Provably fair games explained: server seed, client seed, nonce and how to verify

What does provably fair mean?

In an ordinary online game you have to trust that the result was not chosen after you bet. Provably fair replaces that trust with a check you can do yourself.

It works like a sealed envelope. Before the round, the game shows you a fingerprint of a secret. After the round, it shows you the secret. If the secret matches the fingerprint, the game could not have swapped it once it saw your bet. If the result also follows from the secret and your inputs, the round is proven.

The fingerprint is a SHA-256 hash. It is easy to compute a hash from a seed, and practically impossible to find a different seed with the same hash. So a published hash pins the seed down.

What are the server seed, client seed and nonce?

• Server seed: a long random string the game keeps secret until the round is over. You see only its SHA-256 hash beforehand.
• Client seed: a string you control. It protects you only if the game could not predict it when the server seed was chosen. The game stores your client seed and keeps using it while the server seed changes every round, so a seed you reuse is known in advance. Note the next server seed's hash, then set a fresh, unpredictable client seed. On Loot Yeti you type it in Provably fair settings, or let a new random one be made every round.
• Nonce: a counter that goes up by one each round. It makes every round different even when both seeds stay the same.

The three are combined with HMAC-SHA256, a standard keyed hash. The server seed is the key, and the message is the client seed and the nonce joined by a colon, such as lucky-yeti:7. The output is 64 hex characters that look random but are fully decided by the inputs.

How is a result made from the seeds?

Here is one real round of Chicken Road 2 on the Medium road, step by step. Every value below is computed by the game's own code.

1. Server seed, revealed after the round: 8195951f48d04b2018114ccabb3d6d64eed4dc1bf6674e091840f8b757e70054
2. Its SHA-256 hash, shown before the round: e52d02681cb2c61fa46a7faa83e8639d1e8ac6b2e097071db869dbeac91914d0
3. Client seed lucky-yeti and nonce 7 make the message lucky-yeti:7.
4. HMAC-SHA256 with the server seed as the key gives: 99b809fb5c9a30fedffe8c777aec372fe5f4f1d79d8a944bcbf2196a661f5826
5. Take the first 13 hex characters, 99b809fb5c9a3. As a number that is 2,704,251,528,006,051.
6. Divide by 2^52 to get a value u between 0 and 1: u = 0.600464.

Chicken Road 2 then walks the road. The chicken gets through lane k only while u is below 95.5% divided by lane k's multiplier.

u is at or above the limit for lane 5, so the car hits there. Cashing out after lane 4 would have paid 1.56×; going on lost the stake.

Because the crash lane is fixed the moment the stake is placed, playing faster or slower changes nothing. The only choice that matters is where you cash out.

How do you verify a round on Loot Yeti?

1. Open the game's menu (☰) and choose My bet history.
2. Tap a finished round; in Elements of Power, tap the shield on the spin. It shows the revealed server seed, the hash that was shown before the round, your client seed and the nonce.
3. Every game checks that the SHA-256 of the server seed equals that hash. A match alone only proves the seed was not swapped; the outcome must also replay. Plinko Aztec, Penalty Unlimited and Elements of Power replay it for you from the seeds, and Penalty Unlimited and Elements of Power show the HMAC output too. For Chicken Road 2, replay it yourself as in the example above.
4. To check it yourself, use any HMAC-SHA256 tool. Use the server seed as plain text for the key, not as hex bytes, and clientSeed:nonce as the message.
5. Turn the output into the result with the game's rule below, and compare it with what happened.

How does each Loot Yeti game read the hash?

• Chicken Road 2: the first 13 hex characters become u, and the car hits at the first lane where u is not below the RTP divided by that lane's multiplier, as in the example.
• Penalty Unlimited: the same u decides the kick the keeper saves: the first kick where u is not below the RTP times the stake, divided by the cash-out after that kick. Where you aim never matters.
• Elements of Power: the first 13 hex characters pick water, earth, fire, the Joker, air or the skull, using the chances for the board before the spin. The next 13 pick the fire bonus reels' multiplier and the 13 after that the earth bonus reels' multiplier, each used only when its ring fills.
• Plinko Aztec: the hash is read as eight 32-bit words, and further blocks come from the messages clientSeed:nonce:1, clientSeed:nonce:2 and so on. Each ball uses one word for its slot, by counting the 1 bits in the word's top 15 bits (that is 15 fair coin flips), and one for its bounces off the sun discs.

Our guides to the Chicken Road game, Plinko and penalty shootout games explain the odds these rules produce.

What does provably fair not prove?

It proves the result was not changed after you bet. It does not prove the odds are generous. A provably fair game still has a house edge, and you should read its RTP separately. Our RTP and house edge guide covers that part.

It also only helps if you look. Set a fresh client seed after noting the next server seed's hash, and check a round or two in your history.

On Loot Yeti the games run in your browser with play money, so the server seed is made on your own device. The method and the math are exactly the ones above. The check matters most on a site where the operator makes the server seed.