Hangman

How to play hangman

One player thinks of a word and draws a blank for each letter. The other guesses letters. A letter that appears in the word is written into every blank it occupies — one guess of a against banana reveals three letters and costs nothing. A letter that does not appear costs one part of the drawing: head, body, two arms, two legs. Six wrong and the figure is finished. Complete the word before that and you have won.

Here you guess by clicking the A–Z rack or just typing on your keyboard. You can also name the whole word at any time in the rail — a wrong call costs exactly one life, whatever it was.

Did the game change the word? Now you can check

This is the only complaint hangman generates, it is why Evil Hangman became famous, and on almost every site it is unanswerable: nothing at all stops an implementation from picking a different word once it has seen which letters you like. Certification badges do not help, because they are claims about an audit you did not see of software you cannot read.

So this page does something checkable instead. Before your first guess we generate a random 32-byte nonce, join it to the secret word, and show you the full SHA-256 of the pair. When the game ends we reveal the nonce and the word. You check them with a tool of your own:

printf '%s' 'NONCE:WORD' | sha256sum

Hash that exact string — the nonce, a colon, the word, nothing else. If it does not reproduce the hash you were shown, we swapped the word. It cannot be faked, because the hash was on your screen before we knew a single thing about how you would play. The board shows the first and last eight characters of it while you play, so you can screenshot the board at your first guess and compare afterwards without copying anything.

And the honest limit of a commitment computed on your own machine, because it is worth being exact: this page holds the nonce and the word the whole time. So the hash binds our code against changing its mind mid-game — the adaptive substitution that Evil Hangman is deliberately built on, and precisely what people accuse ordinary hangman sites of — rather than binding a remote operator against you. There is no remote operator here to bind. That is a real and useful property; it is a smaller one than "provably fair" usually implies, and we would rather say so than let the phrase do work it has not earned.

And here is exactly what that does not prove. It proves the word was fixed. It does not prove it was chosen without bias — we could in principle have leaned toward hard words before committing. That second question is answered by a different fact rather than by cryptography: there is no server here at all. The word pool is a static text file you can download and read, and the pick is made by window.crypto.getRandomValues inside your own browser, with rejection sampling so that even the modulo is unbiased. Nothing about your game is sent anywhere, so there is no place for a thumb to be on a scale. The commitment closes the one hole that leaves — our own JavaScript changing its mind halfway through.

Evil Hangman: the host that has not chosen a word

The adversarial variant comes from Keith Schwarz's Stanford CS106 assignment, and it is the reason hangman is worth writing an engine for at all. The evil host does not pick a word. It holds every word of the right length, and after each guess it splits what remains into groups by the pattern that guess would produce — the words with no e, the words with e in position three, the words with e in positions one and four — then keeps the largest group and answers with that group's pattern.

It sounds like cheating and it is precisely the opposite. Every answer it gives is true of every word it still holds, so it can never be caught contradicting itself, and it only commits to a real word when your guesses have squeezed it to one. You are not asked to take that on trust: the board prints how many words survive after every guess, and the rail prints the split it just made — "the host kept the 1,412 words with no T in them and threw away 588". At the end it re-checks the word it finally landed on against every answer it gave you and prints the verdict.

Our engine also exposes the one property that makes the whole thing honest: the host's surviving set is identical to the set you could recompute yourself from the public clue list and the public word pool. It has no private information. The rail prints both numbers side by side, so if they ever diverged you would see it.

How much harder is it, exactly?

Measured, not estimated, over all 8,636 five-letter ENABLE words. A player who simply walks the English frequency order — e, t, a, o, i, n, s, h, r, d — beats an ordinary host on 597 of them at six lives, which is 6.91%. Against the evil host that same player wins nothing, and loses in the most complete way the board allows: e, t, a, o, i and n are all misses, and 302 words are still standing when the sixth life goes. Anyone can check that 302 in one command. To beat the evil host that player needs eighteen lives. A better player — one that picks the letter whose worst case leaves the fewest words, which is the only sensible thing to do against an opponent choosing its answer after seeing your guess — still needs sixteen.

One honest footnote about our own host, because it is the kind of thing that usually gets left out. "Keep the largest group" is a heuristic, not optimal adversarial play, and our test suite contains the exact counterexample: on the 146 four-letter ENABLE words over the letters {a,d,e,l,r,s,t}, a perfect player holds our greedy host to 2 wrong guesses while a full-minimax adversary forces 4. Twice the damage from the same word set. We ship greedy anyway, because greedy is what the variant means and it costs O(n) per guess where minimax does not — but the suite states the cost rather than pretending there is none.

The three rules hangman implementations get wrong

1. A repeated guess must not cost a life. Guessing e twice is a wasted turn, not a wrong answer. In our engine the repeat is caught before the host is consulted, so nothing at all changes — not your lives, not the revealed letters, not the word pool, not the clue record.

