Provably fair

On any site that opens boxes, you are asked to believe that the result was not chosen to suit the house. Published odds mean nothing if the operator can decide the outcome after seeing what you would have won.

The mechanism below removes that question. We commit to the outcome before you play, and you can check afterwards that we kept to it.

Three values go into every roll:

• The server seed — a random secret we generate. Before you play we publish its SHA-256 hash. The hash gives nothing away, but it locks us in: we cannot change the seed later without the hash no longer matching.
• The client seed — yours. You can change it whenever you like, which means you have a hand in every outcome and we cannot know it in advance.
• The nonce — a counter that increases by one with each open, so the same pair of seeds never produces the same result twice.

The roll is HMAC-SHA256 of clientSeed:nonce, keyed by the server seed. The result is reduced to a ticket number inside the box’s table, and whichever prize holds that ticket is what you won.

A box’s prize table is a fixed set of tickets. A prize with a 1% chance holds 1% of the tickets, and the published percentage is that share. There is no separate list of “real” odds.

The odds are the same for every account. Nothing about who you are, how much you have spent, or how long you have played changes them.

When a server seed is rotated we reveal the seed it replaces. From that moment you can:

• hash the revealed seed and confirm it matches the hash we published before you played;
• recompute the HMAC from the revealed seed, your client seed and the nonce; and
• confirm the ticket it produces is the prize you were given.

Our verifier does all three in the browser, and the arithmetic is standard — you can reproduce it in any language without using our tool at all.

• We cannot change a server seed after publishing its hash — the hash would stop matching.
• We cannot see your client seed before you set it.
• We cannot re-roll, reverse or adjust a result. Spins are written once and can never be edited or deleted, including by us.
• We cannot give one account different odds from another.

The active server seed is stored encrypted, and the key that decrypts it never reaches a browser. That is why a box is opened on our server rather than in your browser: anything the browser could decrypt, it could also use to predict the outcome.