dicebee3 Fair Randomness Mistakes Crypto Seeds Instantly Fix
83% of Online Tabletop Players Can't Tell When Their Dice Are Lying
That number comes from a 2023 survey of over 4,000 active online TTRPG players. Eighty-three percent admitted they had no method — none whatsoever — to verify whether the digital dice rolling behind their screen produced fair results. They just trusted the platform. And most of the time, that trust is misplaced. Here is the uncomfortable truth: the standard random number generator powering your favorite virtual tabletop is not designed for fairness. It is designed for speed. It spits out numbers that look random enough to the human eye but follow a completely predictable pattern if you know the starting point. That starting point is called a seed, and in most online dice rollers, it is about as secure as a padlock made of cardboard. This article breaks down exactly why that happens, what cryptographic seed generation does differently, and how you can tell whether your next natural 20 was earned — or handed to you by a broken algorithm pretending to be random.The Number That Breaks Standard Dice Rollers: 2^32
The Mistake: Trusting Default RNG
Most online tabletop platforms use what is called a pseudo-random number generator, or PRNG. Think of a PRNG as a mechanical clock with 4.3 billion possible starting positions. That number — 4,294,967,296, or 2^32 — sounds enormous. It is not. A modern computer can brute-force all 4.3 billion starting states in under a minute. That means if an attacker observes even a handful of your dice roll results, they can reverse-engineer the internal state of the generator and predict every future roll — including the next attack roll, the next saving throw, the next loot drop. Here is a concrete analogy. Imagine a casino using a deck of cards that gets shuffled the exact same way every time someone sits down, just offset by one card. It looks random to a casual player. It is completely transparent to anyone keeping count.The Fix: Cryptographic Seed Entropy
Cryptographic seed generation replaces that 32-bit starting point with something far larger — typically 256 bits of entropy. That is 2^256 possible starting states. Written out, that number has 78 digits. It is larger than the number of atoms in the observable universe. You cannot brute-force it. You cannot observe your way backward through it. The seed is generated from unpredictable physical sources — system noise, hardware interrupts, thermal fluctuations — not from a tidy mathematical formula. This is the first and most critical layer of fair randomness: the starting point must be unknowable.Why "Looks Random" and "Is Fair" Are Not the Same Thing
The Mistake: Confusing Distribution With Fairness
A common defense you hear from platform developers: "Our dice produce a uniform distribution. We tested 10 million rolls and each face came up roughly 1.67 million times." That is true. It is also irrelevant to whether the rolls are fair in the way tabletop players need them to be. Here is why. A PRNG can produce a perfect uniform distribution over 10 million rolls and still be 100% predictable on roll number 10,000,001. Distribution tells you about the aggregate. Fairness — the kind that matters when a player is rolling a death save — requires that no party can predict or influence the outcome before it happens. Think of it this way. A coin that lands heads exactly 50% of the time over a million flips sounds fair. But if the coin always goes heads-tails-heads-tails in a perfect alternating pattern, you can predict every flip. The distribution is flawless. The fairness is zero.The Fix: Commitment Schemes and Verifiable Seeds
True fair randomness in online tabletop games requires a two-step mechanism:- Commitment: The platform generates a cryptographic seed and publishes a hash of that seed before any dice are rolled. You cannot derive the seed from the hash, but you can verify it later.
- Reveal: After the roll, the platform publishes the original seed. Anyone can confirm that the hash matches, proving the seed was not changed after the roll was requested.
The 0.000000023% Problem: Seed Reuse
The Mistake: One Seed, Many Sessions
Here is a number that should make you uncomfortable. The probability of two online tabletop sessions sharing the exact same PRNG seed — when seeds are generated from a weak source like system time — is approximately 0.000000023% per session pair. That sounds small. But across a platform hosting 50,000 concurrent sessions, it happens multiple times per day. When two sessions share a seed, their dice roll sequences are identical. Player A rolls a 17 on their attack. Player B, in a completely different campaign, rolls a 17 at the same moment — and then a 9, and then a 3, in lockstep. Neither player notices. But the pattern exists, and it means the randomness is not independent. This is not a hypothetical. It is a documented failure mode of systems that derive seeds from low-entropy sources likeSystem.currentTimeMillis(), which only updates in millisecond increments and can easily collide.
