How to Verify a Roll Hash: A Provably Fair Walkthrough

On this page ▾

1. The idea in one paragraph
2. The ingredients
3. Verification, step by step
4. A worked example (simplified)
5. What verification proves, and what it does not
6. Tools you can use
7. Common reasons a check fails
8. Sites that offer provably fair games
9. Beyond the roll: other trust checks
10. Legal and responsible note

Most CS2 gambling sites claim to be "provably fair". Few players ever check. Verification takes about two minutes once you know the pattern, and it is the single best way to confirm a site is not quietly editing outcomes. This is a hands-on walkthrough; for the broader theory, read our provably fair explainer.

The idea in one paragraph

Before you bet, the site shows you a hash of its secret server seed. A hash is a one-way fingerprint: you cannot reverse it, but any change to the seed changes the hash completely. Because the hash was published before the bet, the site is locked in. You also supply a client seed, and each bet increments a nonce. The roll is computed from all three, so neither side controls the outcome alone.

The ingredients

Live demo

Bankroll Calculator

Full page & guide →

Session bankroll (CA$)

Risk levelLow (1% bets)Medium (2.5%)High (5%)

Number of bets

Win probability (%)

Payout on win (×)

Run 1,500 simulations

Default = roulette red/black (7 of 15 slots, pays 2×). Risk of ruin is a Monte-Carlo estimate from 1,500 simulated sessions in your browser.

Verification, step by step

Step 1: note the pre-bet hash

Before you play, copy or screenshot the active server seed hash from the fairness panel. Without it, you cannot prove later that the seed was not swapped.

Step 2: set your own client seed

Change the default client seed to something you chose. A random-looking string of letters and numbers is fine. This makes sure the site did not pre-select a client seed that suits it.

Step 3: play and record the bet

Make the bet whose result you want to check. Note its nonce (bet number under the current seed pair).

Step 4: rotate the seed pair

Press the option to change or reveal the server seed. The site then shows the old unhashed server seed and generates a new hash for future bets.

Step 5: check the hash matches

Run the revealed server seed through the SHA-256 function using any trusted offline or in-browser tool. The output must equal the hash you saved in Step 1. If it does not, the site changed the seed, which is the red flag provably fair is designed to catch.

Step 6: recompute the roll

Most implementations compute an HMAC-SHA256 using the server seed as the key and a message made of the client seed, nonce and sometimes a round counter, joined by colons. The resulting hexadecimal string is converted to a number and mapped to a game outcome. The exact formula differs from site to site, so use the site's documented method or its own verifier.

A worked example (simplified)

Suppose a roulette round maps a number to a slot between 0 and 14 in a 15-slot wheel where 0 is green and 1 to 7 are red and 8 to 14 are black. The algorithm takes the first 8 hex characters of the HMAC output, converts them to an integer and applies modulo 15. If the result is 0, the round is green and pays 14x. Anyone with the three inputs gets the same number. That is the essence of the process; real implementations vary, so treat this as an illustration, not any particular site's code.

Tip: verify at least a few rolls, including one loss that felt suspicious. Verifying only wins tells you nothing.

What verification proves, and what it does not

A fair roll can still lose. On a 15-slot roulette, the house edge on a 2x bet is 1/15, about 6.67%, and no verification changes that. See coinflip odds and house edge and the roulette simulator to see the maths in action.

Tools you can use

• The site's built-in verifier, usually in the fairness or settings menu.
• Independent open-source scripts that implement the documented formula.
• A basic SHA-256 hash tool for the seed-to-hash check.

Only paste seeds that have already been revealed. Never share an active, unrevealed server seed, and never enter your password, Steam login or wallet details into a "verifier".

Common reasons a check fails

1. You copied a seed with a trailing space.
2. You used the wrong nonce or started counting from 1 instead of 0.
3. The seed pair was rotated between the bet and the check.
4. You are using a formula for a different game mode.
5. The site changed algorithm versions; check its documentation.

Sites that offer provably fair games

Provably fair systems are common at crypto casinos and some skin sites. Platforms such as Stake and CSGOEmpire document their approaches, and our rating methodology considers transparency. Always read the fairness page on a site before you deposit.

Beyond the roll: other trust checks

Provably fair covers only randomness. Also check withdrawal reliability, support responsiveness and whether the site has a history of disputes. Our scam-avoidance guide covers those.

Legal and responsible note

Offshore sites are not licensed in Ontario by iGaming Ontario or the AGCO, so provably fair is a technical assurance, not a regulatory one. See our legality guide. This is not legal advice.

Frequently asked questions

What is a server seed hash?

It is a cryptographic fingerprint of the secret server seed, shown before you bet so the site cannot change the seed afterwards.

Do I need to be a programmer to verify a roll?

No. Most sites provide a built-in verifier, and independent tools let you paste in the seeds and nonce.

Does provably fair mean I will win?

No. It proves a result was not tampered with, not that the odds favour you. The house edge still applies.

Why must I change my client seed?

Changing it reveals the old server seed for checking and lets you set your own randomness input.

What if a verification fails?

Re-check that you copied the seeds and nonce exactly. If it still fails, contact support and screenshot everything.