Provably fair: how to verify for yourself that a game did not cheat

At an Estonian-licensed casino the trust question has an institutional answer. The games are certified, the Tax and Customs Board supervises, and in a dispute there is an authority to turn to.

At a crypto casino there is none of that. A Curaçao or Anjouan licence gives you no legal remedy in Estonia and no Estonian authority has jurisdiction over that operator. You are essentially on your own.

Provably fair is the industry's answer to exactly that problem. The idea is simple and technically elegant: instead of asking you to believe the casino did not alter the result, the casino gives you a mathematical proof you can verify yourself — without trusting the casino, without an auditor, without a regulator.

It is a real thing and it works. But there is a cloud of misunderstanding around it that turns it into a marketing word, and players who say "this casino is provably fair, therefore honest" have understood about half of it.

In this guide we take the whole mechanism apart: what the server seed, client seed and nonce are, why the hash given before play is the heart of the system, how to genuinely verify one specific result, and — most importantly — what provably fair does not prove. That last part is longer than the first, and it is the reason this article exists at all.

The problem it solves

Imagine the simplest possible online game: a coin flip. You bet, the server decides the outcome, the server tells you whether you won.

The problem is obvious. The server decides the outcome after it sees your bet. If it wanted to cheat, it would not need anything sophisticated — it would simply decide differently. You would see no difference, because you never see what "should" have come up.

An ordinary casino solves this with a third party: an independent laboratory tests the generator, a regulator supervises the laboratory. You do not trust the casino, you trust the chain behind it. That works, but it requires the chain to exist — and with a crypto casino it mostly does not.

Provably fair solves it without a third party. The trick is known in cryptography as a commitment scheme and in everyday life it is as old as a sealed envelope.

The analogy that explains the whole thing. I write a number on a piece of paper, seal it in an envelope and hand the envelope to you. You cannot see what is inside. Then you say your number. Then we open the envelope and combine the two numbers into a result.

I cannot cheat, because the envelope was in your hands before you said your number. You cannot cheat, because you did not know what was in the envelope. Neither of us has to trust the other.

Provably fair is exactly that, except the envelope is a cryptographic hash. And that makes it better than paper: the hash is public, but its contents cannot be derived from it.

Three ingredients

Every provably fair system consists of three things. The names are the same across operators, so you can learn them once and use them everywhere.

1. The server seed

What it is. A random string the casino generates. This is the "number in the envelope" — the thing that gives the result its randomness.

Why you do not see it. If you could see the server seed before play, you could calculate every result in advance and only play when you win. The system would be useless in the opposite direction.

What you see instead. Its hash — a fingerprint computed with the SHA-256 algorithm. The hash is a long run of characters, unique to that specific seed, from which the seed cannot be worked back. The properties of hash functions that the whole thing rests on are described under the SHA-2 family.

That hash is the heart of the system. The casino gives it to you before your first bet. From that moment it is locked: if the casino later changed the seed, the new seed would not produce the same hash. It has bound itself.

2. The client seed

What it is. A string that you provide. The client seed is usually generated automatically, but it can and must be changed.

Why it exists. Without it, the casino would know the whole sequence of results in advance. It could not change them after your bet, but it could know them beforehand — and use that, for instance in what it offers you or the order in which it shows games.

Your contribution to the sequence makes that impossible. The casino does not know what you will enter, so it does not know the combined result.

A practical requirement: if you have never changed the client seed, you are using the casino's own generated value and have given away half the guarantee. We come back to this below.

3. The nonce

What it is. A simple counter. The first bet is nonce 0, the second 1, the third 2.

Why it is needed. Without it, the same pair of seeds would give the same result every time. The nonce ensures every bet differs without having to rotate seeds.

Practical meaning: the nonce is also your bet counter. To verify a result you need to know which bet number it was.

How the result is actually calculated

The three ingredients go into one function and a number comes out. The exact implementation differs between operators, but nearly all follow the same pattern.

