No manufactured hands
Random dealing does not engineer strong-hand collisions for excitement or favour membership tiers. Board games have no shuffle; published rules govern moves and outcomes.
OUR FIRST PRINCIPLE
Fair play comes first.
Fair play without exploitation: funded by memberships, not player losses. No manufactured hands or advantages for sale. Membership never changes the deal, rules, or outcome. No real-money play.
Membership keeps play fair
Membership includes review, training and identity cosmetics. All players follow the same dealing, action and settlement rules; membership provides no in-game advantage. We sell no chips and do not profit from player wins or losses. Baccarat’s 5% commission on Banker wins is solely a bean settlement rule; beans have no cash value.
Evidence you can check
Rules, scoring guides and verification tools are accessible. Sealed poker hands support browser verification after the hand. Each other game’s mechanism and limits are stated below.
TEXAS HOLD’EM · DEFAULT SEALED DEALING
Commit. Deal. Verify.
Every Hold’em hand without advanced encrypted dealing defaults to sealed dealing, including bot games and solo hands, and each can be checked in Fairness details afterwards. The only differences: at bot tables the game process also receives the bots’ own hole cards so they can act, and in solo hands the player randomness comes from you alone.
- 01
Before dealing: the encrypted deck is locked
In default sealed hands, the separate dealer secretly shuffles a standard deck, encrypts every card and publishes a commitment before any player randomness is revealed. Players first send only a hash of their randomness and reveal it after the roster is fixed.
- 02
During play: player randomness decides positions
Player randomness decides which encrypted card goes to which position. The dealer locked its deck before it could know that randomness, so it cannot steer a card to anyone. Players use delivery credentials for their own hole cards; the betting process receives public and showdown cards as needed.
- 03
After the hand: choose Verify
The dealer’s seed is never published and unshown cards stay encrypted. Choose Verify in Fairness details at the table or on the verify page: your browser checks the shuffle proof and a decryption proof for each card you may see, and compares them with the commitment and cards this device recorded during the hand. Withheld randomness is flagged.
Try it: how a commitment catches a swapped card
This demo shows the commitment idea in its simplest form: it creates a seed in your browser, publishes its SHA-256 commitment and shuffles from that seed; revealing the seed afterwards lets you recompute the deal, and swapping any card makes the check fail. Real Hold’em hands never publish the dealer’s seed. They are checked with a shuffle proof and decryption proofs, and unshown cards stay encrypted. For real hands, open Fairness details at the table.
- 01Before the deal · commit
- 02After the hand · reveal
- 03Anyone · recompute
- Commitment SHA-256(seed)
- ································································
- Random seed
- Hidden until the hand ends
First 5 cards of this hand
Preparing a new hand…
Teaching model: hashing and shuffling run locally in your browser. Not live table data.
What does verification show?
Sealed verification checks the deal commitment, the shuffle proof, player randomness and observed cards. The separate dealer still knows the deck; process isolation does not prevent operator access. A passing check does not prove the service has no bugs, collusion or cheating, or remotely attest which code is running.
Verification material goes only to players dealt into that hand, not to later arrivals or spectators. It contains the shuffle proof, player randomness and decryption proofs for the cards you may see: the board, showdown and voluntarily shown cards, and your own hole cards. Folded and undealt cards are never opened and cannot be computed from it. A full check needs the record this device kept during the hand (latest 500 hands); on another device or after clearing it, only the server record itself can be confirmed valid. Rabbit-hunt cards are not covered; hands from before this update show as an older version that cannot be verified; advanced encrypted dealing is checked differently.
GAME-SPECIFIC SCOPE
One commitment. Different mechanisms.
Card games
♠Texas Hold’em
Hold’em hands without advanced encrypted dealing default to sealed dealing. Before the deal, a separate dealer locks a shuffled deck with every card encrypted and publishes its commitment; randomness from the players dealt in decides which encrypted card goes to which position. The dealer’s seed is never published and unshown cards stay encrypted. When you choose Verify, a shuffle proof shows the locked deck is exactly one standard 52-card deck and decryption proofs show each card you may see; your browser checks them. At bot tables the game process additionally receives only the bots’ own hole cards. The platform operates both processes, so isolation does not make it unable to read cards. Advanced encrypted dealing has a separate privacy boundary.
