How the dice are fair
Your roll is not drawn when you press. It is determined at UTC midnight by that day's secret and merely discovered. Once the day is over the secret is published, and anyone can recompute any roll from it, forever.
Nobody can predict tomorrow, because tomorrow's secret does not exist yet. And nothing can be gained by learning one early: you cannot reroll, decline, or time your entry into a better outcome, so the worst an early leak could do is spoil a surprise.
Check a roll
This runs in your browser, on the published secret, with the algorithm below. Nothing is sent anywhere.
The algorithm, exactly
This is normative. Anyone reimplementing it should reproduce our faces byte for byte.
- Message
- YYYY-MM-DD|<player_id>
- The UTC date and the canonical lowercase hyphenated uuid. The date is in the message even though the secret is already per-day, so a secret can never be replayed across days.
- Key
- That day's secret: 32 bytes, published as 64 hex characters.
- Stream
- HMAC-SHA256(secret, message)
- 32 bytes. If exhausted, the next block is
HMAC-SHA256(secret, message + "|1"), then"|2", and so on. A second block has never been needed; the rule exists so the behaviour is defined rather than undefined. - Dice, in this fixed order
- d4, d6, d8, d10, d12, d20
- Per die of n sides
- limit = 256 − (256 mod n); discard any byte ≥ limit; face = (byte mod n) + 1
- Rejection rather than plain modulo, because 256 is not a multiple of 6, 10, 12 or 20, so plain modulo would make low faces come up measurably more often on four of the six dice. Expected consumption is 6.1224 of the 32 bytes available.
| Die | Sides | Limit | Bytes rejected |
|---|---|---|---|
| d4 | 4 | 256 | 0.00% |
| d6 | 6 | 252 | 1.56% |
| d8 | 8 | 256 | 0.00% |
| d10 | 10 | 250 | 2.34% |
| d12 | 12 | 252 | 1.56% |
| d20 | 20 | 240 | 6.25% |
How the score follows from the faces
Every one of the 460,800 possible rolls is scanned against the same 166 badge rules. Within each scoring family only the rarest badge you matched counts, and your EP is how improbable that whole set is:
EP = round(10 × −log₂(P(your scoring set)))
So two rolls whose patterns are equally improbable always score equally, and a rarer set is never worth less. EP runs from 30 to 188. The top of the ladder is not a percentile: an SSS is a scoring set that occurs exactly once among all 460,800 rolls.
What publishing a roll costs you
The verifier needs your player id, and a shared roll page publishes it. Day secrets are published once their day is over and are kept forever. So anyone holding a link to one of your rolls can recompute your faces for every closed day in Raredle's history, including days you never claimed.
We opened that door on purpose. A verifier only you could run would prove nothing to anyone else, which would leave the fairness claim existing only in this paragraph. Know that before you share.