Step 1: combination. The server seed, client seed and nonce are combined and run through a cryptographic function — typically HMAC-SHA256, where the server seed is the key and the client seed together with the nonce is the message.

The result is a long hexadecimal string — something like 4a7d1ed414474e4033ac29ccb8653d9b…, only twice as long again.

Step 2: conversion to a number. The first characters of that string are taken and converted into a number. Typically four bytes are taken, converted into an integer and divided by the maximum to give a value between zero and one.

Step 3: mapping to a game outcome. Now everything depends on the game:

• Dice: the 0–1 value is multiplied by 100 → a result of 0.00–99.99.
• Limbo: the value is converted into a multiplier by a formula that produces the right distribution.
• Plinko: for each row a separate bit decides whether the ball goes left or right.
• Mines: a sequence of values determines which squares get the bombs.
• Crash: one value determines the moment the multiplier drops.

The most important property. This whole chain is deterministic. The same three inputs always produce the same result — on any computer, at any time. That is precisely what makes verification possible: if you know the three inputs, you can compute the result yourself and compare it with what the casino displayed.

And here is the beauty of the system: the casino cannot lie in either direction. It cannot change the result, because the seed was locked by the hash. Nor can it claim the result was different, because you recompute it yourself.

The games this applies to are usually called originals — games the casino built itself. The concept is explained in the provably fair glossary entry.

Step by step: verify one result for real

Theory is useless if you never do it once. Here is a procedure that takes about five minutes and after which you will know whether your casino's system genuinely works.

Step 1 — set your client seed. Open the game settings, find "Client seed" and enter your own value. Anything — a word, a number, whatever. This is the most important step and it is the one most players skip.

Step 2 — save the server seed hash. In the same place there is "Server seed (hashed)" — a long hex string. Copy it somewhere outside the casino, for instance into a notes app. This is your envelope and the only piece of evidence whose value depends on you having it beforehand.

Step 3 — play a few rounds. Five to ten bets is enough. Note which bet number the one you want to verify was — that is the nonce. Most interfaces show the nonce in the bet details.

Step 4 — rotate the seed. This step is essential, and here is why: the casino only reveals the server seed once it is no longer in use. If it revealed it immediately, you could compute the next results in advance. So: click "Rotate" or "New seed".

Step 5 — retrieve the old server seed. It is now visible — usually in the seed history, under "previous seeds".

Step 6 — verify the hash. Take the revealed server seed and compute its SHA-256 hash. Casinos usually have a built-in verifier for this, but you can use any independent SHA-256 tool — and independent is better, because trusting the casino's own verifier leads you in a circle back to the start.

Compare that hash with the one you saved in step 2. If they are identical, the casino has kept its promise: the seed your bets were calculated with is the same one it locked for you beforehand.

If they are not identical, that is a very serious finding. It means the seed was swapped in the meantime. Stop playing there.

Two practical notes on this step. First: compare the hashes character by character or with a copy-paste comparison, not by eye. A SHA-256 hash is 64 characters long and two different hashes can share their opening characters. Second: check that you are using the same hash algorithm — almost every operator uses SHA-256, but the odd one uses something else and it will be stated in the documentation. A hash computed with the wrong algorithm will never match, and that looks like fraud while in fact being your own mistake.

Step 7 — recompute the result. Enter the server seed, client seed and nonce into a verifier and see whether the result matches what you saw in the game.

What you now know. You have proved that a specific result was predetermined independently of your bet. Not "the casino said so" — you calculated it yourself.

How long it actually takes. About fifteen minutes the first time, because you are hunting for the right places in the interface. Two minutes the second time. And after the second time you no longer need to do it every time — it is enough that you know the system works at that house, and that you check again if something looks suspicious. That is what the mechanism is for: not constant verification, but verifiability.

What provably fair does NOT prove

This is the most important chapter in the article and the reason "provably fair" as a marketing term is misleading.

1. It says nothing about the house edge

Provably fair proves the result was fairly generated. It says nothing about whether the game's payouts are fair.