短Short Deck Hold’em
New deals use shared encrypted-deck, shuffle and decryption proofs with a fixed game-specific manifest: 36 cards for Short Deck, 52 for standard decks, jokers for Dou Dizhu, and distinct physical identities for Guandan and Color Clash. After completion, choose Verify dealing in the table menu for your proofs; Guandan provides each deal, while Color Clash chains discard reshuffle epochs. Only your permitted cards and public cards are opened; secret seeds are never published. The browser checks the proof against the commitment and visible cards saved on this device; missing visible-card observations are explicitly reported as incomplete verification. New deals lock the deck and seats before player commitment and reveal; each Guandan deal and Color Clash reshuffle has a fresh exchange. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Verification does not exclude operator aborts or prove every action, settlement rule or off-table behaviour. The server still knows the cards. Older deals keep their original verification protocol.
牛Bull (Niuniu)
New deals use encrypted decks, shuffle proofs and selective card-opening proofs. Verify visible cards from hand history after completion; the browser uses Hold'em's shared pf2 verifier to check the deck and deal positions. Secret seeds and unauthorized card openings are not published. New deals lock the deck and seats before player commitment and reveal. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Operator aborts remain possible. The server still knows the cards, and proofs do not attest actual wallet credits.
公Sangong
New deals use shared encrypted-deck, shuffle and decryption proofs with a fixed game-specific manifest: 36 cards for Short Deck, 52 for standard decks, jokers for Dou Dizhu, and distinct physical identities for Guandan and Color Clash. After completion, choose Verify dealing in the table menu for your proofs; Guandan provides each deal, while Color Clash chains discard reshuffle epochs. Only your permitted cards and public cards are opened; secret seeds are never published. The browser checks the proof against the commitment and visible cards saved on this device; missing visible-card observations are explicitly reported as incomplete verification. New deals lock the deck and seats before player commitment and reveal; each Guandan deal and Color Clash reshuffle has a fresh exchange. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Verification does not exclude operator aborts or prove every action, settlement rule or off-table behaviour. The server still knows the cards. Older deals keep their original verification protocol.
金Zha Jin Hua
New deals lock an encrypted deck and roster, then mix player seeds through commitment and reveal. After the hand, its history verifies the shuffle and permitted card openings against this device's commitment and seed records. Secret seeds are never published and unshown cards stay encrypted; without local records the proof establishes self-consistency only. The server still knows the cards. Verification does not exclude operator aborts or independently prove settlement. Older hands are not given retrospective proofs.
地Dou Dizhu
New deals use shared encrypted-deck, shuffle and decryption proofs with a fixed game-specific manifest: 36 cards for Short Deck, 52 for standard decks, jokers for Dou Dizhu, and distinct physical identities for Guandan and Color Clash. After completion, choose Verify dealing in the table menu for your proofs; Guandan provides each deal, while Color Clash chains discard reshuffle epochs. Only your permitted cards and public cards are opened; secret seeds are never published. The browser checks the proof against the commitment and visible cards saved on this device; missing visible-card observations are explicitly reported as incomplete verification. New deals lock the deck and seats before player commitment and reveal; each Guandan deal and Color Clash reshuffle has a fresh exchange. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Verification does not exclude operator aborts or prove every action, settlement rule or off-table behaviour. The server still knows the cards. Older deals keep their original verification protocol.
↻UNO
New deals use shared encrypted-deck, shuffle and decryption proofs with a fixed game-specific manifest: 36 cards for Short Deck, 52 for standard decks, jokers for Dou Dizhu, and distinct physical identities for Guandan and Color Clash. After completion, choose Verify dealing in the table menu for your proofs; Guandan provides each deal, while Color Clash chains discard reshuffle epochs. Only your permitted cards and public cards are opened; secret seeds are never published. The browser checks the proof against the commitment and visible cards saved on this device; missing visible-card observations are explicitly reported as incomplete verification. New deals lock the deck and seats before player commitment and reveal; each Guandan deal and Color Clash reshuffle has a fresh exchange. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Verification does not exclude operator aborts or prove every action, settlement rule or off-table behaviour. The server still knows the cards. Older deals keep their original verification protocol.
