How Provably Fair Crypto Casinos Work

Provably fair is a specific cryptographic arrangement, not a marketing adjective. It lets you confirm after the fact that the result of a bet was fixed before you placed it and was not chosen once the operator knew what you had staked. It is a genuinely strong guarantee against one particular kind of cheating, and it is routinely oversold as a guarantee against everything else.

The Commitment Comes First

Before you play, the server generates a random server seed and shows you only its SHA-256 hash. A hash is one-way: you cannot work backwards from it to the seed, but once the seed is later revealed you can hash it yourself and check it matches what you were shown. That published hash is a commitment. From that moment the operator is locked to that seed and cannot swap it for a more convenient one without breaking the hash.

The Three Inputs

• Server seed — secret during play, revealed on rotation, hash published in advance.
• Client seed — yours. You can and should set it to something you chose. This is the part that stops the operator pre-computing a favourable sequence, because it cannot know your string in advance.
• Nonce — a counter that increments by one with each bet, so the same seed pair produces a different result every round.

If a site does not let you set your own client seed, the scheme is decorative. With both seeds under the operator's control, it can search for a seed whose outcome sequence suits the house and still publish a valid-looking hash.

From Hash to Roll

The three inputs are combined with a keyed hash, almost always HMAC-SHA256, with the server seed as the key and a string such as clientSeed:nonce as the message. The output is 64 hex characters. That output is then converted to a number in the game's range: the usual method takes the hex in four-byte groups, treats each byte as a value from 0 to 255, and sums byte / 256n across the group to build a fraction between 0 and 1, which is scaled to the game's outcome space. The dividing point for win or lose is set so that the payout multiplier equals the target RTP divided by the win chance — at a 1% edge, a 50% win chance pays 1.98×.

Verifying a Round Yourself

1. Note the published server seed hash before you start, along with your client seed.
2. Play, keeping the nonce of the bet you care about.
3. Rotate the seed. Rotation is what triggers the reveal of the old server seed; an unrevealed seed cannot be checked.
4. Hash the revealed server seed with SHA-256 and compare it to the commitment you noted. If it does not match, nothing else matters — the operator changed the seed.
5. Compute HMAC-SHA256 over your client seed and nonce using the revealed server seed as the key, then apply the site's documented conversion. The result must equal the outcome you were shown.

Any general-purpose HMAC-SHA256 tool run offline is enough for step five, and doing it outside the operator's own verifier is the point of the exercise.

What the Proof Does Not Cover

Verification says the result was honest. It says nothing about any of the following, and each has been a real failure mode:

• The house edge. A provably fair game with a 10% edge is provably fair and still expensive. The proof covers randomness, not the payout table.
• Whether you get paid. Solvency, withdrawal limits and account closures are entirely outside the cryptography.
• The commitment's timing. If the hash is published after bets rather than before, the scheme is worthless. Check that the hash is visible before your first wager.
• Everything that is not the RNG. Bonus voids, altered terms and frozen balances are contract problems, not hash problems.

A fairness page that gives you the algorithm, the exact conversion method and a way to check outside the site is doing this properly. One that says "all games are provably fair with SHA-256" and offers no seeds, no nonce and no method is telling you nothing you can test. If you want the wider due-diligence process, see how to check whether a crypto casino is legitimate.