A casino can offer a perfectly verifiable game with a 15% house edge. Every result is verifiable, every hash matches, and you still lose three times faster than in an ordinary slot. The system works exactly as promised — it just does not promise what you thought.

What to look at instead: the game's published RTP and volatility. Those are separate numbers and must be checked separately. For dice the house edge is typically around 1%, which is good; for some other originals it is considerably higher.

2. It does not cover third-party games

Provably fair applies only to originals — the casino's own dice, limbo, plinko, mines, crash. Slots, live tables and game shows come from external providers and use ordinary certified RNG.

That means most of the games at a crypto casino are not provably fair. If an operator advertises itself as a "provably fair casino" but you are playing a Pragmatic Play slot, that claim has nothing to do with your session.

3. It does not guarantee you get paid

The most important limitation. Provably fair protects you against one specific fraud: changing the result after the bet. It protects you against nothing else:

• Account freezes after a large win
• Withdrawals dragged out or refused
• Terms changed unilaterally
• A KYC requirement imposed unexpectedly
• The operator disappearing

You can prove mathematically that you won 5 BTC fairly and still not see a cent. The proof is not an enforceable document — there is no court to weigh it. What to actually watch when withdrawing is covered in a separate guide: how to withdraw money from a crypto casino.

4. It does not prove the original seed was random

The system proves the seed was not changed. It does not prove it was chosen randomly. In theory a casino could generate many seeds, compute all their result sequences and pick one unfavourable to you.

The client seed is exactly what cuts off that attack — because without your input the casino cannot compute the sequence in advance. And that is why changing the client seed is not optional. If you use the casino's generated client seed, the casino controls both inputs and that protection disappears.

How the system gets weakened

Not all "provably fair" badges are equal. Four patterns worth recognising.

1. The hash is given only after play. If you did not see the server seed hash before betting, there is no proof. Timing is the whole thing. Check that the seed settings page shows the hash before, not after.

2. The client seed cannot be changed. If the interface does not let you enter a client seed, or resets it to a casino value, half the guarantee has been taken away. A decent operator lets you enter any string.

3. The verifier is only the casino's own. A built-in verifier is convenient, but it is the casino's code. If it is the only way to verify, you are checking the casino with the casino's tool. A decent operator publishes the algorithm precisely enough that you can reproduce it with an independent tool.

4. Seed history is not available. If you cannot look back at old server seeds and their hashes, you cannot prove anything. The history has to be there.

What is actually a good sign

• The hash is visible before the first bet and the seed history is accessible.
• The client seed can be freely entered.
• The algorithm is documented precisely enough to reproduce independently.
• The nonce is visible on every bet.
• Rotated seeds stay in the history with a date.

If those five are present, the system is real. Among the houses we have reviewed, the originals selection and verification tools are stronger at Stake, Shuffle, Roobet, BC.Game and Rainbet — each review says what can actually be checked there. The full list is in the casino comparison.

A worked example: dice from start to finish

Take one specific bet and walk the whole chain with numbers. That makes it clear where each ingredient does its work.

Setup. You are playing dice. Before betting, the casino gives you the server seed hash — a long hex string, which you save. You enter my-test-2026 as your client seed. The nonce starts at zero.

Bet 1 (nonce 0). You bet the result will be over 50. The game shows 73.41. A win.

Bet 2 (nonce 1). Same bet, result 12.08. A loss.

Bet 3 (nonce 2). Result 55.60. A narrow win.

Now you want to check bet 2 — the one that looked suspiciously low.

Verification, step 1: rotate the seed. You click "rotate". The casino gives a new seed with a new hash and reveals the old server seed in full.

Verification, step 2: confirm the envelope was the same. You take the revealed server seed and compute its SHA-256 hash with an independent tool. You compare the result with the hash you saved at the start.

If they match character for character, one specific thing has been proved: the casino used exactly the seed it locked for you beforehand throughout that session. It could not have swapped it, because no other string produces the same SHA-256 hash.

