Multiplayer browser games with private rooms let only invited friends in, and Bomb Appétit works that way. There is no public lobby to browse. A host creates a room, gets a five-letter code, and sends it to friends. Only people holding that code can join, and each sees only a display name and a role.
What makes multiplayer browser games with private rooms private?
A room is private because nothing lists it. In Bomb Appétit, the Play page offers two buttons that matter here: create a room, or join one by typing its code. There is no directory of open rooms, no matchmaking with strangers and no public chat, so a room exists for exactly the people who were told its code.
Plenty of browser games work the other way. They drop players into a shared lobby, pair them with whoever is waiting, or show a list of games anyone can enter. That suits some games. It does not suit a bomb round, which depends on a small group that can talk freely and trusts each other with the timer.
The code does the job a guest list would do at a party. A host presses create, the server picks five letters that no current room is using, and the room appears with that code in large type. Friends type the same five letters into the join box, or follow a link that carries them, and land in the lobby. Nothing else in the game points to the room.
Privacy here also means each screen holds only what its owner needs. The bomb exists on one device, the Defuser's, and Experts never receive it. That is a fairness rule more than a privacy rule, but it shapes what a guest can and cannot learn by joining.
A group that wants to keep things even tighter can rely on the second channel every round needs anyway. The game has no voice chat, so friends are already on a phone or video call together. Reading the code out on that call, or pasting it into the call's own chat, keeps it inside a circle of people who already know each other. If you read it aloud, the advice in reading a game room code aloud without mix-ups saves a wrong guess or two.
Who can get into a private bomb room?
Anyone who has the room's code and a recent browser can join, up to the room's limit, and nobody else can. The limit is one Defuser and four Experts. When the four Expert seats are taken, the room refuses further players with a message that it is full, so a sixth person cannot squeeze in.
There is no password beyond the code and no approval step for the host. That keeps joining quick, which matters when four friends are waiting on a call. It also means the code is the whole secret. Whoever you give it to can walk in, and whoever they forward it to can walk in too.
Joining does not need an account. Guests type a display name and they are in, with no email and no sign-up. Signing in with GitHub is optional and only adds leaderboards and saved progress. So "who can get in" does not depend on accounts at all; it depends only on who holds the five letters.
Joining also does not hand anyone control. The host is the player who created the room, and only the host can change what the room will play and start the bomb. A guest who joins can pick a role and read the manual, but cannot swap the mission or arm the bomb.
Roles have their own lock. Once the bomb is armed, nobody can switch seats until the round ends, so a late arrival cannot grab the Defuser role mid-countdown. They can wait in the lobby, watch the result appear, and take a seat for the next round.
Many groups play this over a voice call with no video at all, and the room works the same way. Ways to run that kind of call well are in games to play on call with friends, voice only.
What other players in a private room learn about you
Other players in a room see the display name you typed, your role and whether you are the host. If your browser drops off, the lobby marks you as away. They do not see your email, your GitHub account or anything about your device. The name is whatever you chose, from one to twenty-four letters or numbers.
That name is the only personal detail a room holds about a guest. Pick a nickname your friends will recognise, since a list of five people called "me" helps nobody choose a Defuser. If you would rather stay anonymous, a first name or an initial is plenty.
During a round, each role sees a different slice. The Defuser sees the bomb. Experts see the manual for the room's rule seed and a status line: the time left, the strikes, the modules solved and whether a needy module is awake. When the round ends, the result shows in the room for everyone, with a link to the run.
Who sees what in a private room
The table shows what each kind of person can see. It describes Bomb Appétit's rooms; the names in the first column are roles, not real players.
| Person | Display names | Roles | The bomb | The manual | The last result |
|---|---|---|---|---|---|
| A guest Expert | Yes | Yes | No | Yes, for the room's seed | Yes |
| The Defuser | Yes | Yes | Yes, while it is armed | Not by the rules of the game | Yes |
| The host | Yes | Yes | Only if the host is the Defuser | Yes, unless the host is the Defuser | Yes |
| Someone without the code | No | No | No | Any public manual, but not which seed the room uses | No |
Two cells deserve a note. The manual is a public page, so anyone can open manual 1 without a room; what the outsider lacks is the room's seed and everything else about the round. And the Defuser could technically open a manual in another tab, but the game only works if they do not, which is a matter of honour, not software.
One place a result can leave the room is the leaderboard. Only signed-in players are ranked, and a ranked run names the Experts beside the Defuser on that mission's public board. A group of guests who never sign in leaves no names on any board.
When does a private room close for good?
A private room does not last forever. Each room expires a set time after it is created, and after that its code no longer finds anything; a friend who tries it sees "room not found". For a new evening, the host simply creates a new room and sends a fresh code.
Expiry is a quiet privacy feature. A code pasted in last month's group chat cannot be used to drop into tonight's game, because last month's room is gone. Each evening's room is a separate space with its own code.
Within one evening, the same room serves round after round. After a bomb is defused or goes off, the host can reset the room and set up another mission, and the players stay where they are. Nobody needs to rejoin, and the code stays the same for the rest of the session. The exact lifetime, and what the host should do near the end of it, is covered in how long an online game room lasts.
Players can also leave on their own. Someone who closes the tab shows as away to the others, and someone who chooses to leave frees their seat for another friend. If the host walks away, the remaining players can still see the lobby, but nobody else can start the next bomb, so a host who needs to go should say so first.
The private room mistake: posting the code where strangers read it
A private room stops being private the moment its code appears somewhere strangers can read it: a public social post, an open forum, a stream overlay or a large server channel. Anyone who sees those five letters can join while the room is open. Send the code only through a channel limited to the friends you mean to invite.
This mistake usually comes from good intentions. A host wants to make joining easy and posts the code wherever the group happens to gather online. If that place is a public thread or a livestream, the audience includes people the host has never met.
The damage is limited but real. A stranger can take an Expert seat, fill the room so a friend cannot join, or claim the Defuser role in the lobby before your friend does. They never see the host's email or account, but they can certainly spoil the evening.
The fix is simple. Before the bomb is armed, look at the player list. If a name there is not someone on your call, ask who it is. If nobody answers, the cleanest move is to create a new room and send the new code privately. The old room expires on its own.
Phone-only groups often share codes by text message, which is about as private as it gets. Tips for that kind of group, from holding the bomb sideways to keeping alerts off the screen, are in phone games to play with friends long distance. For the wider picture of how rooms, roles and status lines fit together, see multiplayer browser games to play with friends far apart. When the code is safely in the right hands, open the Play page and create your room.