Play Koi-Koi online with a friend

Create a room

Once you are signed in, the home page is the lobby. Its Create a room panel has these choices; the two room settings you used last are remembered on your device.

Press Create room and you get a six-character code, such as ABC234, and a waiting screen. You have one room at a time: creating a new one closes the one before. If you go back to the lobby while your room is open, the lobby says Your room ABC234 is still open. with Return to it and Close it. While a match is being played in it, the lobby says A match is in progress in your room ABC234. and offers Return to match and Resign and close instead, and a new room can be created only once that match has ended. A match that ended while you were away shows as Your match in room ABC234 ended while you were away. with See the result, which opens it so that your device can confirm the result. If the other player of your room’s last match was away when it ended and has not confirmed the result yet, closing the room from the lobby or the waiting screen, or creating a new one, asks first: the room keeps how that match ended for them.

Send the invite

The waiting screen shows the room code in large letters and the invite link under it, in the form https://hanafuda.lemme.dev/#join=ABC234. Copy invite link puts it on the clipboard, and on phones and tablets that can share, Share opens the system’s share sheet. Pressing the code copies the code.

You can also just read the code out. Your friend types it in the lobby under Join with a code. Codes use capital letters and the digits 2 to 9, without I, O, 0 or 1, so they are hard to misread; small letters, spaces, full-width characters and a pasted invite link are all accepted.

Your friend joins

The link opens the home page with a line above the buttons: Sign in to join room ABC234. After signing in, your friend sees the join page, which names you as the host and lists the number of rounds, the password (if any) and both room settings, so they know the terms before they join. They type the password and press Ask to join.

Your device lets them in at once; you do not have to do anything. The one exception is a player who walked out of a match against you before (see After the match): then you are asked, and choose Let them in or Ban for 12 hours. A room holds exactly two players, so once your friend is in, nobody else can join.

The match starts

Both screens now show Securing the session while the two devices agree on keys that only they hold. A coin flip that neither device can steer picks the first dealer, and the cards are shuffled and dealt face down by both devices together, in seven short steps. From then on you play exactly as against the computer: the same rules, the same table, and the same room settings for both of you.

The shuffle

At the start of each round the two devices shuffle the deck in turn, each locking every card with secret keys of its own. This is a known method called mental poker. A card can be read only when both players’ keys for it come together: your device gets the keys for your own hand, so only you see your cards, and a card you play is opened for your friend as you play it. Neither player can choose the deal, and the server holds no key at all.

Each step of the shuffle also carries a zero-knowledge proof: it shows that the step was done honestly (the same cards, only reordered and locked again) without revealing the new order or the keys. The other device checks the proof before it accepts the step, so a tampered deck is refused on the spot, before anyone can learn a card from it, and its author is named. When the round ends, both devices still reveal their keys and go over each other’s steps a second time. If a match ends early, in the middle of a deal, the winner’s device reveals its keys for that deal too, and the other device checks them before it confirms the result.

Every move

Each move is encrypted on your device, signed with a key made for this match only, and chained to the move before it. Your friend’s device replays it with the same rules engine. If the move is legal, it signs it too, and only then does the move count. A move, once shown to the other device, can never be taken back: if it is refused, it is sent again exactly as it was, and if it is refused a second time, or a move proves cheating, the match stops as disputed and counts for nobody. Because every move carries both players’ signatures, neither of you can later deny or rewrite it.

For the technically minded: the keys come from a post-quantum key exchange (X-Wing, which combines ML-KEM-768 with X25519), moves are encrypted with XChaCha20-Poly1305 and signed with Ed25519, and a room’s password, stretched with scrypt, also goes into its keys. Everything else the two devices send each other (the answers to moves, the connection details, the end of the match and its result) is encrypted and signed the same way. To rule out anyone in the middle, press the lock icon at the table and compare the security code, five emoji, with your friend over another channel: it must be identical on both screens.

What the server sees

Direct connection. Every match connects the two browsers directly (WebRTC): they send the same encrypted, signed moves to each other instead of through the server, so each player can see the other’s IP address. To keep yours hidden, switch on Hide my IP address in Settings: your side then connects only through a relay server, or, where the game has none, through its server. Until the direct connection is up, and whenever it drops, the moves go through the server, still encrypted and signed, and the game keeps trying to connect directly by itself. The lightning icon beside the lock at the table shows how the moves travel.

What all this cannot do: make a player move (that is what the turn clock is for), or make a player confirm a result. A match counts for the rankings only when both players’ devices confirm the same result; one they do not both confirm counts for neither player.

Disconnects and reloads

If a player’s connection drops, the other screen counts down the time they have to come back: “Hana disconnected · 2:41 to come back”. That is 3 minutes, timed by the server. Back in time, the match goes on where it was. After that, the player who stayed can press Claim win or keep waiting; nothing happens by itself. The win counts once the absent player is back and their device confirms it, so a player who never comes back leaves the match unrecorded for both.

Reloading the page, closing the tab or the app, or restarting the device is safe. The match keys are kept on your device, encrypted, for up to 7 days, and the next time you open the game in the same browser it takes you back to the room, where the match picks up where it was. They are kept nowhere else: a match started in one browser cannot go on in another, or on another device (on an iPhone or iPad, Safari and the Home Screen app count as two). There, the only choice is to resign, and the match then counts for neither player. Opening the room in a second tab shows Play here, which moves the match to that tab. Signing out removes the saved matches from the device.

After the match

When the match ends, both players see the result. The host can press Keep the room open: the room goes back to waiting with the same code, and your friend opens the invite link again to start another match. Close room ends it, unless your friend was away when the match ended and has not confirmed the result yet: the room then stays open without an opponent, keeping how the match ended for them, until you close it from the lobby or let another player in. To stop in the middle, press Resign (the flag in the toolbar) and your friend is awarded the win, once both devices have confirmed it; leaving the room or signing out during a match resigns too, after asking first. Signing out also removes the saved matches from your device: it first gives their results a few seconds to be confirmed, and a resignation not confirmed by then counts for neither player.

Under the result, a line says where it stands: Confirmed by both players, Waiting for Hana to confirm — it is recorded when they do, or Not recorded with the reason. Your device keeps trying to finish that step after you leave the room, and the next times you open the game, for up to 7 days.

An opponent who cut a match short (walked out, resigned, stayed away until you claimed, stopped the match with a dispute, or claimed a win your device did not confirm) goes on a list kept only in your browser. If they later ask to join a room you host, you are told what happened and decide between Let them in and Ban for 12 hours.