Provable fairness

Before you play a single round, the house commits to a secret seed by publishing its SHA-256 hash. Outcomes are HMAC-SHA256(serverSeed, clientSeed:nonce) — the house cannot bend a roll without breaking its own commitment.

How to verify any round

Note the seed hash shown with each round you play.
Rotate your seed below — the old seed is revealed.
Check SHA-256(revealed seed) equals the hash you saw.
Recompute HMAC-SHA256(seed, clientSeed:nonce): the first 8 hex chars ÷ 2³² give the roll. Flip wins under 0.5 for frog; dice wins when roll × 100 is under your target.
Blackjack: the deck is a Fisher–Yates shuffle whose i-th swap uses the roll from HMAC-SHA256(seed, clientSeed:nonce:i) — re-derive all 52 cards and compare with the hand you were dealt. Open hands block seed rotation so a reveal can never expose a live deck.

Your client seed

Half of every roll is yours. This seed is mixed into each outcome — set it to anything afterthe house has committed and the server seed can't have been picked around it. Stored only in your browser.

Used by Frog Flip, Pond Dice and Blackjack from your next round. It appears in each round's record so anyone can recompute the result.

Independent verifier (runs in your browser)

What about the arcade episodes?

Worm Frog, Frogris and Hopper are games of skill — there is no house randomness to commit to. Instead, each run gets a signed run token, and for every episode your inputs are recorded and replayed move-by-move on the server, which recomputes the score itself and rejects anything that doesn't reproduce — including runs faster than real time. Leaderboard and bounty placements only count for wallets with real $RIBBIT credit spend behind them.