21Blackjack
New deals use shared encrypted-deck, shuffle and decryption proofs with a fixed game-specific manifest: 36 cards for Short Deck, 52 for standard decks, jokers for Dou Dizhu, and distinct physical identities for Guandan and Color Clash. After completion, choose Verify dealing in the table menu for your proofs; Guandan provides each deal, while Color Clash chains discard reshuffle epochs. Only your permitted cards and public cards are opened; secret seeds are never published. The browser checks the proof against the commitment and visible cards saved on this device; missing visible-card observations are explicitly reported as incomplete verification. New deals lock the deck and seats before player commitment and reveal; each Guandan deal and Color Clash reshuffle has a fresh exchange. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Verification does not exclude operator aborts or prove every action, settlement rule or off-table behaviour. The server still knows the cards. Older deals keep their original verification protocol.
Mahjong
星Xiangyang Ka Wu Xing
The server shuffles randomly and applies the room’s action and scoring rules. Membership tier is not an input to dealing. Per-game cryptographic verification records are not currently available for this game.
幺Guiyang Chicken Mahjong
The server shuffles randomly and applies the room’s action and scoring rules. Membership tier is not an input to dealing. Per-game cryptographic verification records are not currently available for this game.
萬Chengdu Mahjong
The server shuffles randomly and applies the room’s action and scoring rules. Membership tier is not an input to dealing. Per-game cryptographic verification records are not currently available for this game.
Team play
掼Guandan
New deals use shared encrypted-deck, shuffle and decryption proofs with a fixed game-specific manifest: 36 cards for Short Deck, 52 for standard decks, jokers for Dou Dizhu, and distinct physical identities for Guandan and Color Clash. After completion, choose Verify dealing in the table menu for your proofs; Guandan provides each deal, while Color Clash chains discard reshuffle epochs. Only your permitted cards and public cards are opened; secret seeds are never published. The browser checks the proof against the commitment and visible cards saved on this device; missing visible-card observations are explicitly reported as incomplete verification. New deals lock the deck and seats before player commitment and reveal; each Guandan deal and Color Clash reshuffle has a fresh exchange. Full device verification requires your contribution and no withheld commitments; missing own contributions, withheld reveals or missing device evidence produce incomplete verification. Verification does not exclude operator aborts or prove every action, settlement rule or off-table behaviour. The server still knows the cards. Older deals keep their original verification protocol.
Board games
五Gomoku
There is no shuffle or hidden hand. Both players see the same board. The server validates turns, moves and five-in-a-row wins. The rules are freestyle, with the first player alternating between games.
跳Chinese Checkers
The board is public and no chips are used. The server validates turns, jump paths and opposite-camp wins. Classic or Super rules are chosen at room creation; the first seat rotates each match.
将Chinese Chess
Both players see the full board. The server validates moves, check and game endings. Both sides have the same per-move time limit and swap colours each game. Membership adds no clock time or rule advantages.
Dice games
⚄Big & Small
Solo Quick Roll combines a precommitted server seed with a browser-generated player seed. Save the pre-bet commitment receipt and use the public offline verifier afterwards to recompute the dice and base bean payout. Rooms also expose commitments and reveals, but the operator knows results in advance, retaining seed-selection and abort risks. Rooms and solo play share the account-wide bean wallet. Membership does not change payouts; offline verification alone does not prove actual credits, and server rules handle additional Max rewards separately.
Casual
✦Scratch Cards
Each reward card costs 100 beans. A precommitted server seed and browser-generated player seed determine its numbers and bonus. The result is fixed at purchase; hidden areas are withheld until revealed. All six reveals trigger settlement and proof availability. Save the pre-purchase receipt and use the public offline verifier to recompute numbers, matching-number payouts and bonuses. Beans and Max rewards are credited server-side; offline verification alone does not attest actual credits, commitment publication time or the deployed version.
✦Japanese Crane
Each grab costs 100 beans. The server decides a catch from the aim point's distance to fixed toy positions; browser 3D physics and claw animation display the result and do not determine server rewards. A catch normally awards 200 beans, or instead Max for 30 days with a 0.01% chance. Collections, attempts, receipts and balances are stored server-side per account. There are no physical prizes, redemption or shipping. A server receipt is not an independent cryptographic fairness proof.