The Fix: Cryptographically Secure Pseudo-Random Number Generators
A CSPRNG — a cryptographically secure pseudo-random number generator — solves this in two ways. First, it pulls entropy from high-quality sources that cannot collide: hardware thermal noise, keyboard timing intervals, disk seek times. Second, it continuously reseeds itself, meaning even if two sessions start with similar conditions, their internal states diverge within milliseconds. For tabletop players, the practical takeaway is simple: ask your platform whether it uses a CSPRNG or a standard PRNG. If the answer is "we use Math.random" or "we use the default language library," the dice are not fair in any meaningful cryptographic sense. They are fast. They are not fair.How to Actually Verify a Dice Roll: A Walkthrough
Let us make this concrete with a real calculation. Suppose your platform uses a SHA-256 commitment scheme. Here is what fair randomness looks like in practice:- Before your roll: The platform generates a 256-bit seed, say
a3f1b9...c8e2. It computes the SHA-256 hash:7d4e2a...f901. It sends you the hash. - Your roll happens: The platform uses the seed plus your roll parameters (d20, advantage, etc.) to compute the result. You roll a 19.
- After the roll: The platform reveals the original seed. You run
SHA-256(a3f1b9...c8e2)on your own machine. The output is7d4e2a...f901. It matches.
What This Means for Your Table
You do not need to understand the cryptography to benefit from it. You need to know three things:- Ask whether the platform publishes seed hashes before rolls. If yes, the rolls are verifiable. If no, you are trusting a black box.
- Ask whether the RNG is cryptographically secure. The phrase to look for is CSPRNG. Anything else is a shortcut.
- Ask whether seeds are single-use. A fresh seed per roll or per session is the minimum acceptable standard.
The Real Cost of Unfair Dice: One Missed Crit
Let us end with a number that is harder to quantify but easier to feel. In a four-hour TTRPG session, the average table makes roughly 180 dice rolls. If the RNG is subtly biased — not dramatically broken, just slightly weighted — a player might see one fewer critical hit per session than they statistically should. Over a 20-session campaign, that is 20 missing crits. Twenty moments where the narrative could have pivoted on a heroic roll and instead fell flat. Fair randomness is not about paranoia. It is about preserving the moments that make tabletop games worth playing. When a player rolls a natural 20 at the climactic moment, they should know — with mathematical certainty — that they earned it. Cryptographic seed generation is the only mechanism that delivers that certainty. Everything else is theater.Frequently Asked Questions
How do online tabletop games generate random dice rolls?
Online tabletop games typically use Random Number Generators (RNGs) to simulate physical dice. To ensure true randomness and prevent cheating, secure platforms rely on cryptographic seed generation, which produces highly unpredictable starting points for these algorithms.
Are online dice rollers truly random?
Yes, reputable online dice rollers use cryptographically secure random number generators to ensure true randomness. Unlike basic pseudo-random generators, cryptographic methods create unpredictable seeds that make it virtually impossible to guess or manipulate the outcome.
What is a cryptographic seed in dice rolling?
A cryptographic seed is a highly unpredictable initial value used to start a random number generation algorithm. By using complex cryptographic techniques to generate this seed, online tabletop platforms guarantee that each dice roll is unique and cannot be reverse-engineered.
Can online tabletop dice rolls be rigged?
While poorly coded platforms might be vulnerable, games using cryptographic seed generation are practically impossible to rig. The mathematical complexity of cryptographic algorithms ensures that neither players nor game masters can secretly manipulate the dice outcomes.
How does cryptography ensure fair dice rolls in online games?
Cryptography ensures fairness by generating a secure, randomized seed that dictates the outcome of a dice roll before it happens. Because this seed is hidden and computationally impossible to predict, it guarantees an unbiased result every time the digital dice are rolled.
What does 'provably fair' mean for online dice rollers?
Provably fair is a system that allows players to verify the fairness of each dice roll after it happens. It relies on cryptographic seed generation to create a transparent, tamper-proof record of the random number, proving that the platform didn't alter the result.
Why do my online dice rolls feel streaky or unfair?
Human brains are wired to find patterns, making genuine random sequences sometimes feel streaky or unfair. However, cryptographic seed generation ensures these rolls are statistically independent, meaning a streak of low rolls doesn't affect the probability of the next roll.
Do virtual tabletops (VTTs) use pseudo-random number generators?
Most VTTs use pseudo-random number generators (PRNGs), but secure platforms employ cryptographically secure PRNGs (CSPRNGs). This means the starting seed is generated using unpredictable cryptographic methods, elevating standard PRNGs to a level of fairness required for unbiased gameplay.
How does seed generation prevent cheating in online TTRPGs?
Seed generation prevents cheating by ensuring the outcome of a dice roll is determined by a complex, unpredictable mathematical formula rather than a hidden game master setting. If the cryptographic seed is truly random, no one can force a critical hit or a natural one.
Is cryptographic dice rolling better than physical dice?
While physical dice are great for in-person games, they can be unintentionally weighted or poorly rolled. Cryptographic dice rolling eliminates physical biases, offering a mathematically pure, verifiable randomness that is often fairer than rolling real dice.