Is Zha Jin Hua Dealing Fair? Who Can See Your Cards, and Is Blind Really Blind?

Zha Jin Hua players keep asking three things. Are the cards really random? Can anyone peek at mine? And does a player who is playing blind secretly know their own cards? Here are the answers based on the code BluffKing runs today, what you can check yourself, and what we cannot do yet.

• Random: every hand uses one full 52-card deck. The server shuffles and encrypts the deck and publishes a “fingerprint” of it first. Then the browser of every human player in the hand adds a random number, and together those numbers decide the order in which the locked cards are dealt. The shuffle never reads membership, purchases, host status or past results.
• Other people can’t see your cards: other players, spectators, the host and bots cannot get the cards you have not shown. Cards become visible only where the rules say so, such as to the two players in a compare or at a forced showdown.
• Blind really means unseen: until you tap “Look” (while you are still in the hand and it has not ended), your three cards are not sent to your phone or browser at all, not even to your own device. The same holds for every other blind player.
• What you still have to trust: the server has to decide who wins a compare, so it knows the cards while the hand is played. Default dealing does encrypt the deck, but the server holds the key; Zha Jin Hua does not have Hold’em’s advanced encrypted mode, which splits the key among players.

1. How are the cards shuffled and dealt?

1. Lock the deck. Before each hand the server shuffles one standard 52-card deck with the operating system’s secure random numbers, encrypts every card and publishes a fingerprint (commitment) of the locked deck. A deck swapped after that point would not match at verification time (whether you can catch a later swap depends on the browser you played on still keeping the opening record; see section 6).
2. Players add random numbers in two steps. Each human player’s browser generates a random number and first submits only its fingerprint. Once everyone has submitted, each reveals the number itself. Nobody can see someone else’s number first and then change their own.
3. Everyone’s numbers set the deal order. The deck fingerprint, every player’s number and the hand ID together produce an order that decides which locked card goes to whom; each seat then receives three consecutive cards in seat order.
4. Check it afterwards. When the hand ends, the players in it can fetch a proof and check on their own device that the deck was exactly one standard deck, that the order really came from the deck locked at the start plus everyone’s numbers, and that every card they saw matches.

Why nobody can pick the cards. When the server locks the deck it does not yet know the players’ numbers, so it cannot arrange an order that favors anyone. When players submit their numbers they know neither the locked cards nor anyone else’s number, so they cannot pick either. As long as one player’s number is truly random and arrives in time, and nobody submits a fingerprint and then holds back the number (see section 6), the final deal order is random.

The public data does not reveal any cards. The table only sees the deck fingerprint and the players’ numbers. Those tell you which locked card goes to which seat, but the locked cards themselves are never published or sent to any player, so nobody can work out who holds what.

2. Why is it the same for every player?

Dealing uses only the locked deck, the hand ID, the seat list for that hand and the players’ random numbers. No account identity, membership level, purchase history, stack size or recent losses go in, so there is no step that “helps new players”, “rewards paying players” or “makes a winner give it back”.

Bots follow the same rules. A bot does not know its own cards before it looks, and after looking it decides from its own three cards plus the public betting and compare results. It cannot read anyone else’s cards or the deck.

Random does not mean luck is shared out evenly. Several weak hands in a row, or an opponent hitting big hands back to back, can both happen. We once checked all 11,397 Zha Jin Hua hands and found Leopards at the rate theory predicts; see the Leopard frequency check.

3. Can anyone else see my cards?

When the server sends table data, it filters it per person and only includes the cards that person may see right now:

• You: after you tap “Look”, after you fold or lose a compare and are out, or once the hand has ended.
• The player who compares with you: the two players in a compare see each other’s three cards; nobody else sees the cards from that compare.
• The whole table: hands in a forced showdown after the last round, a winner who chooses to show, and, when the room has the bonus enabled, the sole-winning straight flush or Leopard that collects it.
• Everything else: other players, spectators, the host and bots cannot see it. Hand history follows the same rules and labels cards you may not see as “Hidden”.

