Provably fair crypto casino games work by commitment. Before you bet, the casino publishes a SHA-256 hash of a secret server seed. Your result is then calculated from that seed, a client seed you can set and a bet counter called the nonce. After the seed is retired, the casino reveals it, and you can recompute the hash and the result to confirm nothing was changed.
The problem provably fair solves
In any online game the casino's server decides the outcome, and you only see what it shows you. Nothing stops a dishonest operator from looking at your bet first and then picking a losing result. Provably fair systems close that gap by making the casino lock in its randomness before your bet exists and prove afterwards that it used what it locked in.
The tool doing the locking is a cryptographic hash function. A hash turns any input into a fixed-length fingerprint. The same input always gives the same fingerprint, a tiny change gives a completely different one, and you cannot work backwards from the fingerprint to the input. SHA-256, the function most casinos use, is specified by the US National Institute of Standards and Technology in its Secure Hash Standard (FIPS 180-4).
None of this needs a blockchain. Provably fair is ordinary cryptography running on the casino's server. It is tied to crypto casinos because those sites build their own simple games and use it to earn trust that a well-known regulator would otherwise lend them.
The inputs behind every result
Implementations differ in detail, but almost all of them combine the same four pieces of data.
| Input | Who sets it | When you see it | Why it exists |
|---|---|---|---|
| Server seed | The casino | Only after it is retired | The casino's secret share of the randomness |
| Server seed hash | The casino | Before your first bet with that seed | Commits the casino to the seed without revealing it |
| Client seed | You, or your browser by default | Always; you can usually change it | Stops the casino controlling every input |
| Nonce | Counted automatically | Shown in each bet's details | Makes every bet under the same seed pair different |
Games that need more random numbers than one calculation produces, such as a card shuffle or a Mines board, add a fifth value, often called a cursor or round, which counts the extra blocks of output. A simple dice roll only needs the first block.
What happens when you place a bet
The sequence below is how a typical provably fair dice game handles one round. The order matters: the casino commits first, you contribute second, and the result is computed last.
- The casino generates a random server seed and shows you its SHA-256 hash.
- You keep the suggested client seed or type your own.
- You place a bet. The system takes the bet's nonce, starting at 0 or 1 depending on the casino, and builds a message from your client seed and the nonce.
- It runs HMAC-SHA256, using the server seed as the secret key and that message as the input. HMAC is a standard way of mixing a secret key into a hash, defined in NIST FIPS 198-1.
- The first bytes of the output are converted into a number, and the number is mapped to the game outcome, here a dice roll between 0.00 and 100.00.
- The nonce goes up by one for your next bet. The server seed stays the same until you or the casino rotate it.
Because the hash was published before you chose your client seed, the casino could not pick a server seed that loses against your specific seed. Because the server seed was hidden, you could not predict the roll either.
Worked example: verify a dice roll by hand
The numbers below were generated for this article and can be reproduced on any computer. They follow a construction widely used for dice games: message = client seed, nonce and round joined by colons; first four bytes of the HMAC turned into a fraction; fraction scaled to a roll. Your casino's fairness page states its exact formula, and you should use that one when checking a real bet.
| Field | Value |
|---|---|
| Server seed hash (shown before betting) | 51b3a9c63cfc60149cff46c5c72605004a77b06e34e83dfeeceffacf655b4754 |
| Client seed | rollshark-demo |
| Nonce | 1 |
| Result shown in the game | 83.23 |
| Server seed (revealed after rotation) | 7f3a9c21e84b5d06f1a2c3e4b5d6f708192a3b4c5d6e7f8091a2b3c4d5e6f701 |
Step 1: check the commitment
Hash the revealed server seed with SHA-256, treating it as plain text. On a Mac or Linux terminal that is one line: echo -n "7f3a9c21e84b5d06f1a2c3e4b5d6f708192a3b4c5d6e7f8091a2b3c4d5e6f701" | openssl dgst -sha256. The output is 51b3a9c6…655b4754, identical to the hash you were shown before you bet. If a single character differed, the casino would have swapped its seed and the round could not be trusted.
Step 2: recompute the HMAC
Build the message rollshark-demo:1:0 (client seed, nonce, round) and run HMAC-SHA256 with the server seed as the key: echo -n "rollshark-demo:1:0" | openssl dgst -sha256 -hmac "7f3a9c21e84b5d06f1a2c3e4b5d6f708192a3b4c5d6e7f8091a2b3c4d5e6f701". The output starts d511f329b8f6f425.
Step 3: turn the bytes into a roll
Take the first four bytes, d5, 11, f3 and 29, which are 213, 17, 243 and 41 in decimal. Divide each by successively larger powers of 256 and add them up:
- 213 ÷ 256 = 0.83203125
- 17 ÷ 65,536 = 0.00025940
- 243 ÷ 16,777,216 = 0.00001448
- 41 ÷ 4,294,967,296 = 0.00000001
The total is 0.83230514. Multiplying by 10,001 gives 8,323.88; rounding down gives 8,323, and dividing by 100 gives a roll of 83.23. That matches the game, so the round is verified. The 10,001 multiplier exists so that every value from 0.00 to 100.00 is possible.
Run the same steps with nonce 2 and nonce 3 and you get 54.62 and 53.87. The seeds did not change, but the counter did, which is why consecutive bets never repeat.
Using a verifier instead
Most casinos have a built-in verifier on their fairness page, and independent ones exist online. They do the same arithmetic. A casino-hosted tool is convenient, but it asks the casino's current website to vouch for the casino's past result, so recomputing at least a few bets yourself, or with a tool the casino does not run, is the stronger check. A verifier only needs seeds and the nonce. Never paste a password, wallet recovery phrase or private key into one.
