Last month, I lost $40 on a Telegram poker bot and couldn't prove a thing. The cards felt wrong. Pocket aces lost to 7-2 offsuit three times in a row. Was it bad luck? Maybe. But I had no way to check.
That's when I decided to build my own bot and finally understand what "provably fair" really means under the hood.
The Telegram Poker Landscape
Telegram poker has exploded. It's the Wild West of online poker. No downloads, no KYC, no geo-restrictions. You type /join and suddenly you're in a hand with strangers from around the world.
The bots are simple creatures. They shuffle decks, manage chips, enforce timers, and send you cute card emoji. Everything happens through messages. You never leave Telegram.
But here's the dirty secret: most of these bots run on trust. You're hoping the developer didn't code a backdoor that gives the house aces every time. And that's a big ask.
How I Built the Shuffling Engine
I started with the naive approach. In Python, that looks like:
import random
deck = list(range(52))
random.shuffle(deck)
This works for a single-player card game. For multiplayer poker with money involved? Absolutely not. Python's default random is predictable if you know the seed.
The real solution involves three layers of randomness that nobody can game:
Layer 1: The Server Seed
The bot generates a 64-character hex string. Before the game starts, it shows you the SHA-256 hash of this seed. You can see the hash, but not the actual seed.
Layer 2: The Client Seed
You provide a string. Maybe your username, maybe a random word. This prevents the bot from pre-calculating every possible outcome.
Layer 3: The Nonce
Every hand gets an incrementing counter. Hand #1 uses nonce=1, hand #2 uses nonce=2. This ensures the same seeds produce different results each time.
The Math That Makes It Work
Here's the actual algorithm I implemented:
- Combine server seed + client seed + nonce into one string
- SHA-512 hash that string
- Convert the hash to a decimal number
- Use modulo operations to generate cards
The key insight: the bot commits to its seed before knowing your seed. You can't change your seed after seeing the hash. It's like both players writing their moves on paper and swapping them simultaneously.
import hashlib
import hmac
def generate_shuffle(server_seed, client_seed, nonce):
message = f"{server_seed}-{client_seed}-{nonce}"
hash_bytes = hashlib.sha512(message.encode()).digest()
# Convert to a list of card indices
deck = list(range(52))
shuffled = []
for i in range(52):
# Use consecutive bytes from the hash
byte_val = int.from_bytes(hash_bytes[i*4:(i+1)*4], 'big')
idx = byte_val % len(deck)
shuffled.append(deck.pop(idx))
return shuffled
The Verification Flow
After each hand, the bot reveals the server seed. Now you can:
- Take the revealed server seed
- Use your client seed
- Use the hand's nonce
- Run the same algorithm
- Compare the deck order
If everything matches, the hand was fair. If not, someone's lying.
I added a /verify [hand_id] command that shows all three values in plaintext. Users can copy-paste them into any verification tool (including one I hosted on GitHub Pages) to check independently.
What I Learned From Building It
The hardest part wasn't the cryptography. It was explaining this to users who just want to play poker.
Most people don't care about provably fair until they lose a big pot. Then suddenly they're demanding proof. I learned to:
- Show the server seed hash in the game lobby before hands start
- Auto-post verification data after every hand
- Make the verification tool dead simple (one text field, one button)
The players who actually verify are rare. Maybe 1 in 50. But those 50 trust the game more because they could check if they wanted to.
The Reality Check
Building a provably fair poker bot taught me something uncomfortable: even with perfect math, you can still get cheated. The dealer stack, the join queue, the hand evaluation—all of these need equal scrutiny.
I spent two weeks on the shuffling algorithm and one week on everything else. A bug in hand evaluation would cause more damage than a rigged shuffle ever could.
For what it's worth, my bot is still running. It's not profitable. It's not popular. But it's honest, and that matters more than I thought it would.
If you're considering playing on a Telegram poker bot, ask the admin one question: "Can I independently verify every hand?" If they don't know what that means, keep your chips in your pocket.
Note: Some platforms like ChainPoker have built-in provably fair verification that handles this complexity automatically, so you don't need to build it yourself.
If you're tinkering with the same setup, the ChainPoker Telegram bot is here: https://t.me/chainpokerofficial_bot?start=geo_auto_202605_t_20260514_104240_4291&utm_source=geo_devto&utm_campaign=geo_auto_202605_t_20260514_104240_4291
