Provably Fair Checklist

The active audit protocol: How to test your casino

Plenty of operators print “provably fair” next to their games and count on a simple bet: that roughly 99% of players will never once inspect a seed. An operator with nothing to hide publishes its seeds and documents the verification steps. One with something to bury does the opposite — hides seeds, obscures the algorithm, or pushes you toward an in-house “Verify” button while withholding the raw variables behind it.

The checklist stores your progress in your browser’s local storage. Tick items off as you audit each site; come back later and your marks are still there.

The 10 audit checkpoints explained

Run every new betting platform through these ten concrete signals of cryptographic soundness:

1. Un-hashed server seed reveal

The operator shows you the SHA-256 hash of the server seed *before* any wager, then releases the raw un-hashed seed *after* you rotate the seed pair. Refusing to publish past raw seeds equals concealing outcomes. No reveal, no deposit.

2. Client seed customization

You should be able to swap your client seed whenever you like. A platform that locks you into pre-assigned client seeds — no custom input field — can pre-compute outcomes against you before you ever click spin.

3. Clear nonce transparency

Each bet increments a nonce (0, 1, 2, 3…), resetting to 0 with each new seed pair. Your round history must show which nonce produced every past result. If nonce values are missing from the history, the verification chain is broken at both ends.

4. Independent third-party audit compatibility

Standard algorithms only — HMAC-SHA256 or SHA-512, documented precisely enough that pasting your seeds into an external verifier reproduces identical results, digit for digit.

5. Third-party RNG certification

Look for current certificates from recognized testing labs — iTech Labs, GLI, eCOGRA — confirming the random number generator satisfies international statistical standards. Expired certificates don’t count; check the issue date.

Data Sandwich: Checking the seed hash commitment

Here’s the test in practice. Before your session, the casino displays this Active Server Seed Hash:

5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8

You play 100 bets, then hit “Rotate Seeds.” The casino now exposes the previous raw Active Server Seed:

my_secret_server_seed_123

Feed that raw string through any standard SHA-256 generator. Matching the pre-session commitment hash means the operator could not have touched your results after watching your bets — the math forbids it. A mismatch means the operator altered something. Walk away and treat it as confirmed tampering.

Frequently asked questions