meaning it’s deterministic, based on the previous 12 digits.

Bar code #3 solution

For this puzzle, each left half of the bar code was a latitude, and each right half was a longitude. This one would take them a little longer to crack. They map to:

  • 22.2767, 114.169 — Hong Kong
  • 31.6348, -8.14798 — Morocco
  • -22.9111, -43.1842 — Rio de Janiero
  • 1.31092, 103.826 — Singapore

We needed lat/longs that mapped to those places, but because changing the final digit of a lat/long coordinate doesn’t move you too far, geographically, we had some flexibility. So we picked a final digit that made the whole number into a valid UPC code. This was crucial because a bar code scanner would fail if you showed it a UPC with an improper check-sum digit at the end.

Of course, latitudes and longitudes only go up to 180°, so how would a solver know where to put the decimal within these numbers? And are we talking positive or negative? Because most lat/long combinations land you in the ocean, there actually aren’t that many valid options. So we left that to the solvers to figure out.

As for what those locations mean, ever seen a Hope & Crosby movie?

Continued in part 2 »

Lots of pieces start to fall into place, a theme emerges, and we do our best Carrie Mathison on the conference room wall.

The Mystery League

Follow us on Medium or Twitter, or subscribe to our mailing list.



Sandor Weisz
The Mystery League

Commissioner of The Mystery League. Father of two, friend of millions.