provably fairdiceguide
You verify backgammon dice with a promise made before the game and checked after it. Orion publishes a SHA-256 commitment to a secret seed before your first roll, reveals the seed when the game ends, and lets your browser recompute every roll at orion.arthea.ai/verify with just the game ID. If everything matches, the dice were fixed before play began and nobody, including us, steered them.
Every online player knows the feeling. You dance on the bar for three turns. Your opponent finds the one number that hits and covers. On a wooden board you would shrug, because you watched the dice leave the cup. Online, you are asked to trust a number you never saw generated. We did not want to ask for that trust. We wanted to make it checkable.
What does commit-reveal actually mean?
Picture a sealed envelope. Before you sit down, the house writes the whole evening's dice inside, seals it, and hands you a photograph of the seal. When play ends, the envelope is opened. If the contents match the seal, the rolls existed before the game did, and nothing could have been picked mid-game to hurt you. Commit-reveal is that envelope, built from arithmetic. The seal is a SHA-256 hash, and no one can produce a different seed that matches it. Four steps carry the proof from our server to your browser.
Before the game. The server draws a secret random seed and hashes it with SHA-256. That hash is the commitment, and it is attached to your game before the first roll. From that moment the whole game's dice are already determined. The server has published a promise it can no longer edit.
During the game. Every roll is derived from the seed with HMAC-SHA256: seed and roll number in, two dice out. The position, the score, the cube, who is about to win: none of it enters the computation. The server is not choosing rolls. It is reading out a list it committed to before you played.
When the game ends. The seed is revealed and stored with the game record. This is the envelope opening. Anyone can hash the revealed seed and compare it with the commitment that was published before the first move, and the two must be identical.
Verify it yourself. Open orion.arthea.ai/verify in any browser and enter the game ID. The page recomputes everything locally with Web Crypto, the cryptography built into the browser itself: first the SHA-256 of the revealed seed against the original commitment, then every roll of the game, die by die. No account, no app, about a minute.
A full match establishes three facts at once:
- The revealed seed hashes to the exact commitment published before the first roll
- Every roll of the game derives from that seed by HMAC-SHA256, so nothing was rerolled or swapped
- The dice were never adapted to the position, the score, or the player
What would a mismatch prove?
A mismatch would not be a display bug. It would be evidence. If the revealed seed does not hash to the commitment, the dice were changed after the game began. If a single roll fails its HMAC check, the dice you saw were not the dice that were committed. Either failure is proof of tampering that anyone can reproduce from the same record, on any machine, forever.
This is also why you should never see one. The commitment is published first, before a single checker moves. A house that wanted to rig this game would have to publish the evidence of its own rigging in advance, then hand every player the tools to find it. We do not ask you to trust that we are honest. We built the system so you do not have to.
Nobody can aim a roll that was sealed before the game began.
If the dice are provably fair, why do I still get bad rolls?
Because fair dice are still dice. You will get closed out on the bar. You will need anything but a 2-1 and roll the 2-1. Over thousands of games the numbers flatten toward the true distribution, but one evening promises nothing. What verification removes is the question underneath the tilt. That miracle shot was fixed before either of you touched a checker, and it was not aimed at you. Knowing that will not soften the roll. It does let you stop auditing the universe and get back to playing the position.
Dice are the loudest suspicion, but not the only one. The same server that commits to your rolls also validates every live move at source, so a modified client cannot slide a checker where the rules do not allow it. Fair rolls and legal moves come from the same authority.
Can I try the verifier before the game is out?
Yes. The verifier is live today at orion.arthea.ai/verify, and it includes a demo replay, so you can watch a complete verification run on a sample game, commitment to seed to every roll, before you have a game of your own. For Orion itself, the door at orion.arthea.ai/go carries the App Store and Google Play links and always shows what is available right now.
Fair dice are the floor the whole voyage stands on. Twelve destinations, ten leagues, one rule underneath everything: when a game ends, you never have to take our word for it.