I'm building an HTML game. For this game I want to implement a save-feature that should work like in some already existing games:

The user can chose export, this will create a string, representing the game state (I guess). This string can be pasted into an import input and will load the save game.

I thought about storing the state in a JSON, minifying it, stringifying and encoding it in Base64. But I don't think this is a good idea, users could easily cheat in this game by decoding the string, changing whatever they want, encoding it again and loading this string.

I already tried generating save files in games with this feature and decoding them in Base64 which didn't work, so I assume they use a different encoding.

How can I encode the JSON like this?

  • 1
    \$\begingroup\$ Welcome to GDSE. This seems like a possible duplicate of How do I implement a retro-style password-based "savegame" system? If you feel your question differs or the answers there won't work for you, please consider editing to emphasize the differences. \$\endgroup\$
    – Pikalek
    Aug 19, 2019 at 0:35
  • \$\begingroup\$ Also, any time you hand over game state data to players, there's an opportunity for it to be misused. It's possible to make this harder for them (hashing, etc) but in most normal circumstances, you won't be able to prevent it all together. \$\endgroup\$
    – Pikalek
    Aug 19, 2019 at 0:39
  • \$\begingroup\$ Maybe this will be useful not related directly but should help, as the language is only tool docs.godotengine.org/en/3.1/tutorials/io/… \$\endgroup\$
    – grzesiekmq
    Feb 16, 2020 at 11:46
  • 4
    \$\begingroup\$ If this is a single-player game, why does it matter if users cheat? It takes some effort and knowledge to decode a string, find which data changes what in the game, so if someone decides to do that, why not let them? \$\endgroup\$ Feb 17, 2020 at 11:56
  • 2
    \$\begingroup\$ If this is an HTML game that runs its game loop entirely in the browser then the player is already free to use their browser's Javascript console to tamper with your game at run time. They don't even need the save data to cheat. \$\endgroup\$
    – Romen
    Mar 17, 2020 at 15:00

1 Answer 1


If you want to be sure they won't misuse save data don't give it to them in any form :)

You may give them some key to save stored on for example firebase or playfab that they can recover by entering it or just create authentication mechanism that will connect them to all their data saved in cloud.

If you don't really care just give them that JSON.

If someone will want to decode it he will just find your part of code that decodes it on frontend. You may want to make it a little bit harder for them by hiding decoding mechanism on server but that just turns it into more fun for hacking.

  • \$\begingroup\$ I disagree with giving raw JSON. Not giving raw JSON for end user will prevent most CASUAL players from adjusting its data. Furthermore, making it more challenging to hack actually draws longer attention from those who actually knows how to do it (win for you as well). \$\endgroup\$
    – eLTomis
    Jul 15, 2020 at 13:26
  • \$\begingroup\$ @TomasŠvedas maybe using some asymetrical encoding for data that requires server side for decoding could be a little bit harder for hackers and still give ability to keep local copy of game data that is to hard to crac for casual players but at some point if hacker cracs it he can create tool for casual players to edit this data \$\endgroup\$
    – Xesenix
    Jul 15, 2020 at 14:31
  • \$\begingroup\$ still, think of it as free promotion. Now imagine, your game is hard to hack, hackers discuss, people looks for tools, your game name shows in search - free promotion. Then, the hack is released, people are posting and sharing the hack - also promotion. Those, who hack, will always hack, so you can try turning that as a benefit for you. \$\endgroup\$
    – eLTomis
    Jul 15, 2020 at 14:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .