PF Universal Verifier

Run the universal verifier: the 3-step process

Stake, BC.Game, Roobet, and most modern crypto-casinos build their game results on the same cryptographic primitives, so results can’t be altered after a bet is placed. To audit a specific round, copy these values straight from your bet history panel (newer to this? Start with our guide on how to verify provably fair outcomes):

1. Server Seed (Revealed): While you play, the operator keeps this string hashed. Once you rotate your active seed pair, the casino hands over the raw hexadecimal string of the previous server seed. For the full mechanics, see our breakdown of the server seed, client seed, and nonce.
2. Client Seed: A string created by your browser or typed in manually before betting. Its job is simple: the casino cannot know your seed combination in advance.
3. Nonce: The sequence number of your bet. The first wager on a seed pair is nonce 0 or 1 (site-dependent), the second is 2, and so on.

The cryptography behind the numbers

For years I assumed what was described as provably fair systems explained in casino marketing was just a wrapper to keep suspicious players quiet. Then I followed the math end to end. It turns out the whole thing rests on a single algorithm: HMAC-SHA256.

1. Building the message string

The game combines your client seed, the nonce (bet number), and a cursor value (used when one round needs several numbers, such as card draws or mines boards). Colons join the parts into one message string:

Message = "client_seed:nonce:cursor"

2. Generating the HMAC hash

That message and the revealed server seed then go through a Keyed-Hash Message Authentication Code (HMAC) built on the SHA-256 hash function. The output is a 64-character hexadecimal signature:

Signature = HMAC-SHA256(Server_Seed, Message)

This signature is locked. Change one character in your client seed or server seed and the hash becomes something unrecognizable and random-looking.

3. Converting hash bytes to game floats

To turn a 32-byte signature into multipliers or card indices, the algorithm reads the bytes in groups of 4 (32 bits) and converts each group into a decimal fraction between 0 and 1:

Float = (Byte_1 / 256^1) + (Byte_2 / 256^2) + (Byte_3 / 256^3) + (Byte_4 / 256^4)

The verifier runs this exact math stream. Compare the floats generated here against the cards, dice rolls, or crash points in your game history, and you’ll know whether the operator’s RNG is legitimate.

Strategy: Keep the operators honest

Casinos understand their audience. The overwhelming majority of players never open their seed panel, let alone write code to check it. That’s precisely why verification is worth a few minutes of your time.

Checking every wager is overkill. Build a simple habit instead: rotate seeds after a big win or an unusually long losing streak, copy your bet history, and paste the values here. Five minutes, three fields.

If a casino ever produces a result that doesn’t match this universal cryptographic stream, you hold immediate, undeniable evidence of tampering.

Frequently asked questions