Verification, step 3: compute the result. You now have three inputs: the revealed server seed, the client seed my-test-2026 and nonce 1. You run them through HMAC-SHA256 and convert the output into a number.

If 12.08 comes out, everything is in order. Your loss was predetermined at the moment the seed was locked — long before you chose your stake.

What that calculation proves and what it does not. It proves 12.08 was not chosen because you bet. It does not prove that dice has a low house edge, nor that your win will be paid. It is a narrow but real guarantee — and worth doing once yourself, because after that it stops being a matter of belief.

Managing seeds in practice

If you play regularly, a question arises: how often should you rotate the seed and what should you keep?

How often to rotate. Every rotation creates a new verifiable "session". Two sensible rhythms:

• Once per playing session. Start with a new seed pair, play, rotate at the end. That way each session has its own proof and verification is simple.
• Before and after a larger bet. If you make a bet larger than usual, it is worth having it under its own seed — then you can verify exactly that one without wading through hundreds of results.

What rotation does not do. Rotating a seed does not "fix your luck" or change probabilities. Every bet is independent and the seed only determines which specific number comes out — not how likely a win is. If somebody suggests rotating because the current seed is "cold", that is the gambler's fallacy in new clothes, closely related to misreading volatility.

What to keep. Three things per seed pair:

1. The server seed hash (taken before play)
2. The client seed (the string you entered)
3. The nonce range (which bet numbers, from which to which)

They fit on one line in a notes app, and without them there is nothing to verify later. Most casinos keep seed history themselves too, but your own copy is the only one that does not disappear along with the account.

One practical warning. If you rotate a seed mid-game — for instance during a crash round in progress — operators behave differently. Some finish the round with the old seed, some void it. Always rotate between rounds.

And one habit that is good regardless: if the casino interface does not show the nonce in the bet details, verification is practically impossible, because you do not know which index to compute with. Check that it is there before you start playing seriously — not when you want to dispute something.

Why this model emerged at all

Provably fair is not a crypto casino invention born of pure goodwill. It is an answer to a specific historical problem.

The original context. The first bitcoin casinos appeared in 2012–2013 and they had nothing: no licence, no audit, no reputation, no jurisdiction. A player sending bitcoin to a stranger's address had no guarantee whatsoever. The market needed a substitute for trust and cryptography was the only one available.

Why a commitment scheme specifically. It already existed, was well understood and was trivially implementable. SHA-256 was familiar to the community through bitcoin itself. The model fitted culturally too: "don't trust, verify" was that same community's founding sentence.

What has changed since. Two things that matter for today's picture.

First: the market professionalised. The largest crypto casinos are today substantial businesses that sponsor sports clubs. For them, manipulating results is commercially pointless — the house edge earns more, risk-free. Provably fair is by now more of a marketing asset than a necessity for them.

Second: regulation caught up — partly. The new Curaçao licensing system introduced requirements the old model lacked, and at European level crypto assets themselves are regulated by the MiCA regulation and travel rule requirements. That does not make a crypto casino a licensed casino, but it does mean "completely unregulated" is no longer an accurate description.

What that means for today's player. Provably fair is still useful and still real. But its role has shifted: it is no longer the only thing making a casino trustworthy, and it never was the thing that guarantees payment. When choosing a house today, its history, withdrawal speed and KYC threshold are stronger signals than whether the originals have a verifier.

If you want a comparison with an entirely different model — where trust comes from a licence rather than from mathematics — the world of Estonian-licensed houses is covered at freespin.ee, pangakasiinod.ee and, on withdrawal speed, kiiredvaljamaksed.ee. The difference is not which is "better" — it is who stands behind your win when something goes wrong.

Where all this fits

Provably fair is good technology that solves one problem very well. The question is how large a share of your risk that problem actually is.

Think about crypto casino risks in order of how likely they are:

The most likely risk: you simply lose, because the house edge works. Provably fair does not help here at all. Only knowing the RTP and controlling your stake size does.