7Slots
Each spin costs 100 beans. The server uses operating-system cryptographic randomness to draw three independent reels, each with six equally likely symbols, and settles the shared bean wallet using the published paytable. Spins with a payout also have a 0.01% chance of Max for 30 days. Results, receipts and balances are server-kept; reloading or leaving the page does not reset the wallet. Membership does not alter odds. A server receipt is not independent per-spin cryptographic verification.
♦Baccarat
Each hand uses a fresh eight-deck shoe. The encrypted shoe is committed before the bet and browser randomness determines its final order; the server applies published burn, drawing and bean payout rules. Afterward, choose Verify dealing in the table menu to check shuffle and visible-card decryption proofs, or download them for offline verification. The secret seed is never revealed. Verification alone does not attest wallet credits, extra Max rewards or absence of operator aborts; the server still knows the cards.
49TOTO
Before purchase, each scheduled period publishes its identity, rules and a fixed future drand round. The server verifies that round's BLS signature and derives the shared result with the public algorithm. Entries close five seconds before the draw. An unavailable beacon leaves the draw waiting for its fixed round, without a server-random fallback. Save the pre-draw receipt and use the public offline verifier to check the draw proof and prize calculation. Balances and payouts are server-kept beans. A proof does not attest actual wallet credits, publication time or the deployed binary; missing legacy commitments are never invented.
33Double Color Ball
Before purchase, each scheduled period publishes its identity, rules and a fixed future drand round. The server verifies that round's BLS signature and derives the shared result with the public algorithm. Entries close five seconds before the draw. An unavailable beacon leaves the draw waiting for its fixed round, without a server-random fallback. Save the pre-draw receipt and use the public offline verifier to check the draw proof and prize calculation. Balances and payouts are server-kept beans. A proof does not attest actual wallet credits, publication time or the deployed binary; missing legacy commitments are never invented.
5+2Super Lotto
Before purchase, each scheduled period publishes its identity, rules and a fixed future drand round. The server verifies that round's BLS signature and derives the shared result with the public algorithm. Entries close five seconds before the draw. An unavailable beacon leaves the draw waiting for its fixed round, without a server-random fallback. Save the pre-draw receipt and use the public offline verifier to check the draw proof and prize calculation. Balances and payouts are server-kept beans. A proof does not attest actual wallet credits, publication time or the deployed binary; missing legacy commitments are never invented.
80Happy 8
Before purchase, each scheduled period publishes its identity, rules and a fixed future drand round. The server verifies that round's BLS signature and derives the shared result with the public algorithm. Entries close five seconds before the draw. An unavailable beacon leaves the draw waiting for its fixed round, without a server-random fallback. Save the pre-draw receipt and use the public offline verifier to check the draw proof and prize calculation. Balances and payouts are server-kept beans. A proof does not attest actual wallet credits, publication time or the deployed binary; missing legacy commitments are never invented.
③Fucai 3D
Before purchase, each scheduled period publishes its identity, rules and a fixed future drand round. The server verifies that round's BLS signature and derives the shared result with the public algorithm. Entries close five seconds before the draw. An unavailable beacon leaves the draw waiting for its fixed round, without a server-random fallback. Save the pre-draw receipt and use the public offline verifier to check the draw proof and prize calculation. Balances and payouts are server-kept beans. A proof does not attest actual wallet credits, publication time or the deployed binary; missing legacy commitments are never invented.
20482048
A solo merge puzzle costing 100 beans per game. The server stores the entry receipt and supplies a random seed; the browser generates tiles from that seed and the action sequence. Progress and the top score stay on this device. On reaching 2048, the server replays the actions and awards 500 beans, or instead Max for 30 days with a 0.01% chance. Beans and rewards are server-kept. Receipts and replay are not independent cryptographic fairness proofs; membership does not change merge rules.
When is advanced encrypted poker dealing available?
All-human friend rooms with no AI can opt into advanced encrypted dealing. During such a hand, the server does not hold unshown hole-card plaintext, and those cards stay out of full history. If a disconnect prevents decryption, the hand is voided and contributions refunded, with a visible switch to default sealed dealing from the next hand.
Read the mechanism and its limits →Keep checking. Ask hard questions.
For a suspicious hand, keep its ID, time and reproduction steps. Specific records and rules give us something concrete to investigate.
The open-source scope includes the poker rules engine and dealing core, not the entire hosted service.
Find your game