On this page ▾
- Provably fair uses cryptographic hashes so a site commits to a result before you bet and cannot change it after.
- Typical ingredients: a server seed (hashed in advance), a client seed you can set, and a nonce counter.
- The hash function is usually SHA-256, often inside an HMAC; results are mapped to a roulette slot, crash multiplier or case roll.
- Provably fair proves honesty of the random number, not that the odds favour you. The house edge remains.
- Always verify at least a few rounds yourself, especially before larger sessions.
"Provably fair" is on nearly every skin gambling site, yet very few players have ever checked a roll. That is a missed opportunity: the verification is simple once you understand the pieces, and it is the main technical protection you have against a site manipulating outcomes. This guide explains the logic in plain English, walks through a verification, and points out the limits of the concept.
The problem provably fair solves
In a physical casino, regulators audit the machines. On an offshore skin site, there is no Canadian regulator checking the random number generator, so you need another way to trust the result. Provably fair solves a specific problem: can the site change the outcome after seeing your bet? With a commit-and-reveal scheme, the answer is no, because the result was fixed before you wagered.
The key ingredients
| Term | Who controls it | Purpose |
|---|---|---|
| Server seed | The site | Secret random string; its hash is shown before you play |
| Server seed hash | The site (public) | A SHA-256 fingerprint that locks in the server seed |
| Client seed | You (or the site by default) | Your input to the randomness so the site cannot pick the result alone |
| Nonce | Automatic counter | Increases with each bet so every round is different |
| HMAC-SHA256 | Algorithm | Combines the seeds and nonce into a long pseudo-random value |
How the commit-and-reveal works
- Commit. Before you bet, the site shows you the SHA-256 hash of its server seed. A hash cannot be reversed, so you cannot learn the seed, but the site cannot later swap it for a different seed without the hash changing.
- Contribute. You set or accept a client seed. This stops the site from pre-computing a result that suits it, since it does not know your seed in advance.
- Play. Each bet uses the seeds plus the nonce (0, 1, 2 and so on) to produce one result.
- Reveal. When you rotate your seed pair or the round ends, the site reveals the old server seed.
- Verify. You hash the revealed seed and confirm it matches the hash shown earlier. Then you recompute the rounds to confirm each result.
From hash to result: the maths
The site runs HMAC-SHA256 with the server seed as the key and a message built from the client seed and nonce, producing 64 hexadecimal characters. Part of that output (for example the first 8 characters) is converted to a number, then reduced to the game's range. The exact formula differs per site, so always read the site's own verification page.
Roulette example
A 15-slot wheel needs a number from 0 to 14. If the site takes the first 8 hex characters as an integer n and computes n mod 15, each slot has a probability of 1/15, apart from a tiny rounding bias. Slot 0 is green, slots 1 to 7 are red and 8 to 14 are black, giving 7/7/1. See how streaks behave in our roulette strategy guide.
Crash example
For crash, sites usually convert the hash to a float and apply a formula so that P(multiplier at least x) = 0.99/x for a 1% house edge. Some results are set to 1.00x instantly. This means a round crashing at 1.00x occurs about 1% of the time, and reaching 2.00x about 49.5% of the time. See our crash strategy guide.
Case opening example
For cases, a number between 0 and 1 is mapped onto cumulative odds: for example Mil-Spec 79.92%, Restricted 15.98%, Classified 3.2%, Covert 0.64% and Rare Special Item 0.26%. Our case opening odds guide breaks this down.
How to verify a roll yourself
- Record the data. Copy the hashed server seed, your client seed and the nonce for the round you want to check.
- Rotate your seed. On the site's fairness page, rotate to reveal the previous server seed.
- Check the hash. Paste the revealed server seed into a SHA-256 tool. The output must equal the hash you saw before betting. If not, the site cheated or you copied wrongly.
- Recompute the round. Use the site's verifier or an independent HMAC-SHA256 tool following the documented formula.
- Compare. The recomputed result must match what happened in the game.
For a detailed walkthrough with screenshots-style steps, read How to verify a roll hash.
Tip: Change your client seed to something personal before you start. If you use the default seed, the site chose both ingredients, which weakens the guarantee.
What provably fair does not tell you
- It does not change the odds. The house edge is part of the game design. On 15-slot roulette, red returns 14/15 of each stake in the long run, a 6.67% edge.
- It does not guarantee payouts. A site can run a fair game and still refuse to pay, or hold your withdrawal.
- It does not prove solvency. Verification covers the random result, not whether the operator has funds.
- It does not cover everything. Case battles, coinflips against other players and bonus mechanics may have separate rules.
- It does not replace regulation. Offshore operators are not licensed by Canadian provinces; see our legal guide.
Why the nonce and client seed matter
Imagine the server seed is fixed for a session. Without a client seed, the site could pick a server seed whose first rounds are tilted in its favour. With your own client seed mixed in, the site cannot know the final outputs in advance, because it committed to its seed before it saw yours. The nonce then guarantees that bet number 1 and bet number 2 give different results from the same pair. If you rotate your seed pair often, the amount of data any single seed pair covers is small, which makes later auditing easier.
A short habit list: set a custom client seed, note the starting hash, rotate after a session, and spot-check three or four rounds, including at least one big win or loss. If a result looks unusually unlucky, remember that streaks are normal; in 15-slot roulette, about 1.2% of the time you will see seven non-red results in a row. Verification tells you whether something was manipulated, not whether you were unlucky.
Red flags in a provably fair setup
Watch for: a server seed hash that changes without you rotating; a verifier that only runs on the site's own servers; no documented formula; a client seed you cannot change; or results that differ from the recomputed output.
Independent communities often review popular sites. Check our How We Rate page to see how fairness features feed into our scoring.
Some honest limits
Verifying a few rounds cannot prove a site is perfect, because a dishonest operator could still behave differently in rounds you never check. Think of provably fair as a strong deterrent, not a certificate. A statistical test across thousands of rolls can reveal bias, but that is beyond most players. If you want to explore randomness safely, our crash simulator and roulette simulator let you watch variance without risking anything.
Key takeaways for Canadian players
Use provably fair as a minimum standard, not a reason to bet more. Verify a handful of rounds, set your own client seed, and combine this with sensible bankroll limits. New to the basics? Start with How CS2 Gambling Works. Gambling is for adults of legal age in your province. If it stops being fun, see responsible gambling or call your provincial helpline.
Frequently asked questions
What does provably fair mean?
It means the site commits to a hidden random value by publishing its hash before the round, then reveals it afterwards so you can check the result was generated from it and was not altered.
Does provably fair mean I will win more?
No. It proves the outcome was not tampered with, but the house edge is still built into the game rules and payouts.
What is a server seed?
It is a secret random string chosen by the site. You see its SHA-256 hash first, and the plain seed is revealed after you rotate or the round ends.
What is a nonce?
A counter that increases with each bet using the same seed pair, so every round gets a unique result even with the same seeds.
Can I verify results without coding?
Yes. Many sites include a built-in verifier, and independent online SHA-256 and HMAC tools let you check a roll step by step.
Play responsibly: CS2 gambling is for adults 19+ (18+ in AB, MB, QC). Set limits, never chase losses, and use self-exclusion if it stops being fun. Free, confidential help: ConnexOntario 1-866-531-2600 or your provincial helpline — see our responsible gambling page.