2. A correct guess reveals every occurrence. One guess of a against banana reveals three letters for one turn and no lives. A clue is a set of positions, never a single index; implementations that reveal the first occurrence and wait for you to guess again are playing a different game.

3. The game ends on the last letter, not on the last life. Completing the word with one life left is a win, and it is a win on that call — no further guess is needed for the engine to notice. All three are tested by name, and the third has a footnote we kept because it embarrassed us: it is tempting to say the win check running before the loss check is what protects rule 3. It is not. Swapping those two branches changes nothing, because a correct guess never decrements lives — we swapped them and the suite stayed green, which is how an assertion that guards nothing gets caught. The property that actually carries the rule is a hit costs no life, and breaking that turns sixteen checks red.

Playing with a friend, on one screen or two

On one device, type your word into the box on the start panel and press Pass the screen. The word is never rendered — the guesser sees blanks, the rack and the gallows, exactly as if a dictionary had chosen it. This is the classroom and passenger-seat mode, and it takes no account and no second device.

Online, type your word and press Host online. You get a four-letter room code; send it however you like. When your friend joins, their board shows the right number of blanks — and their browser is never sent the word. Their guesses arrive at your page, your page applies the rules, and only the public state travels back: which letters are revealed, how many lives are left, which letters have been tried. Nobody needs an account and nobody installs anything.

Where the words come from

Two files, both downloadable, answering two different questions. Is this a word? is settled by ENABLE, the 172,820-word public-domain dictionary released by Alan Beale and Mendel Cooper that we already ship for our word game. Does anybody know this word? is a question ENABLE cannot answer, and it matters enormously: draw uniformly from ENABLE and your five-letter word is blype, aboma or antra. That is not a hard hangman, it is a broken one — there was never a word to find.

So the secret is drawn from a familiarity ranking: the intersection of ENABLE with Peter Norvig's published unigram counts from the Google Web Trillion Word Corpus, kept in frequency order, with the public-domain LDNOOBW obscenity list applied mechanically. The everyday setting is the thousand commonest words of your chosen length; wider is three thousand and starts to get odd. If you actually want blype, the third setting is the raw dictionary and it says so.

The bias in that ranking, stated rather than hidden: the corpus is web text, so its head leans toward the vocabulary of web pages — click, index, forum, shipping. Those are real, common, guessable words and they make fine hangman, but the proxy is "how often this appears on a page", which is not quite "how well known this word is". A spoken-language frequency list would be better and is not public domain. The obscenity list is matched exactly, over a version of itself closed under the regular English endings — the first draft matched it literally, and forty automated deals promptly served a word LDNOOBW lists in the singular and not the plural. It is deliberately not matched as a substring, which would take class, assess and cocktail with it. That costs a few innocent words and we accept it rather than hand-edit, because a hand-edited blocklist is an unauditable opinion and this one is a file with a hash. It filters obscenity, not unpleasantness: if a word list for a classroom has to be tighter than that, set your own word. The generator is tools/hangman_words.py and it prints its sources.

Questions people ask

How many guesses do you get in hangman?

Six wrong ones: head, body, two arms, two legs. Playground variants run from three to eleven parts by adding a face, hands, feet or a noose, but six is what almost every printed rule set uses and it is what this board draws. Correct guesses are unlimited and free.

What is the best first letter to guess?

Against an ordinary host, e — it is the commonest letter in English and appears in more words than any other. Against the evil host, frequency is worthless, because the host picks its answer after seeing your guess; what works there is the letter whose worst case leaves the fewest words standing. The board will tell you which letter that is, but only if you ask it to — Tell me the best letter in the rail starts switched off, because naming the optimal move is a solver and we would rather you decided whether you wanted one.

Can I set my own word?

Yes — type it into the box on the start panel, then either pass the screen or host a room.

Is Evil Hangman actually cheating?

No. It never gives an answer that is false of a word it still holds, and it commits to a real word the moment your guesses force it to. It is the strongest host that can still be honest, and the board shows you its surviving dictionary shrinking so you can watch that be true.

Is this free?

Yes. No signup, no ads, no video between rounds, no daily limit, no coins and no hints to buy.

The honest small print

The commitment uses the SHA-256 in fairdice.js, the same implementation our dice games' verifier runs on, and if that file fails to load the game still plays but the panel says unverified rather than showing a badge we cannot back. There is no leaderboard: a hangman score depends mostly on which word came up, and ranking that would be ranking luck. Win counts are kept in your own browser. The published figures on this page — 597 of 8,636, the eighteen lives, the 302 survivors and the greedy-versus-minimax counterexample — are computed from scratch in tools/hangman_test.mjs rather than quoted. That suite was validated by writing ten deliberate defects into the engine one at a time and recording how many checks each one turned red — nine of them broke between 1 and 17 checks, and the tenth, swapping the win test and the loss test, broke none. That last result is kept in the suite header because it is the useful one: the ordering reads like the mechanism behind “the game ends on the last letter” and it is not, so an assertion about it would have been green forever and guarded nothing. There is no published perft or solve for hangman and none is claimed.