The second most likely: bonus terms eat the win. The wagering requirement, game weighting, maximum bet and maximum cashout do more damage than any result manipulation. How the small print really works is in a separate article: how wagering requirements really work. For the arithmetic there is the bonus calculator, the wagering calculator and the max cashout calculator.

Third: the withdrawal does not come, or drags. The KYC threshold is crossed unexpectedly, the account goes into review, documents are requested. Provably fair does not touch any of that.

And only then: the casino manipulates results. That is the risk provably fair protects against — and probably the smallest of the four, because a large operator does not need it. The house edge earns money without any fraud at all.

A conclusion that is uncomfortable but honest. Provably fair is valuable and worth using. But if you choose a casino by it, you are choosing by the smallest of four risks. The more important criteria are withdrawal history, KYC thresholds, bonus terms and whether the operator has actually paid.

The licensing side — what the new Curaçao system really gives and what it does not — is examined in the new Curaçao licensing system, and the register is kept by the Curaçao Gaming Control Board. The Estonian legal side is covered in is a no-KYC casino legal for an Estonian player and the tax side in are crypto winnings taxed in Estonia.

What provably fair is NOT: three confusions

1. It is not blockchain. Provably fair uses no blockchain and no block explorer — the whole computation happens on the casino's server and in your browser. A block explorer and Etherscan are useful for something else entirely: tracking your deposits and withdrawals. Those two get confused constantly.

Some operators do use blockchain data as a seed source — for instance the hash of a future block — and that is a stronger variant, because neither side can know it in advance. But it is an addition, not the rule.

2. It is not an audit. Certification means an independent laboratory has tested the game's code and mathematics. Provably fair means you can recompute a single result yourself. They are different things solving different problems — and an ordinary licensed casino uses the first, a crypto casino the second.

3. It is not a synonym for "no-KYC". They are often offered together because both belong to the same marketing story. But no-KYC concerns identity verification and provably fair concerns game results. A casino can have one without the other, and the no-KYC promise usually disappears exactly when the withdrawal is large.

A checklist you can run in five minutes

1. Open the seed settings and check that the server seed hash is visible before betting.
2. Enter your own client seed. Any string.
3. Save the hash outside the casino.
4. Play a few bets, note the nonce.
5. Rotate the seed so the old one is revealed.
6. Compute the hash with an independent tool and compare it with what you saved.
7. Recompute one result and compare it with the game history.
8. Write down what was missing. If a step was not possible at all, that is information about the house — and worth weighing before you put more money there.

If all seven check out, the system is real. If some step is not possible at all, you now know exactly what is missing — and what that absence means.

In summary

Provably fair is one of the few things in the crypto casino world that is technically real rather than marketing. The commitment scheme works, the mathematics is correct and verification is available to anyone.

Three things to take from it:

One: do the verification properly once. Change the client seed, save the hash, play, rotate the seed, recompute. Five minutes, and you know whether your casino's system is real or decoration.

Two: changing the client seed is not optional. Without it you prove half the thing. It is the most common mistake and also the easiest to fix.

Three: do not let it displace more important criteria. A verifiable result is valuable, but it is protection against the smallest risk. Withdrawal history, KYC thresholds, the small print of bonuses and whether the house has actually paid — those decide whether you get your money. Provably fair only decides whether the number was honest.

And the most honest summary is this: a mathematically proven win that is not paid out is still an unpaid win. The technology solves the trust problem at the table. It does not solve it at the cashier.

How to weigh this in practice. If you play at a crypto casino, provably fair is one of three things worth checking — and not the most important. The order that affects a player's wallet most, by our measurements, is this: first, whether the house has historically paid and how fast; second, on what terms and at what sum KYC triggers; third, how expensive the bonus terms are; and only fourth, whether the originals have verification tools.

That does not make the fourth point unimportant. It means overlooking the first three costs more. Every house we review has all four assessed separately — the list is in the casino comparison, the fastest under fast withdrawals and those with the lowest verification threshold in the no-KYC selection. If something goes wrong, the complaints procedure is described on the complaints page and our assessment principles under about us.