Provably FairSeed Verifier
Paste your seeds, recompute the outcome and check the hash the site committed to before you played. Everything runs in your browser — your seeds never leave this page.
Doc-verified: Documented byte-level: HMAC-SHA256(serverSeed, "clientSeed:nonce:cursor") → 4 bytes → float → floor(float × 10001) / 100. source
Doc-verified: Same documented float, mapped over the outcome table: ticket = floor(float × tickets). source
Doc-verified: Official open-source verifier formula: 52 bits of HMAC-SHA256(salt, gameHash) → X → max(1, floor(99 / (1 − X)) / 100). Current chain salt: 00000000000000000001e08b7fd44f95e3e950ac65650a8031a6d5e1750e34be. source
Generic construction: Generic — CSGORoll documents its commitment scheme (SHA-256-hashed server seed, EOS-block client seeds, HMAC-SHA256) but not a public byte-level formula, so recomputed tickets are indicative. The server-seed hash check applies fully. source
Generic construction: Generic — Clash.gg documents pre-committed SHA-256 server-seed hashes and browser-generated client seeds but not the byte-level roll mapping, so recomputed tickets are indicative. The server-seed hash check applies fully. source
Show the work
| Nonce | Float | Outcome |
|---|
How this works
Provably-fair games commit to their randomness before you bet: the site hashes a secret server seed with SHA-256 and shows you the hash. Your browser contributes a client seed, and a nonce counts your bets. Each outcome is HMAC-SHA256(server seed, client seed:nonce), turned into bytes, then into a number — so once the server seed is revealed at rotation, you can recompute every roll yourself and confirm the site couldn’t have steered it.
This verifier does both halves of that check: the commitment (does the revealed seed hash to what was promised?) and the outcome (do your seeds reproduce the result you saw?) — with every intermediate value shown, HMAC hex to float. What it can’t prove is that the odds were any good: a case with terrible EV verifies perfectly. Fairness of the mapping, not fairness of the paytable.
Privacy: all hashing runs locally via your browser’s WebCrypto API. No seed, hash or nonce is ever transmitted — this page works with the network tab open or the Wi-Fi off.
FAQ
Does my server seed leave the browser?
No. Every hash is computed locally with your browser’s built-in WebCrypto API. This page makes no network requests with your seeds — you can verify that in your browser’s network tab, or even go offline before pasting them.
What can this tool actually prove?
Two things: that the revealed server seed matches the SHA-256 hash the site committed to before you played (so the seed wasn’t swapped after the fact), and that your seeds and nonce deterministically produce the outcome the site showed you. It cannot prove the odds were good — house edge lives in the paytable, not the seed.
Why batch-verify after rotating my seed?
Rotation is the only moment a server seed is revealed, and it closes the seed for good — so that is when every bet made under it becomes checkable at once. Batch mode recomputes a whole nonce range against the revealed seed in one pass instead of one bet at a time.
Why doesn’t my recomputed result match on some sites?
Not every site publishes its byte-level formula. Presets marked “generic” use the standard HMAC-SHA256 construction, which those sites may not follow exactly — for them the recomputed outcome is indicative, while the server-seed hash check still applies fully.