What others can see is whether you have looked: each seat shows “Blind” or “Seen”, because a seen player pays double to call. They cannot see which cards you saw.

Two routes have nothing to do with the server. Someone who controls your phone, browser or account can see your own cards, and two players can tell each other their cards without any cheat software. If you suspect collusion, see the self-checks and reporting steps in Is my opponent cheating?

4. Can a blind player peek at their own cards?

No. While you play blind, the table data the server sends to your device has your own three cards empty. It is not that the cards arrive and the screen hides them; they never reach your device, so changing the page or digging through the cache finds nothing. Only when you tap “Look” does the server send you your three cards, the table sees you switch to “Seen”, and your later calls cost double.

A few cases that are easy to mix up:

• You win a compare while blind: you stay blind and your own cards are still not sent to you, but the player who lost the compare does see your cards. That is the compare rule.
• You fold or lose a compare while blind: you are out of the hand, so you can see your own cards; they can no longer affect it.
• Bots playing blind: they do not know their cards either and decide from public information only.

See Zha Jin Hua rules for the full rules.

5. Evidence: what can you check yourself?

1. Verify a hand at the table. Open “Records” from the table menu, go to “Hand history”, pick a hand and tap “Verify deal” under “Deal proof”. The check runs on your own device, and the proof only opens cards you were already allowed to see; unshown cards stay private.
2. Read the result. “Fully verified” means this device recorded the deck fingerprint at the start, your random number was part of the shuffle, nobody held back their number, and every card you saw matches. “Proof valid; this device did not fully witness the hand” means the proof itself holds, but this device lacks a complete record from the start, for example after switching devices, clearing browser storage or dropping the connection; it is not the same conclusion. “Mismatch” is worth a screenshot and a report.
3. Check offline. Tap “Download proof” to save the file and then, with Rust installed and the open-source code below downloaded, run the verifier from the code folder: cargo run -p mental-poker --bin pf_verify -- --hand proof.json. An output starting with OK means it passed.
4. Read the code. The dealing proof and verifier are public at github.com/CisaSettle/bluffking. The Zha Jin Hua part is mental-poker/src/pf2_zjh.rs; deck locking, the shuffle proof and the deal order are in pf2.rs. Public code alone cannot prove that the live software matches it, which is why the per-hand checks in steps 1 and 3 matter more.

6. What we cannot do yet

• The server knows the cards during the hand. It needs them to decide compares and showdowns. Under the conditions in section 1 (a human random number arrived in time and nobody held one back), verification shows the cards were not picked in advance, and under the device-record condition in the next point it can catch a later swap. It cannot show that nobody on the server side looked. Someone who can read the dealing program’s internal data or the dealing secrets in the database could see the cards and rebuild past hands; ordinary game accounts and admin accounts have no such access. This is the same as default Hold’em dealing; see Is BluffKing fair?
• Catching a later swap depends on your device’s record. The proof can reveal a swap after the fact only while the browser you played on still keeps the record from the start of the hand (up to 30 days).
• Seats that do not submit a number are left out of the shuffle. An outdated page, a dropped connection or missing the time limit of the exchange (about 1.5 seconds per step) means that seat’s number is not included; bots do not contribute numbers. With no human numbers at all, the order depends only on the server’s random numbers. If someone submits a fingerprint but never reveals the number, the result lists it and does not show “Fully verified”.
• An aborted restart cannot be ruled out. If someone could make a hand fail during its opening exchange and start again, checking that hand would not show it; that needs a separate review.
• Hands before 1 November 2026 no longer have a proof available: their older format has been retired.

If cards do not match, you see cards you should not, or you can reproduce reading cards early, note the hand number and time, take a screenshot and send it through in-app feedback. Qualifying reports can go through the security bounty.