In 1954, a man named Teddy Daniels arrives at a mental hospital in the Boston Harbor Islands in 1954, accompanied by a partner named Chuck. Teddy believes they have been sent to the hospital, named Ashecliffe, to investigate the disappearance of a patient. The head of security, Deputy McPherson, has the men surrender their firearms and takes them to the office of the facility's main doctor, Dr. Cawley. Cawley tells the men that a delusional patient named Rachel Solando has vanished. Teddy finds two mysterious notes in Rachel's cell that read "The Law of 4" and "Who is 67?" Teddy becomes suspicious when he learns that Rachel's doctor, Dr. Sheehan, has been sent away, and also when he meets Cawley's associate, a German man named Dr. Naehring.
Teddy has a dream where his dead wife Dolores tells him that Rachel is "still here." Believing that Rachel had help escaping, Teddy interviews the other patients in her group therapy sessions, but learns nothing. Marooned in a shelter during a storm, Teddy tells Chuck that the arsonist who killed his wife, Andrew Laeddis, should be at Ashecliffe, but is seemingly missing. Teddy also reveals that he interviewed a former Ashecliffe patient named George Noyce, who told him that Ashecliffe is conducting illicit experiments on political subversives. Chuck worries that the men have been lured to the island and are being set up by Cawley and other Ashecliffe employees.
Teddy learns that Ashecliffe has 66 patients, believing Andrew Laeddis to be the 67th. When Rachel Solando turns up alive, Teddy interviews her, but fails to understand a seemingly delusional story she tells him about "swimming in the lake." Teddy suffers a migraine and dreams of Rachel, three dead children, a scarred man he believes to be Andrew Laeddis, and Dolores, who tells him to find Laeddis. Teddy wakes up and goes searching for Laeddis with Chuck in Ward C, where Ashecliffe houses the most dangerous patients. Teddy attacks one patient, and follows a voice until he finds a badly scarred George Noyce, who tells Teddy his investigation is fake and to leave Dolores behind. Noyce also tells Teddy that Laeddis is being kept in the lighthouse, which is where lobotomies are performed.
Disturbed by Noyce's words, Teddy becomes suspicious of Chuck and heads toward the lighthouse alone but cannot reach it due to the high tide. In a nearby cave, Teddy finds an older woman he believes to be the real Rachel Solando. The woman tells Teddy that Ashecliffe has likely been poisoning his food with psychotropic drugs, causing his migraines and dreams, and has been conducting brainwashing experiments on patients just like Nazis did on prisoners in concentration camps. Teddy climbs back up to a main road the next morning and is ferried back to Ashecliffe by a warden, where he is reprimanded by Cawley for not trusting his "method." Cawley also tells him that Chuck does not exist.
Later, a panicked Teddy attempts to reach the ferry but is intercepted by Naehring. Teddy attacks and sedates Naehring when Naehring suggests that he is a "monster" suffering from a "wound." Teddy hijacks one of the facility's cars, but decides to go to the lighthouse instead to save Chuck, against the wishes of Dolores's ghost, whom he symbolically leaves behind. At the lighthouse, Teddy finds Cawley waiting for him. Cawley explains that Teddy is Andrew Laeddis, Asheliffe's 67th patient, admitted two years prior after his suicidal wife Dolores killed their three children Henry, Simon, and Rachel. Cawley reveals that "ANDREW LAEDDIS" and "TEDDY DANIELS" are anagrams, as are "RACHEL SOLANDO" and "DOLORES CHANAL."
Teddy is horrified to learn that the last two days have been "radical, cutting-edge role-play," in which everyone around him has performed for his sake, including his psychiatrist, Dr. Sheehan, who has been posing as his partner Chuck. Cawley and Sheehan express hope that they can rehabilitate Teddy and avoid having to perform a lobotomy, which the medical board has recommended after Teddy attacked George Noyce for calling him "Laeddis." Cawley reveals that Teddy inhabits a delusion in which he is a U.S. Marshal investigating a disappearance, in order to avoid reckoning with traumatic events in his own past.
Upon hearing these revelations, Teddy suddenly remembers his former life as Andrew Laeddis, where he one day came home from work and killed his wife Dolores after learning she had drowned his three children in a lake. The next morning, Teddy acknowledges his traumatic memories, but Cawley warns that he has "broken through" before and subsequently regressed. Soon after, in a conversation with Chuck, Cawley's suspicions are confirmed, as Teddy lapses back into his U.S. Marshal persona. Teddy asks Chuck whether it is better to live as a monster or die as a good man, and walks in the direction of the lighthouse with Cawley and others.