Hash coordinates (back-end) without the client (front-end) knowing the coordinates, but to be able to guess them
You should not send salt to the front end. Send only the hash. After the &quot;game&quot; completed, e.g. after the front end has done 20 attempts you named, you should present the right answer and the salt. Thus every participant can check that the hash you presented at the beginning really matches the message and the salt.
And the cryptographic properties of SHA-256 guarantee that you cannot deny the right answer, because there is no easy way to find another message (coordinates in your case) and another salt, that produce the same hash. In your example, if you publish hash sZv6eqPT9bqGiXbjvO8yrb4wuFjl0Z1CwSHdnIgGqEI=, then everyone can be sure that you cannot find any other salt and any other message (coordinates) that produce the same hash.