The message, in the name of Al-Qaida in the Arabian Peninsula, appeared as a 72-hour deadline set by the group ended.
"In answer to what we promised ... to kill the hostage Paul Marshall (Johnson) after the period is over ... the infidel got his fair treatment," the statement said.
"Let him taste something of what Muslims have long tasted from Apache helicopter fire and missiles," the statement said.
Johnson, 49, who worked on Apache attack helicopter systems for Lockheed Martin, was kidnapped last weekend by militants who threatened to kill him by Friday if the kingdom did not release its al-Qaida prisoners. The Saudi government rejected the demands.
As the deadline approached, Saudi security forces launched an all-out search, going door-to-door in some Riyadh neighborhoods, as Johnson's wife went on Arab television Friday pleading for his release.
After Johnson's death was reported, his family was in seclusion at a town house in Galloway Township, N.J., where they have been holding a vigil.
A man standing in front of the house identified himself only as "Bill" and said the family did not want to talk to reporters.
One of the three photographs posted on the Web site showed a man's head, face toward the camera, being held by a hand. The other two showed a beheaded body lying prone on a bed, with the severed head placed in the small of his back, the clothes underneath bloodied.
The face looked like Johnson's.
The beheaded body was dressed in a bright orange jumpsuit, similar to those issued to suspected Islamic militants imprisoned by the United States at Guantanamo Bay — and similar to the suit another American captive, Nicholas Berg, was wearing when he was beheaded in Iraq last month by another group of Islamic militants inspired by al-Qaida.
"To the Americans and whoever is their ally in the infidel and criminal world and their allies in the war against Islam, this action is punishment to them and a lesson for them to know that whoever steps foot in our country, this decisive action will be his fate," the statement said.
The U.S. Embassy in Riyadh had no immediate comment. "We are working on verification," the spokesperson said. Spokespersons for the CIA and State Department in Washington also said they could not confirm the reports of Johnson's death.
A Saudi senior security official, reached by The Associated Press, said: "We have so far nothing on this."
Soon after the statement appeared, the Web site was inaccessible, with a message saying it was closed for maintenance.
Johnson was the latest victim of an escalating campaign targeting Westerners that Saudi and U.S. officials say aims to drive foreign workers from the kingdom and undermine the ruling royal family, hated by al-Qaida.
Johnson was seized on June 12, the same day that Islamic militants shot and killed American Kenneth Scroggs, from Laconia, N.H., in his garage.
Scroggs worked for Advanced Electronics Co., a Saudi firm whose Web site lists Lockheed Martin among its customers. The office number on Johnson's business card was for Advanced Electronics.
The same week as Scroggs' death, another American and an Irish citizen were also shot and killed in Riyadh.
Johnson's death was the second beheading displayed on the Internet by militants with grisly images.
Berg, a businessman, was beheaded in Iraq, and his last moments later appeared on a videotape posted on an al-Qaida-linked Web site. His body was found on May 12. U.S. officials say al-Qaida-linked Muslim militant Abu Musab al-Zarqawi may have been Berg's killer.
A senior Saudi official in Washington, who spoke on condition of anonymity, said the government did not yet have any independent confirmation of Johnson's death. "There is no body, and we know of no videotape," said the official.
Reached by phone at the Bethesda, Md. headquarters of Lockheed Martin Corp., a spokesman said the company had "no official notification on the status of Paul Johnson."
"But obviously we hope that the media reports people are seeing are not true," spokesman Jeff Adams said.
A message posted on the defense contractor's Web site reads "Our thoughts and prayers are with Paul M. Johnson Jr. and his family," but a notation on the message refers to it as "Employee Kidnapped."