I am making a text turn based RPG fighting game in which you create your own spells. You also share them as JSON files with your friends. Sharing is required to win. The game is designed so that it isn't a problem if a spell is copied and shared one billion times

I do not want players to edit the files or the spell creator. The only reason is to not ruin others' experience. I wouldn't mind at all if there were no multi-player elements in the game.

Is there a way to make some game elements unable to be modified ?

My game is interpreted in Lua and has some bash integrated into it for file managing. It is also GNU/Linux only.

  • \$\begingroup\$ If you use json format, where you expect users to "manually" share those files with each other, there is no way to stop them from editing the files. You can maybe use a custom (maybe binary?) format, which would discourage a big percentage of users from attempting to alter them. \$\endgroup\$ Commented Oct 8, 2019 at 9:49

1 Answer 1


You can use cryptography. But doing that in a way that actually prevents people from creating spells requires that you do not ship the private key to users, which implies either an internet server, or pre-signing all the spells.

To get a little more concrete, you can cryptographically sign the spells, which essentially means you append a signature to the file which you can use the public key to authenticate. See https://en.wikipedia.org/wiki/Digital_signature

As mentioned before if the private key is on the user’s machine, then it will be possible to use it to create arbitrary spells that another copy of the game would accept! So if you want the spells to be dynamic, then you need someplace to have the private key where players can’t see it which implies a server.

But, if you don’t want to do that, another option would be to create all the shareable spells ahead of time and to pre-sign them. That way, only those spells will be accepted by unmodified versions of the game. (Someone could still modify their own copy of the game to cheat, whether you use a server or not.)

Given that this is a GNU/Linux only game as you say, I can guess that you may want to open-source it at some point. Understand that if you open-source the private key then all this crypto stuff will be circumventable. You could make a different private-public key pair for an open-source version if you like, without compromising any other key pairs.

  • \$\begingroup\$ One thing to be aware of is that even if you do have a server, users could send their own modified spells to be signed. You’ll need to have some way of verifying that the spell which was sent to the server was created in a valid way, and then you end up with the same problem as before. \$\endgroup\$
    – Ed Marty
    Commented Oct 7, 2019 at 22:30
  • \$\begingroup\$ Having a server with keys is a good option, but I don't think I will use it. Mainly because the scope of the game is small. I'm not searching for a perfect solution, but a simple one that does the job. But I really do like the idea of pre-made spells that get signed in the program. \$\endgroup\$
    – Spowmtom
    Commented Oct 7, 2019 at 23:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .