Free to play, and still provably fair.
The seed pair
When you first load a game your browser creates a server seed (32 random bytes) and shows you only its SHA-256 hash, plus a client seed you can edit and a nonce that starts at 0. The pair lives in your browser's local storage. We never see it.
The construction
Each round computes HMAC-SHA256(serverSeed, `clientSeed:nonce:cursor`), reads the output four bytes at a time into floats between 0 and 1, and maps them through the game's formula: Plinko takes one float per row (left below 0.5, right above); Dice is floor(float × 10001) / 100; Limbo is 1e8 / (float × 1e8 + 1) × 0.99; Mines draws tile positions without replacement; Roulette is floor(float × 37); Dragon Tower gives each of its nine rows its own HMAC block (cursor = row) and draws the egg positions without replacement inside it. This is the construction Stake documents and the one VerifyRoll recomputes (Dragon Tower excepted: its recomputation lives on the shared-round page).
Crash is different
Crash does not use the seed pair. On first visit the browser draws a terminating seed and hashes it forward 1,000 times with SHA-256; games are played from the end of that chain backwards, so the hash shown after each round is SHA-256 of the next round's hash: a commitment made before the chain was ever used. The multiplier is HMAC-SHA256(gameHash, publicClientSeed) read as 52 bits, then max(1, floor(99 / (1 − X)) / 100). The public client seed here is a fixed string shown on the game; a casino uses a Bitcoin block hash mined after the chain was published.
The payouts
Plinko multipliers are the published tables for 8, 12 and 16 rows at low, medium and high risk. Dice pays 99 / chance. Limbo pays the target if cleared. Mines pays 0.99 × the product of the survival odds for each safe tile revealed. Dragon Tower pays 0.99 × (tiles ÷ safe)rows climbed. Crash pays the cash-out multiplier when it is below the crash point. All of these sit at a 1% house edge, the same as the real games they imitate. Roulette is the exception: its payouts are the table's (35:1, 2:1, 1:1) and the single zero fixes the edge at 1/37 = 2.70%.
How to check a round
- 1Open the seeds panel. On any game, press "Fairness seeds". You will see the server seed hash (a SHA-256 commitment), your client seed and the next nonce.
- 2Play some rounds. Each round uses the next nonce. Nothing about the seeds changes while you play, so the results were fixed the moment the pair was created.
- 3Rotate and reveal. Press "Rotate seeds & reveal". The previous server seed is shown in full; check that it hashes to the commitment you saw earlier.
- 4Verify on VerifyRoll. Every round has a "Verify this round" link that opens VerifyRoll with the seeds, nonce and game settings pre-filled. It recomputes the result in your browser.
What it does not prove
Provably fair proves the result was fixed before you played and was not changed afterwards. It does not make the odds better. Every game here shows its RTP and formula so you can see exactly what the odds are.
Last reviewed 2026-09-23