Are online backgammon dice rigged?

If you play backgammon online, you have probably wondered whether the dice are rigged. You danced four times against a two-point board. Your opponent rolled the one double that saved them, exactly when it mattered. Read the reviews of almost any backgammon app and the same complaint is there.

gammonchain is a free backgammon server built around one idea: you should not have to take anyone's word for it. Its dice are provably fair. No one, the server included, can predict or steer a roll, and after the match you can re-derive every roll yourself. Start a match, or read on for how it works.

Why so many players think backgammon dice are rigged

Streaks are normal, and they feel wrong. Against a board with one point open, 25 of the 36 rolls fail to come in. That is about 69%, so staying on the bar three turns running happens about one time in three.
The key rolls are the ones you remember. The double that turned a game sticks in memory; the hundred ordinary rolls around it do not.
Online, you play a lot. Play every night and one-in-a-thousand sequences turn up regularly.
You normally cannot check. When dice come from a server you cannot see, "they are fair" is a claim, not evidence. Doubting it is not paranoia.

What "certified random" can and cannot prove

Sites usually answer with an audit: a lab tested the random number generator and found its output uniform. That shows the generator can produce fair dice.

It cannot show that the roll in your game came from that generator unaltered, or that nobody saw it coming. A histogram of millions of rolls would look perfect even if a handful of key rolls had been chosen. gammonchain publishes totals too (a lobby panel counts every face, with a chi-square test), but that is a sanity check. The proof has to be per roll.

How provably fair backgammon dice work here

Every roll is built from secrets from more than one side, locked in before the first die is thrown:

The server commits. Before play, the server picks a secret seed and publishes a fingerprint of it (a SHA-256 hash), so it cannot swap the seed later.
Your browser commits. Your browser builds a chain of secret values, each one the hash of the next, and publishes only the end of the chain. Values are revealed one at a time and each must hash to the one before, so you cannot pick a convenient one, and nobody can work out the next.
Both players sign the commitments. The match header holds the server's fingerprint and both players' chain ends. Both browsers sign it before any value is revealed.
Each roll mixes both secrets. When you press roll, your browser sends your next chain value with the request. The dice are computed as HMAC-SHA256(server seed, match | game | roll number | … | your value). Each game's opening roll uses a value from each player.
The seed is revealed at the end. Every chain value is already in the signed event log, so once the seed is out, anyone can recompute every roll.

Why nobody can predict or steer a roll

The server cannot steer a roll, because its seed was fixed before play. It cannot predict one either, because it does not have your next chain value until you ask to roll.
You cannot steer your roll, because your values were fixed by the chain end you published. You cannot predict it, because the seed stays secret until the match ends.
Your opponent has neither the seed nor your next value.

The full protocol, with the exact byte formats, is in the dice fairness docs.

What you can verify, and how

Every match ends as a signed record: commitments, rolls, moves, the revealed seed, and Ed25519 signatures from the server and both players over a hash chain covering it all.

During the match, the fairness button shows the server's commitment and both chain ends; log shows the hash chain as it grows.
When the match ends, your browser verifies the record on its own, using the same rules engine and dice code the server runs. You see VERIFIED or VERIFICATION FAILED, each check with its result, and a table of every roll next to its re-derived value.
Later, download signed record and check the file any time under verify a record in the lobby. Nothing is sent anywhere.
Without trusting the verdict, read the checks yourself. The code your browser runs is served as plain, unminified JavaScript: the verifier, how each die is derived and the rules.

The verifier checks that the seed matches its commitment, that every roll equals its derivation, that every move was legal, that the score follows from the moves, that nothing in the chain was edited, and that both named players really signed. Change one byte and it fails. See verification and signed records.

What this does not prove

A server that leaks its seed. If the operator secretly gave one player the seed, that player could work out their own upcoming rolls, though not their opponent's, and could not change any die. No scheme where the server holds a seed rules this out. The signed record does show who played whom.
Bot matches. The server holds the bot's chain, so it cannot prove the bot did not know its own next roll. Your rolls are still unpredictable and unaltered. Bot matches are never rated.
Matches that never finish. A match stopped by a server restart, a failed start or 30 idle minutes produces no record.
Accounts. If you register, the server stores your key so it can sign you in by email, which means the operator could sign as you. A guest's key never leaves the browser.
Luck. Fair dice still produce streaks. This proves nobody chose your rolls, not that they were kind.

Fair dice backgammon: common questions

Are online backgammon dice rigged?

Usually you have no way to tell, and that is the real problem. Most sites ask you to trust a certified random number generator. On gammonchain you do not have to: every roll is derived from secrets both sides committed to before play, and you can re-derive each one from the signed record after the match.

Can the gammonchain server change or choose my dice?

No. The server commits to its seed before the first roll, and each roll also depends on a value from your browser that the server does not have until you roll. A changed die would no longer match its derivation, and verification would fail.

How do I check that my dice were fair?

When a match ends, your browser verifies the signed record and re-derives every roll, and shows you the result. You can also download the record and check it again later, in the verify panel on the site.

Why do I keep rolling badly if the dice are fair?

Streaks are part of fair dice. Against a board with only one point open you fail to come in about 69% of the time, so dancing three turns running happens about once in every three tries. Fair dice are not kind dice. They are dice nobody chose.

Do I need an account to play with provably fair dice?

No. You can play as a guest with a key generated in your browser. A guest's private key never leaves the browser, so nobody, including the server operator, can sign a match record in a guest's name.

Can I read the code that makes my dice?

Yes. The dice derivation, the rules engine and the verifier are served as plain, readable JavaScript, and your browser runs exactly that code to check your match. They are MIT licensed. The rest of the server's source is not published.

Play a match you can check

No account, no download. Play a person or a bot, and the verification is waiting when the match ends.

Play now — no sign-up