How the dice are made.
Every game on yayay.io gets its dice from one secret number. The server picks it before the first roll and shows you a fingerprint of it. When the game is over you get the secret itself, so you can work out every roll on your own computer and see that the dice match what the server promised at the start.
The numbers on this page are real. Your browser has just drawn its own secret and runs the same steps the server runs.
The server draws a secret
When a game starts, the server asks the operating system for 32 random bytes. That is 256 bits, written here as 64 hex digits. The count of possible secrets is a number with 78 digits, so guessing one is hopeless.
Only its fingerprint is shown
The server runs the secret through SHA-256 and publishes the result as the fingerprint. Going from secret to fingerprint is easy. Going back is impossible, and changing a single bit of the secret gives a completely different fingerprint. The secret stays on the server while the game runs, and our admin tools don't show it either.
Each die comes from the secret and its number
For die number 0 the server hashes the secret followed by the number 0 written as four bytes. It reads the first four bytes of that hash as a whole number, takes the remainder after dividing by 6 and adds 1. Die 1 uses the number 1, and so on through the game. Games against the bot get their dice the same way.
The game ends and the lock opens
The replay of a finished game shows the secret next to its fingerprint. From that moment the dice are no longer a secret, and anyone who can open the replay can check them.
You check it yourself
Hash the secret with SHA-256. When the result equals the fingerprint you saw at the start, this is the secret the server was holding before the first roll. Then work out each die from it and compare them with the game. Your browser has just done exactly that with its own secret, and every die matches.
Change a die and run the check
This is the log of a short game made from your browser's secret. Tap a die to change it, the way a server would have to if it swapped a roll in the middle of a game. The check works out every die from the secret again and names the first roll that no longer matches.
Why we don't use special dice hardware
Some sites advertise a hardware random number generator. It would add nothing here. The operating system already mixes noise from the hardware into its random source, and no test can tell what comes out of it apart from true randomness. The thing that lets you trust the dice is the check above, because you can run it yourself after any game.