Boxer.io

Press Start and Boxer.io shows you a lobby. Ten portraits in two rows, a caption reading "Matching players" with the dots crawling one by one, and your own face sitting in the sixth slot while the other nine trickle in a fraction of a second apart. It looks like a queue filling up. It is a stopwatch. The screen holds for 3.5 seconds whatever happens, the nine strangers are drawn on the spot from a list of names inside the game file, and no packet ever leaves your computer.

That is worth knowing before you get attached to the leaderboard, because the game underneath is better than the costume it wears. You are a small animal in boxing gloves in a wide arena, and so are nine others. Punching a rival takes one of his three lives; taking his last one drops a shower of experience pellets anybody nearby can hoover up, and every hundred points you collect adds a life of your own, to a maximum of six. The clock runs for two minutes and your reward comes from where you finish rather than from surviving — trophies pay out as 5 × (6 − your place), so fifth gets five, first gets twenty-five, and sixth to tenth get nothing.

The reach of your punch is the stat that decides everything, and it is not fixed. It is 300 units plus 10 per glove level, which is why the menu matters as much as the arena. Boxer.io was built by XTStudio, a name GameMonetize attaches to 69 games and which has no website, no registration and no public face. The files are more talkative than the label: the code still calls WeChat's rewarded-video API, still carries nine WeChat banner slots that do nothing here, still asks Douyin's screen recorder to roll, and names its matchmaking scene pipei and its rank function getDuanWei — Chinese words in pinyin, written by someone who was thinking in Chinese. It compiled on 1 October 2022, the same day Y8 listed it, and was repackaged for this CDN in October 2023.

What the lobby is really doing

The matchmaking screen is the most elaborate thing in the game, and it is a piece of theatre with a script. Ten slots, you in the sixth, and the other nine appear on individual timers set between half a second and two and a half seconds so that they arrive raggedly, the way real people would. Each one gets one of six characters and one of thirty gloves at random, and a name pulled from an array of 290 English first names — 288 unique, because Elsa and Sandra were pasted in twice. The array is reloaded whole at the start of every match and names are removed as they are handed out, so within one fight nobody shares a name, and across fights you never see the same nine.

We watched it happen. At 1.2 seconds the screen held "Matching players.." plus Steve and yourself; at 2.4 seconds it held all ten — Emily, Steve, Kay, Kelly, Emerald, you, Josie, Selina, Mia and Kate. The next match produced Karen, Benson, Caroline, Nina, Lorraine, Nicole, Ray, Neil and Martin.

There is no network code to contradict this. The entire game logic is one 83 KB file, and the only web address in it belongs to the advertising SDK. A full instrumented session — menu, lobby, a complete two-minute match — made 285 requests, all of them for the game's own images and sounds, and opened zero WebSockets. The distributor's own product copy gives the game away in passing when it calls the arena "PvE", which means player versus environment, and nobody reads it.

What the bots do instead is simple enough to exploit. Every half-second to three-and-a-half seconds each one rolls a die: half the time it charges the nearest living fighter within 800 units and throws three to six punches; four times in ten it turns and runs from that same fighter; one time in ten it walks to the centre and hits a tyre. There is no memory and no coordination: a bot that just fled will charge you two seconds later.

The menu is a different game, and it is an idle one

Close the arena and Boxer.io becomes a merge game. Twelve slots, thirty tiers of glove, and the rule you already know: drag a glove onto another of the same tier and they become the next tier up. Drag one to the bin to sell it for half. Drag one onto your fighter to wear it.

Every glove on the board prints coins on its own, every three seconds, at 10 × 2^(tier − 1). The header shows the total per second, and buying a second level-1 glove took ours from +3/s to +6/s in front of us. That figure is the currency of the whole economy — glove prices, end-of-match payouts and idle earnings are all multiplied by it — which is why a player who never merges anything stalls.

Because that timer is the other half of the design. Every match costs 5 stamina out of a bar of 50, and the bar refills at one point per ten minutes — with the tab closed, with the laptop shut, it makes no difference. Ten matches and you are done for the next hour or so, unless you spend diamonds, spin the wheel or watch a video. Offline earnings are capped too, and the game says so out loud: "Offline rewards are capped at 2 hours". None of this was designed for a browser. It is the retention machinery of a Chinese mini-programme game, shipped intact.

