Provably fair dice
Every online roll in Ludotok can be checked after the match, by anyone, without trusting our servers. Before the first roll the server publishes the SHA-256 hash of a secret seed. Each roll is then derived with HMAC-SHA256 from that seed, the players' client seeds, the match id and the roll number. After the match the seed is revealed, so your browser can confirm the hash and recompute every roll.
How does the commit-reveal scheme work?
- Commit. The server picks a 32-byte seed and publishes only
SHA-256(seed). Each player's app sends a small random client seed. - Roll. Roll n is
HMAC-SHA256(serverSeed, matchId + ":" + clientSeeds + ":" + n); the first four bytes as an unsigned integer modulo six, plus one. - Reveal. When the match ends the seed is revealed. Anyone can hash it, compare it with the commitment and recompute all rolls.
Why it matters
Because the commitment is public before the first turn and the roll formula includes seeds from every player, no account, skin, gift or purchase can change a roll, and neither can the server once the match has begun. The reference implementation is the open @ludotok/ludo-core package.
Verify a match
Every results screen shows the 26-character match id. Paste it on the verify page inside the game (Provably fair, in the lobby) or call GET /api/v1/matches/<id>/verify, which returns the commitment, the revealed seed, every client seed and the event log.
Frequently asked questions
What does provably fair mean?
The server commits to a secret seed by publishing its SHA-256 hash before the first roll, and reveals the seed after the match. Because the hash was public first, the server could not change the seed, and every roll can be recomputed from it.
Can Ludotok change a roll for a paying player?
No. Roll values are derived from the committed seed, the players' client seeds, the match id and the roll number. Skins, gifts and purchases never enter that calculation.
How do I verify a match?
Open the provably fair page in the game, paste the 26-character match id shown on every results screen, and your browser recomputes every roll with WebCrypto and compares it with the match log.