0
\$\begingroup\$

I'm building an HTML game. For this game I want to implement a save-feature that should work like in some already existing games:

The user can chose export, this will create a string, representing the game state (I guess). This string can be pasted into an import input and will load the save game.

I thought about storing the state in a JSON, minifying it, stringifying and encoding it in Base64. But I don't think this is a good idea, users could easily cheat in this game by decoding the string, changing whatever they want, encoding it again and loading this string.

I already tried generating save files in games with this feature and decoding them in Base64 which didn't work, so I assume they use a different encoding.

How can I encode the JSON like this?

\$\endgroup\$
  • 1
    \$\begingroup\$ Welcome to GDSE. This seems like a possible duplicate of How do I implement a retro-style password-based "savegame" system? If you feel your question differs or the answers there won't work for you, please consider editing to emphasize the differences. \$\endgroup\$ – Pikalek Aug 19 '19 at 0:35
  • \$\begingroup\$ Also, any time you hand over game state data to players, there's an opportunity for it to be misused. It's possible to make this harder for them (hashing, etc) but in most normal circumstances, you won't be able to prevent it all together. \$\endgroup\$ – Pikalek Aug 19 '19 at 0:39
  • \$\begingroup\$ Maybe this will be useful not related directly but should help, as the language is only tool docs.godotengine.org/en/3.1/tutorials/io/… \$\endgroup\$ – grzesiekmq Feb 16 at 11:46
  • 3
    \$\begingroup\$ If this is a single-player game, why does it matter if users cheat? It takes some effort and knowledge to decode a string, find which data changes what in the game, so if someone decides to do that, why not let them? \$\endgroup\$ – TomTsagk Feb 17 at 11:56
  • \$\begingroup\$ If this is an HTML game that runs its game loop entirely in the browser then the player is already free to use their browser's Javascript console to tamper with your game at run time. They don't even need the save data to cheat. \$\endgroup\$ – Romen Mar 17 at 15:00
0
\$\begingroup\$

If you want to be sure they won't misuse save data don't give it to them in any form :)

You may give them some key to save stored on for example firebase or playfab that they can recover by entering it or just create authentication mechanism that will connect them to all their data saved in cloud.

If you don't really care just give them that JSON.

If someone will want to decode it he will just find your part of code that decodes it on frontend. You may want to make it a little bit harder for them by hiding decoding mechanism on server but that just turns it into more fun for hacking.

| improve this answer | |
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.