A phone game in a laptop window

The feed serves this one at 750×1334, and for once the feed is right: that is exactly the resolution the build declares. The consequence on a desktop is unusual enough to be worth describing before you sit down.

Cocos scales the interface to fit both dimensions, so in a 1280×720 window the entire user interface renders in a strip 405 pixels wide — under a third of the width — with 437 pixels spare on each side. On our own page, in a 1440×900 laptop window, the playable column measures 395 × 702 inside an 804-pixel-wide frame. But those flanks are not black bars. The camera paints the whole canvas, so the game's own background spills into them: a blue tiled wallpaper of gloves in the menu, and the arena floor itself during a match. The odd result is that a desktop player sees more of the battlefield than a phone player does, while the scoreboard, the clock, the stick and the two buttons stay pinned in that narrow middle column.

On a phone it fills the screen, which is what it was drawn for. GameMonetize flags the game desktop-only; that flag is wrong.

Playing Boxer.io unblocked at school

The usual question has the usual answer: one HTML page, nothing to install, no plugin, no account, no download. If the address opens, the game opens, because a filter matches a hostname and never a game.

The interesting catch is elsewhere, and it belongs to this game alone. Everything you earn lives in the browser's own storage for that single site — seventeen keys holding your coins, diamonds, twelve glove slots, trophies, unlocked characters, total kills and nickname. Nothing sits on a server, because there is no server. At home that is a feature. On a shared Chromebook that wipes site data at sign-out, in a guest window, or on a different machine in a different room, you begin again at 1,000 coins and an empty board every time. This is a game about accumulating things, and a managed computer is very good at not accumulating things.

The stamina clock makes the same point from the other side. Five per match, fifty in the bar, one back every ten minutes: a lunch break buys ten fights and nothing buys an eleventh. That is the game's own design rather than any school restriction, and it means two or three matches at a time is the honest way to play it.

If the address is refused, the two answers that get nobody into trouble are asking a teacher whether it can be allowed and playing at home, where it is the same free page.

More free boxing games online

For a fight where the opponent is a person rather than a name from a list, try the two-player shelf: Drunken Boxing gives each player four keys and an energy bar to ration, Drunken Boxing 2 rebuilds it in 3D, and Boxing Random cuts the sport down to one key each. Rabbit Punch is the reaction test of the same idea.

If the arena appealed more than the boxing, Football.io is the other game here with an .io in its name and no network behind it, and we wrote separately about where .io games came from. 12 MiniBattles collects one-screen duels for two. More of the shelf is in our arcade category.

1. Buy a glove before your first fight. The menu opens on twelve empty slots and 1,000 coins. The first glove costs 103 and immediately starts printing more.
2. Press Start. It costs 5 stamina. Sit through the 3.5-second lobby.
3. Steer with W, A, S and D, punch with L. Your two gloves alternate, half a second apart, and they only connect inside your reach — 310 units at glove level 1, 600 at level 30.
4. Eat the pellets. Blue pellets spawn constantly and fallen boxers drop a pile of them. Every hundred points is a level, and every level is another life.
5. Finish in the top five. Trophies only exist there. A hundred trophies is a rank step, from Black iron I up through Bronze, Silver, Gold, Platinum, Diamond and Champion.

Things you only learn by playing it:

• Your boxer has no brakes. Tap W and release it and he keeps walking north at 400 units a second until you press something else. We measured 1,300 units travelled from a 0.3-second press. It is a bug in the key handler; steer by pressing a new direction rather than expecting to stop. The on-screen stick does halt him on release, which makes the mouse genuinely competitive here.
• P is a dodge, not an attack. The spin lasts three seconds, multiplies your speed by 1.5 and makes you untouchable for its whole duration. Use it to cross open ground or to walk out of a fight you are losing, not to finish one.
• The middle of the map is a trap and a gift. One decision in ten sends a bot to the centre to punch the tyres. If you sit near the middle at low level you will meet a queue of them; if you sit near the middle at level 3 you will farm it.
• Let the first thirty seconds happen without you. Ten boxers all start at three lives and the bots attack whatever is within 800 units. Our second match went from ten alive to eight before we had thrown a punch. Stay wide, collect pellets, and arrive at the brawl a level up.
• Space bar also punches. The tutorial only ever mentions L. The key is wired and undocumented.