By BluffKing · Nov 5, 2026

Can Anyone See Niuniu Cards Early or Peek at Others?

During bidding and betting the server sends nobody’s cards, not even yours; the reveal phase sends only your own five. Why modded clients, traffic capture, spectating and collusion see nothing, and where the server-side limits are.

Short answer: in BluffKing Niuniu you cannot see your own cards early, and the normal game flow gives you no way to see another player’s cards during a hand. This is not because the screen covers them. During banker bidding and betting, the server sends nobody’s cards to any phone, not even your own. In the reveal phase it sends only your own five cards. All cards at the table become public together only after everyone has revealed and the hand is over. A card that never reached your phone cannot be pulled out by modding the client, capturing traffic or reconnecting. The explanation below is based on the source code as of November 5, 2026.

What you can see, and when

Phase	You see	Others see
Banker bidding	No cards at all; you can see that others have acted, but whether they bid is shown only after the phase ends	No cards either
Player bets	Still no cards; you can see that others have bet, but the amounts are shown only in the reveal phase	No cards either
Reveal	Only your own five cards	Only their own five cards, not yours
Hand complete	Every player’s cards and hand	Every player’s cards as well

Some Niuniu variants let each player see four cards before deciding whether to bid for banker. BluffKing’s Niuniu does not: bidding, banker handoff and betting all happen before anyone has seen a single card. In the reveal phase the only action is “Reveal”. The server works out the hand by rule, so you do not pick the three cards yourself and there is no decision left to change. The same applies after the 15-second clock runs out: no banker bid, the minimum bet and an automatic reveal.

Why you cannot see your own cards early

The function that decides which cards a viewer may see is visible_cards in server/src/niuniu/hand.rs. It has three rules: during bidding and betting it returns nothing for anyone; during the reveal phase it returns only the viewer’s own seat; after the hand is complete it returns every seat. Each time the table state is sent, server/src/niuniu/room.rs first builds a shared view in which every seat’s cards are empty, then fills them in per account by calling that function for the seat that account occupies. The table view you get after reconnecting goes through the same path, so reconnecting does not reveal cards early either.

We built it this way because the rule is “bet first, look later”. If bidding and betting should be made without knowing the cards, the most reliable approach is for the phone to hold no cards at that point. Once a card is on a phone, someone can read it from memory or network traffic; data that was never sent cannot be read.

Why you cannot see other players’ cards

Modded client, memory reading, traffic capture: in the data the server sends you, other players’ cards stay empty until the hand is over. There is no card face hidden behind the card backs on screen.
Spectating: a spectator has no seat, so under the rules above they receive no cards until the hand is complete.
Players sharing cards with each other: this gains nothing under these rules. Players see their own cards only in the reveal phase, when bidding and betting are already locked, so telling each other cannot change any decision or result in that hand.
Bots: bots do not look at cards either. A bot bids for banker only based on whether it has enough chips to cover the bank, and always places the minimum bet (play_bots in room.rs). A bot cannot be peeking at your cards.
Who banks next: this is decided from the previous hand’s cards, which are already public (the player with the best hand that reaches the table’s banker threshold takes over), so it uses only information everyone has seen.

Where the cards come from, and checking afterwards

At the start of each hand, the dealing program locks an encrypted standard 52-card deck and the seats for that hand, and puts its commitment in the table view. New hands also have players commit to and then reveal their own random numbers, which together set the card order. Each seat takes five cards in order. After the hand, players who were in it can verify it from the menu: the browser uses the verifier shared with Texas Hold’em to check the deck and the deal position of each card, and you can download the proof to check it yourself. Secret seeds are not published, and undealt cards have no opening proofs. See fairness by game for the exact scope.

Limits: when someone could still know the cards

The server deals and settles each hand, so it holds the whole deck from the start of the hand. We do not claim that “even the server cannot see the cards”. What the conclusion above says is that game APIs, table updates, spectating and reconnecting do not hand unrevealed cards to players. Cases that remain: your own device being controlled by someone else (they see what you see), the server or host being compromised, and bugs this review did not find. So the accurate statement is “current source code gives players no path to see cards early or peek at others”, not “cheating is impossible”.