Dice you do not have to take our word for

The part a good random number generator cannot fix

Our dice come from the operating system’s cryptographic generator — the same source that protects a bank login, not the shortcut most games use. That settles how random the numbers are. It settles nothing about the question players actually ask.

A die drawn honestly and a die chosen deliberately look identical afterwards. Both are just a number in a log.

So the useful question is not "is your generator good?" It is "can I check?" Everything below exists to make that answer yes, without asking you to believe a word we say.

1. 1

   Seal

   Before the first roll the server draws a secret 32-byte number — the server seed — and publishes its SHA-256 fingerprint to both players. The fingerprint gives nothing away, but the seed is now fixed: any other seed produces a different fingerprint.

   commit0df0916cb0…2904e706
2. 2

   Mix

   Your app generates a random seed of its own and sends it when you sit down. Both players’ seeds go into every die, so we cannot hunt in advance for a seed whose rolls happen to suit us — at the moment we commit, we do not know what you are about to contribute.

   clientSeeda26460084a0ef89b:d4f28bac6efd1b6e
3. 3

   Derive

   Each die is read out of an HMAC-SHA256 of the seeds and the roll number. Nothing is stored and nothing is chosen: the same three inputs always produce the same die, and no other input produces it.

   die(n) = (HMAC-SHA256(serverSeed, "clientSeed:n:round")[0] < 252) % 6 + 1
4. 4

   Open

   When the game ends we publish the server seed. Hash it, compare with the fingerprint you were given before the first roll, then recompute every die. A server that had picked even one roll fails one of those two checks.

   serverSeed5cde3365be…7b6b2bd5

The values above are the real proof of game #148, a finished game anyone can look up. Put that number in the box below and watch it come out right.

Why no face is even slightly likelier

A byte is a number from 0 to 255 — 256 possibilities. 256 is not a multiple of six; it is 6 × 42 with 4 left over. Take the remainder of a byte divided by six and four faces quietly get 43 chances out of 256 while the other two get 42. It is a tiny bias, and across a million rolls it is a real edge. So those four values are thrown away.

252 = 6 × 42. Every face gets exactly the same number of bytes, so every face is exactly one in six.

• TelegramDice rolled in the bot chatRoll with Telegram’s own dice animation and that number comes from Telegram, not from us; no seed of ours reproduces it. The published proof lists exactly which positions those were, and the ledger marks them with the Telegram symbol instead of a face. For a fully checkable game, roll in the app.
• PracticeGames against the computerThe offline practice game rolls on your own device, with no seed and no proof. There is no opponent and no stake, so there is nothing to prove and nothing at risk.

Everything else — online 1v1, friend rooms and tournaments, free or staked — runs on the chain described above.

const enc = new TextEncoder();
const hex = (b) => [...new Uint8Array(b)].map((x) => x.toString(16).padStart(2, '0')).join('');

// 1. the seed we revealed must hash to the commitment you were given first
const commitOk = hex(await crypto.subtle.digest('SHA-256', enc.encode(serverSeed))) === commit;

// 2. every die, re-derived from that seed
const key = await crypto.subtle.importKey(
  'raw', enc.encode(serverSeed), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);

async function die(n) {
  for (let round = 0; round < 16; round++) {
    const mac = new Uint8Array(
      await crypto.subtle.sign('HMAC', key, enc.encode(`${clientSeed}:${n}:${round}`)));
    for (const b of mac) if (b < 252) return (b % 6) + 1;
  }
}

Every proof is public at /fair/<id> — no key, no account, no players and no amounts. Just the dice.

Questions people actually ask