Fair dice

Every roll in Backgammon is provably fair. We lock in the dice before the match starts, you add your own randomness, and after the match you can check every roll yourself. Neither we nor your opponent can change them.

How it works

1. We commit. Before each match, our server picks a secret random server seed and shows both players its SHA-256 hash, the commitment. A hash is a fingerprint: it shows the seed was fixed in advance without revealing it.
2. You add your seed. Each player's browser adds its own random client seed. Because we fixed our seed before seeing yours, we cannot pick a seed that gives particular dice.
3. The dice are computed, not drawn. Each roll comes from the formula below, so the whole match's dice follow from the seeds and nothing else.
4. We reveal. When the match ends, the server seed is published. Anyone can check that its hash matches the commitment and recompute every roll.

The exact formula

Roll number n of a match uses:

bytes = HMAC-SHA256(key = serverSeed,
                    message = `${matchId}:${clientSeed}:${n}`)

The key and message are UTF-8 text. Read the 32 bytes in order. Skip any byte of 252 or more, and turn each kept byte into a die with byte % 6 + 1. The first two kept bytes are the two dice. Skipping bytes 252 to 255 makes every face exactly equally likely, since 252 is a multiple of 6. In the very rare case that fewer than two bytes are kept, the message gets :1, then :2, and so on added to the end until two dice are found.

Opening roll. Each game starts with an opening roll that decides who moves first: die 1 belongs to the first seat and die 2 to the second. If they tie, the opening is rolled again with the next roll number.

The commitment is SHA-256(serverSeed) as lowercase hex. You do not have to trust this page: anyone can verify with any HMAC-SHA256 tool, such as a command line or an online calculator, using the formula above.

Check any match

Open a finished match in Backgammon and use its fair dice link, or add ?match= and the match id to this page's address, for example backgammon.powellplay.com/fair?match=abc123. This page then loads the match, checks the revealed seed against the commitment, and recomputes every roll in your browser.