BJ21 — free play-money multiplayer blackjack, provably fair

BJ21 — free play-money blackjack you can verify yourself

No real money. Chips are play money: they cannot be bought, sold, deposited, withdrawn or cashed out, and there are no prizes. Sign-up is free: a username, an email address (only to activate the account and reset the password) and a password. Terms & Privacy

Play: https://bj21.live
Offline verifier: https://bj21live.github.io/bj21-verifier/verify-offline.html (SHA-256 of the file: d0324a0002b3db0cdd86194d937b2cd5970fed998806a7e0eb7c8a5da8204ab7 — download it with Save Link As or curl -O; a browser's Save Page As rewrites the file and the hash won't match)
Feedback / bug reports: info@bj21.live (or reply in this thread)

This post locks the seed-chain tip in public, so every round on the table can be checked against it — today or at round 50,000.

The game

Multiplayer table, 7 boxes, one dealer. Guests can watch; log in to play.
Each box draws from its own 6-deck shoe (its provably-fair lane). There is no shared shoe, so nobody else's hits, stands or seed can move your cards.
Dealer stands on all 17s (S17). Dealer checks for blackjack after the deal; a dealer blackjack ends the round and you only lose your original bet.
Blackjack pays 3:2. Double on any first two cards, including after a split. Split once (max 2 hands per box); split aces get one card each.
No insurance, no surrender, no even money.
Bets 10 – 10,000, whole chips. Start with 10,000. Drop below 10 and the Refill button tops you back up to 10,000 — no cooldown, so a fresh account is never better than your old one.
Every clock (seat, Ready, commit/reveal, action, review) is listed in the in-game Rules panel.

Why the house can't pick your cards

Reverse hash chain. The server builds a chain where each link is SHA-256 of the one before it, publishes the end (the tip, below), and spends seeds backwards from there. Round n's server seed hashes to the tip in exactly n steps. The seed for a round is locked before anyone bets; the server can't swap it without breaking SHA-256.
Commit, then reveal. Your browser makes a random client seed and sends only SHA-256(seed) when you press Ready. The seed itself is revealed after every seat has committed, so nobody — house included — can choose a seed after seeing yours. You can also type your own 64-hex seed.
Your lane is yours. Your cards come from HMAC-SHA512(serverSeed, "seat:<box>:<yourClientSeed>:<nonce>"), shuffled with Fisher–Yates over 6 decks. The dealer's lane uses every revealed client seed. Another player leaving, hitting or aborting can't shift your cards.
All or nothing. If any committed seat fails to reveal, the whole round is cancelled before a single card is dealt, every bet is refunded, and that server seed is revealed and burned on the record. There is no partial deal: dealing without the missing seed would give a different dealer hand, so whoever withheld it — a house bot that knows the server seed, say — would get to pick between two dealer hands. Leaving after the deal changes nothing: the cards are fixed, that hand stands and is still paid. An account that keeps cancelling rounds (3 within 10 minutes) loses its seat for 15 minutes, so one player can't stall the table.
Your browser keeps its own copy. The tip and every commitment are pinned in your browser the first time it sees them, before the result exists. Verification compares against that pinned copy, not against what the server says afterwards. If your browser has no pin for something (private window, cleared data, another device), the result says unproven — never a silent pass. On your first visit, compare the tip under Fairness with the one below.
Whole-round replay. Each finished round carries a transcript (bets, every hit/stand/double/split, dealer draws, payouts) that the verifier replays card by card, so the result and the payout are checked too — not only the cards.

How to verify a round

At the table: in the short review window right after a round, open Fairness → Independent Verify. It re-derives every card in your browser with Web Crypto. The ⓘ on a seat shows that seat's lane proof. Missed the window? Use the round's public page below — same checks.
Public page: every round has a page at https://bj21.live/g/<game hash> (open it from History). It runs the same checks in your browser, including Chain to tip.
Off the server: on the round's public page click Copy audit JSON (or Audit JSON at the table during the review window), then paste it into the offline verifier at https://bj21live.github.io/bj21-verifier/verify-offline.html. It is one self-contained HTML file with no network calls; you can save it and open it from disk. Check its SHA-256 matches the one at the top of this post.
Cancelled rounds: Fairness → Audit cancelled rounds recomputes the cards you would have received in every cancelled round. The cancel rate is shown next to it.

Example round to try: https://bj21.live/g/5f7bbfd0bf0c261aec6d6c114ccb536db8926d1b9e106b799403616cce84ca3b
(It is round #1 of this chain, so its hash is the tip itself: round 1's server seed hashes to the tip in one step.)

Seed-chain tip

Code:

chainTip : 5f7bbfd0bf0c261aec6d6c114ccb536db8926d1b9e106b799403616cce84ca3b
built    : 2026-10-31 17:07 (UTC)
length   : 100,000 rounds
check    : SHA-256 applied <round number> times to that round's server seed = chainTip

The server only moves to a new chain when this one is used up. A new tip will be announced in this thread, from this account. If the tip changes while the old chain still had unused seeds, the site raises a red alarm in your browser — please post it here if you ever see one.

Honest limits

The house can cancel a round, not choose one. No protocol can stop a server from crashing or cancelling after the cards are known. What it can't do is hide it: every cancelled round is on the public record with its server seed revealed and burned, the cancel rate is on screen, and you can recompute the cards you would have received. Vetoing every round the house would lose takes a cancel rate around 43%.
Future seeds sit on the server. They can't be computed from the tip, but keeping them secret depends on the server not leaking. If a leak is ever suspected, the chain is rotated and the new tip is posted here.
The server code is not public. Everything that checks fairness runs in your browser and is readable as-is: the verifier code on the site and the offline verifier file. Nobody can prove which binary a server runs; the checks above are built so that it doesn't matter.
The page that makes your seed comes from us too. Your client seed is created and committed by the site's JavaScript. A tampered page could leak your seed before the reveal, and the cards would still verify. The code is readable in your browser and anyone can check what it sends; this is the same trust every browser-based provably-fair game asks for.
The house runs the table. If the server goes down mid-round, that round is refunded on restart. If the database stops accepting writes, the table pauses instead of dealing rounds it can't record.
The exact house edge for per-seat 6-deck lanes has not been computed. It should be close to standard 6-deck S17 3:2, but we don't claim a number.

Questions and attacks on the scheme are welcome in this thread.