Free tool · nothing leaves your browser

Check the dice yourself

Finish a game of backgammon and it hands you a link that lands here with everything filled in. Or paste the values from any game below. This page recomputes the commitment hash and re-derives every roll from scratch — if a single die had been changed after the fact, the check fails.

The game's receipt

Commitment (shown before the game)

Server seed (revealed at the end)

Client seed (yours)

Rolls the game showed you (optional — two digits per roll)

The protocol

Roll i comes from the bytes of
SHA-256(server : client : i : counter) Each byte becomes a die with (byte mod 6) + 1. Bytes 252–255 are thrown away, because 256 is not divisible by 6 and keeping them would make low faces very slightly more likely. The counter only advances if a hash runs out of usable bytes.

The seed is committed before the first move, so the dice cannot depend on the score, the board, or how well you're doing.

Hash self-test

Our SHA-256 is plain readable JavaScript in fairdice.js, checked here against the published FIPS 180-4 vectors so you can confirm it's the real thing.

Why a verifier exists at all

Every dice game online gets the same accusation and gives the same non-answer. Players say the rolls turn against them when they start winning; operators reply that their random number generator is cryptographically secure. Both statements can be true at once, which is exactly the problem — a secure generator says nothing about the code that decides when to call it, or what happens to the result afterwards. One popular Catan site publishes its dice function as open source, and its players still point out, correctly, that the surrounding logic isn't published.

Commit-reveal closes that gap. We publish a hash of the seed before you play; the seed alone determines every roll; we reveal it when the game ends. If we had swapped a roll, the seed we reveal either wouldn't hash to the commitment we already gave you, or wouldn't produce the dice you saw. There is nowhere for a thumb on the scale to hide, and you don't have to trust us to know it — that's what this page is for.

Your seed matters

You supply half the input. We commit our half first, before we can see yours, so we can't go fishing for a seed pair that suits us. If you want to be maximally careful, type something unpredictable of your own into the seed box before you start a game rather than accepting the one we generate.

Nothing on this page is uploaded. The hashing and the checks run entirely in your browser — you can save the page and fairdice.js and run it offline, or re-implement the twelve lines of derivation in any language and compare.