Provable fairness

Before you play a single round, the house commits to a secret seed by publishing its SHA-256 hash. Outcomes are HMAC-SHA256(serverSeed, clientSeed:nonce) — the house cannot bend a roll without breaking its own commitment.

How to verify any round

Note the seed hash shown with each round you play.
Rotate your seed below — the old seed is revealed.
Check SHA-256(revealed seed) equals the hash you saw. The seed is a 64-character hex string, hashed as ASCII text (not as decoded bytes).
Recompute HMAC-SHA256 with the key = the same 64-character hex seed as ASCII text, and the message = clientSeed:nonce as UTF-8 (the nonce written in decimal). The nonce starts at 0 for each seed and goes up by 1 every round, across all games. The first 8 hex chars of the digest ÷ 2³² give the roll. Flip wins under 0.5 for frog; dice wins when roll × 100 is under your target.
Slots: five rolls come from the same digest — hex characters 0–7, 8–15, 16–23, 24–31 and 32–39, each ÷ 2³². Each reel's stop = floor(roll × 29), and the reel shows strip[(stop + row) % 29] for each row.
Blackjack: start from cards 0–51 in order (rank = card % 13, suit = floor(card ÷ 13)). For i from 51 down to 1, take the roll from HMAC-SHA256(seed, clientSeed:nonce:k) with k = 51 − i (so k runs 0 to 50), set j = floor(roll × (i + 1)) and swap cards i and j. The deal goes you, dealer, you, dealer (hole); after a split the first hand draws the next cards, and the split hand gets its second card when its turn starts. Re-derive all 52 cards and compare with the hand you were dealt. A hand still in play blocks seed rotation; a hand left open for over 10 minutes is auto-stood when you rotate, so a reveal can never expose a live deck.

Your client seed

Half of every roll is yours. This seed is mixed into each outcome — set it to anything afterthe house has committed and the server seed can't have been picked around it. Stored only in your browser.

Used by Frog Flip, Pond Dice, Slots and Blackjack from your next round. It appears in each round's record so anyone can recompute the result.

Independent verifier (runs in your browser)

Server seed (revealed, hex)

Client seed

Nonce

How poker decks are dealt

HoldemHeroes tables are run by our table server; the chips at them are held and settled by the poker canister on the Internet Computer.

Before each hand, the canisterdraws a seed from the Internet Computer's randomness and publishes its SHA-256 fingerprint. The table server has to shuffle with that seed: it can't pick another, and the canister refuses a hand committed to any other seed.
After the hand, the seed is revealed, and it must match the published fingerprint.
The shuffle: the seed's 32 bytes are read as four big-endian 64-bit words and start a xoshiro256** generator (its first 20 outputs are thrown away). Starting from the deck in order (card i: rank i % 13 from Two to Ace, suit ⌊i ÷ 13⌋ in the order ♠ ♥ ♦ ♣), for i from 51 down to 1 it picks j uniformly from 0 to i (rejection sampling, so no modulo bias) and swaps cards i and j. Cards are dealt from the end of that array.
The deal: one card to each player starting with the small blind (the first player to the dealer's left) and ending with the button, then a second card each in the same order; then flop, turn and river from the next five cards. There are no burn cards.
You are sent only your own hole cards. Other players see them only if they are shown at showdown.

What the checker below proves:that a hand's revealed seed is the one the canister committed to before the deal, and exactly which deck that seed produces, card by card. Compare it with the cards you were dealt and the board you saw.

What isn't proven yet:the table server deals the cards, so while a hand is running it knows every card, including yours. The seed only fixes the deck; it can't show that the server didn't make use of what it saw. The canister also doesn't record which seats were dealt in or where the button was, so matching cards to players is up to you: the checker shows where each card goes for the number of players you pick.

Check a poker hand

Runs in your browser. It reads the hand's commitment and revealed seed straight from the poker canister (a free public query, no sign-in), checks SHA-256(seed) against the commitment, and rebuilds the deck with the same shuffle the table server runs.

What about the arcade episodes?

Worm Frog, Frogris and Hopper are games of skill — there is no house randomness to commit to. Instead, each run gets a signed run token, and for every episode your inputs are recorded and replayed move-by-move on the server, which recomputes the score itself and rejects anything that doesn't reproduce — including runs faster than real time. Leaderboard and bounty placements only count for members who have bought chips (any payment method) or who bought or burned $RIBBIT for chips in the old system.

Entering the house…