Kevin McDonaldJun 18, 2025

Long before the internet, some phone networks were hackable by playing a single tone at 2600Hz.

Whistled into a phone, it could grant you unrestricted access. Do you have the vocal chops to be an old-school phone phreak?

I built a web app to test your ability to produce the legendary frequency. You won't get free long distance calls but you will get some honor in the knowledge that you could have been a cool hacker. 😎

I am sad to say that I can only whistle up to 1100Hz... But my wife (a long time woodwind player) is able to consistently get it.

Give it a try: https://phreak.kmcd.dev/

#phreaking #2600Hz #bluebox #RetroComputing #hacker #infosec #Tech

Phone Phreak Emulator

Test your phreaking skills by hacking this phone line.

Show threadIan K TindaleJun 18, 2025
@sudorandom when was this ever true? The earliest phones I remember in the 1960s used carbon microphones but had no awareness of tones anywhere in the system, at least from the GPO phone in the hallway by the door. You could dial by imitating clicks by pressing the hook in and out several times, but there was absolutely nothing to do with tones about a phone.
Show threadKevin McDonaldJun 18, 2025

@u0421793 Source: https://en.wikipedia.org/wiki/Phreaking#History.

Indeed, this did happen in the 1960s from what I read. I believe this came about "Touch tone" era of telephony, where tones were indeed used to input number input and special tones were used for control systems. It's my understanding that it was new shiny at the time because yes, rotary phones would indeed disconnect and connect the line in order to input numbers. Tone tone would eventually replaced that system.

Phreaking - Wikipedia

Show threadIan K TindaleJun 18, 2025
@sudorandom no, push button DTMF phones didn’t exist back then – they were to come in in the early-middle 80s – but you couldn’t just whistle a tone into them, that’d be insane, it was dual-tones multi-frequency, but none of the frequencies are what you describe, and anyway you’d need to generate two frequencies at once, differently per key
Show threadPhilSalkieJun 18, 2025

@u0421793 @sudorandom
IIRC, the 2600Hz tone was part of the system that allowed you to make long distance calls without operator intervention. Time frame was late '60s, early '70s - when in-band signaling was in use for phone equipment on one end of the wire to tell the equipment on the other end what was happening. (Like sounds made when a coin was dropped into a pay phone.) DTMF was used for long distance network signaling starting around 1959.

The 2600Hz tone was used by the local central office to tell the equipment on the remote end that the call had finished.
The hack was that if you played a 2600 Hz tone into a phone that was making a long distance call, the far end would hang up and the near end would not - you could then use a special DTMF box that generated network tones (not the same pairs that later were used by touch tone phones, but the same idea - network DTMF was decades earlier) to dial a new number on the far end. By timing the disconnect correctly, you could make the remote calls without the local end generating any billing information.

Lots of link rot if you go searching for exact details.

Show threadIan K TindaleJun 18, 2025
@PhilSalkie @sudorandom well, no, that’s now how it was

The GPO-installed phone in the hallway of the homes which had a phone were not based on any tone at all. They were based on disconnects, by the dial mechanism. Tones were simply not part of the system – at least from the GPO phone in the home. DTMF phones came with GPO deregulation in the mid 80s, and didn’t involve a single frequency but a dual tone multi frequency system.
Show threadPhilSalkie

@u0421793 @sudorandom

You're correct that home DTMF (Dual-Tone Multi-Frequency) came later, when used for the home-to-central office connection. The thing is that DTMF was in use for decades before that for central office-to-central office signalling - by the time Touch-Tone phones were introduced, DTMF was a very mature technology.

At the start of dial/disconnect calling, connections between distant central offices still required operator intervention ("Long Distance Calling"). After a while, the trunking system was automated - for example, there might have been 100 physical pairs run between two large cities, and calls were placed on them automatically, with the first few numbers dialed causing a trunk selection, and the remaining numbers being sent over the trunk to dial the destination line at the far end. There were different busy signals for "destination line in use" and "no trunk available" - in the US, those were slow busy and fast busy.

However there was more information that needed to be sent along the trunk line than could be encoded in just the clicks - that's where DTMF came in, it wasn't originally intended for home use at all. Various sorts of billing and logistics information could be sent along with a call - eventually the dial pulses would be captured locally, the trunk assigned, and the number re-transmitted via network DTMF to the far end. This kept the trunk from having to be held while the user dialed and dialed - much more time-efficient.

Jun 19, 2025 at 2:06pmWeb
Show threadPhilSalkieJun 19, 2025

@u0421793 @sudorandom

Sometimes you could hear those network tones - dial a long distance number with a rotary phone, and you might hear a distant "beep-bloop-blip-beep-blip-blip-beep" as DTMF was sent from local CO to distant CO. Doing this decreased the amount of time each call took on the trunk line because rotary dialing took time. (As a side note, in the US, the "Area Codes" - three digits, x0y or x1y - were selected so that large areas (NY - 212, LA - 213, Chicago - 312) were "Low Dial Pull", so it took less time than dialing Oklahoma - 405. This saved the users' time, but not time on the trunks.)

When DTMF was used for long distance redialing, there needed to be a way to signal the remote side that the local side had hung up. Two different tones were used for that, the "Caller Hang Up" was 2600 Hz, dunno what the "Receiver Hang Up" was.

The whole "Phone Phreaking" thing in the '70s was about figuring out what was going on with the tones, and how they could be generated by individuals to control the network. One story is that the whole thing started because someone was playing electronic music to a friend on a long distance call, and anytime they played a certain piece, the call would drop. They spoke to someone knowledgeable at the phone company, and was told about the disconnect tones, so any reasonably clean 2600Hz tone for a quarter-second or so would disconnect the far end of the call, leaving the near end still attached to the trunk line.

Show threadPhilSalkieJun 19, 2025

@u0421793 @sudorandom

So, even from a rotary phone, with the right equipment (a 2600Hz tone generator and a box that could make network DTMF tones) it was possible to make a long distance call to a specific area, disconnect the far end with a 2600Hz beep, then network DTMF a different number through the handset microphone for the remote CO to dial, and connect to the phone you actually wanted to call. I guess the disconnect tone caused the billing clock to stop, or maybe you had to call some toll-free or reserved system number to then disconnect and make a free call. (In the US, the last four digits "99xy" were reserved by COs for things like "silence", "busy", "ringtone", "ringback", "time", etc.)

The hand-held DTMF concept wound up being adopted by alternate long-distance providers in the US and other countries - if you wanted to use an alternate carrier, you had to touch-tone in some codes, but couldn't do so if you had a dial phone or were on a dial payphone, so you could get a hand-held tone generator to put against the handset's microphone. You could then use Sprint or MCI or whomever as your long distance provider by tone dialing the proper numbers. Some of those units had memory so you could just push one button to send the provider selection and your account number with one press, then dial the number you wanted on the little keypad. (Of course, those DTMF tones were the "Touch Tone" frequencies, different pairs from the "Network" tones.)