The dice
All five games here run on the same two dice. This page shows where their numbers come from, why nobody can pick them — least of all us — and how you check that for yourself.
Why this page exists
31–45 % of all complaints in the reviews of the big backgammon apps are about the dice — more than about any other subject.
The suspicion is not a fringe opinion. It stands in the reviews in every language this site speaks: the dice are rigged, the opponent gets exactly the roll they need, after a purchase you lose the next game. Anybody who plays online has thought that sentence — and mostly there was nobody who took it seriously.
The usual answer is a certificate: an auditor confirms that the random generator is sound. That means ”believe the auditor” — at exactly the point where you do not want to believe anybody. So there is no seal here, but a computation you can redo yourself, for every single finished game.
Why no roll is chosen after the fact
Every game fixes its rolls before they fall. The server publishes a checksum at the start and only at the end the number every roll was computed from — if the two do not match, it is provable.
-
Before the game: the sealed envelope
The server draws a seed of 32 random bytes and publishes only its fingerprint — a checksum the seed cannot be computed back from. From that moment it is fixed; nobody can swap it without the fingerprint no longer matching.
-
Both players add something of their own
Each of you contributes an identifier of your own, and it goes into every roll. This is the step that bare checksum promises leave out — and without it everything else would be theatre: a server that also picks your values can try seed after seed until it likes the rolls, and only then publish the fingerprint.
-
An anchor from outside
On top of that comes a number from drand, a public randomness beacon produced jointly by several independent operators. The round named is one that did not yet exist at the moment of sealing. That closes the last gap: even if the server and both players were in league, they could not pick the rolls in advance.
-
The game runs
Every roll is computed from those parts, by the roll's running number. Nothing is decided in the moment you tap the cup — it stood fixed before the game began.
-
After the game: the envelope is opened
The server publishes the seed. Now both halves can be checked: does it match the fingerprint from before, and does it produce exactly the rolls that fell? If either does not hold, that is no longer a suspicion but a proof — and one anybody can carry out without asking us.
1 Fingerprint 2·3 Bound to 5 Seed
The computation, laid open
Here it is, whole. There is no second, secret part — what stands here is everything a roll needs.
Every roll is HMAC-SHA256(seed, binding ‖ number). Bytes from 252 upwards are thrown away so that all six faces stay equally likely; the rest is the remainder modulo six, plus one.
The seed is the key, the binding is the message: match number, game number, both players' identifiers and the anchor — each piece with its length in front of it. The lengths are not decoration. Without them the identifiers ”ab” and ”c” would give the same message as ”a” and ”bc”, and a player could map two different pairs onto the same stream of dice.
Why four values out of 256 are thrown away
256 does not divide by six. Simply taking the remainder gives the faces 1 to 4 in 43 out of 256 cases and the 5 and the 6 in only 42 — an excess of about two and a half per cent, easy to demonstrate over a hundred thousand rolls. That is exactly the scandal this page is meant to prevent. So the four topmost byte values are discarded and drawn again, and all six faces stay equally likely.
used, spread evenly over six faces discarded, another byte is drawn
Three ways to check it yourself
Everything the check needs is public — and not one of the three ways runs through us.
-
Recomputed in your browser
Every finished game has a page of its own under ”Check the dice”: fingerprint, binding, seed and every roll. Your device recomputes it there with your browser's own crypto — the verdict then comes from your machine, not from ours.
-
nard.gg — check the dice
This file recomputes a game's dice from the published values. It contains nothing of ours but the arithmetic itself — nothing loaded, nothing connected, nothing counted.
Download the verifier — one file, no network, nothing of ours. Save it and run it against any published record, any time.
-
By hand, or with a tool of your own
The formula above is the complete specification, and HMAC-SHA256 exists in every programming language. Anybody who wants to can write the checker in twenty lines and needs nothing from us but the published numbers. That is exactly what they are there for.
What we do not promise
From the moment of sealing, the server knows the rolls of the running game in advance. Removing that would need both sides to commit before every single roll and reveal afterwards — which costs a round trip per turn and invites simply refusing to reveal. We do not do it. And we write it down here rather than keeping quiet about it.
What does hold: every game draws a seed of its own, independent of all others — from one nothing follows about the next. And the proof lies open for every finished game, not on request but of its own accord.
The thirty-six rolls
And why does it still feel as though the dice were against you? Because randomness looks lumpy in small quantities. Two dice fall thirty-six ways, and whoever needs one particular way often waits a long time for it. The two grids here show that — the first, how many rolls reach a given distance at all; the second, how uneven real randomness looks in small numbers.
Two dice fall in thirty-six equally likely ways. Pick a distance and the table shows which of them carry a checker that far — on an open path, with nothing blocking the way.
Nothing picked — the table shows all thirty-six rolls.
21 different rolls, 6 of them doubles. The counting still goes in thirty-sixths: every double falls once, every other roll twice.
Roll them yourself
This table rolls in your own browser, with your browser's own randomness. After thirty-six rolls half the squares are still empty — that is not a fault, that is what randomness looks like.
Rolls in total 0
Doubles
When both dice show the same number it is played four times instead of twice. A double falls in six of thirty-six rolls — one turn in six.
That is why a double reaches further than any other roll: 6–6 carries twenty-four points.
The first roll
At the start each player rolls one die; the higher one begins and plays exactly those two numbers. A tie is thrown again. The first turn of a game is therefore never a double — 30 of the thirty-six rolls remain.