What a matching result proves, and what it does not
A successful check proves something narrow and useful: the outcome was fixed by inputs committed before your bet and was not altered after you placed it. It also proves the published formula produced the result you saw.
Several things stay outside its reach:
- The house edge. The payout table decides that, and the seed maths cannot change it. A dice bet that wins half the time and pays 1.98 times your stake returns 99% on average, a 1% edge, however honest the roll is.
- The conversion itself. If the formula that turns bytes into outcomes is biased, every round can verify correctly and still be skewed. The formula has to be published and sensible, and few players check it.
- Your default client seed. If you never change the seed the casino generated for you, the casino knew both inputs before it committed. Set your own.
- Rounds you cannot see. You can verify the bets in your history. You cannot verify that every other player's bets used the same code.
- Everything outside the game. Payouts, bonus terms, account closures and the licence are separate questions. A casino with a perfect verifier can still hold a withdrawal.
Provably fair also does not make outcomes feel fair. Long losing streaks are normal in a fair random process, and a verified loss is still a loss.
Seed rotation and why the server seed stays secret
The server seed is revealed only when it is retired. If the casino showed the active seed, anyone could compute every future result for that seed pair and bet only on winners. So you play a run of bets against a hidden seed, then rotate: the old seed is revealed for checking, and a new hashed seed takes its place.
Most casinos let you rotate whenever you like from the fairness settings, and many rotate automatically when you change your client seed. When a new pair starts, the nonce resets. Two habits help. Before rotating, note the bet IDs and nonces you want to check, because some interfaces show history differently afterwards. And check against the nonce stored with that bet, not the counter showing now; a mismatched nonce is a frequent reason a verification fails.
Changing seeds does not change your odds. A new client seed gives you a different sequence of results with exactly the same expected loss.
Which games are provably fair
Provably fair suits games whose outcome is one number or a short list of numbers: dice, limbo, plinko, mines, keno, hi-lo, coin flips and wheels. Crash games usually work slightly differently. Many derive each round from one link in a pre-computed chain of hashes and publish the end of the chain first, so the whole run of multipliers is fixed in advance and each revealed hash can be checked against the one before it. See the crash crypto casinos list for where these are offered.
Third-party slots and live dealer tables are generally not provably fair. A slot's random number generator runs on the game studio's servers and is certified by independent test labs instead, and a live roulette wheel is a physical object in a studio. Some studios do supply provably fair titles: 7Bit Casino builds no originals of its own, but its fair-games page explains the provably fair method built into BGaming's slots, dice and table games. How the slot and live dealer side is checked is covered in how crypto casinos verify game fairness.
Provably fair at RollShark's reviewed casinos
Of the 29 trading casinos with a full RollShark record, 21 offer provably fair games, as of October 2026. The eight without are Betpanda, Bets.io, CoinCasino, Instant Casino, Lucky Block, Mega Dice, TG Casino and Vave. Some of them carry studio-built provably fair titles such as Spribe's Aviator, or advertise provable fairness, but none documents a seed system for games of its own. The table picks examples from our records to show how much the offer varies.
| Casino | In-house provably fair games | Detail from our records |
|---|---|---|
| BC.Game | A long list of BC Originals | Seed pair and nonce, a public Crash hash chain; originals cut from 99% to 96% RTP |
| Stake | 31 Stake Originals | HMAC-SHA256 with seed pair, nonce and cursor; Limbo at a 1% edge, other games vary |
| Jackbit | 22 MiniGames | HMAC-SHA256 seeds, with your client seed in every result |
| Cloudbet | 15 Cloudbet Originals | SHA3-256 and SHAKE256; Dice and Plinko at 99% RTP |
| Wolfbet | 5 house games | 1% house edge; per-game HMAC-SHA256 method published |
| BetFury | 24 Originals | Its documentation hashes the result with no client seed; its home page describes a seed pair and nonce |
| Thunderpick | 3 Originals | ThunderSpin checked as SHA256(salt + number); no client seed |
| DuckDice | 2 dice games | SHA-256 commitment, SHA-512 rolls, published code verifier |
Counts and features come from each casino's RollShark record; the number of originals changes as studios add games. The table cannot tell you whether each implementation's conversion formula is unbiased, only how much of the data needed to check results the casino exposes. Thunderpick's scheme proves a ThunderSpin result was not changed after the bet, but without a client seed it cannot show the operator had no say in it, and BetFury's two pages describe different systems. The full filterable list is on the provably fair crypto casinos page, and if you are still deciding whether crypto gambling is for you at all, start with what a crypto casino is.
Whether you play on plinko casinos or dice sites, set a loss limit before you start. A verified round can still be one you could not afford.
Frequently asked questions
Can a casino cheat on a provably fair game?
It cannot change a committed result without the hash check failing, as long as you set your own client seed after seeing the server seed hash. It can still offer poor odds, use a biased conversion formula or refuse withdrawals, which provably fair does not cover.
Do I need to verify every bet?
No. Checking a handful of bets after each seed rotation, and any result that looks odd, is enough to catch an operator that is not honouring its commitments. The value is that you can check any bet you choose.
Why is the server seed hidden until I rotate it?
Revealing an active server seed would let anyone calculate the next results before betting. Keeping it hidden until it is retired protects the game, and the hash shown in advance stops the casino from swapping it.
Does changing my client seed improve my chances?
No. A new client seed produces a different sequence of outcomes with the same probabilities and the same house edge. Its purpose is to stop the casino from knowing every input in advance.
Are slots at crypto casinos provably fair?
Usually not. Slots from studios such as Pragmatic Play run on the studio's certified random number generator, which you cannot check round by round. A few studios, BGaming and Spribe among them, publish provably fair titles.