Three inputs, and only one of them is yours
The model works because the outcome depends on inputs that no single party controls. Understanding which input belongs to whom is what lets you judge whether a particular implementation is actually doing the work, or only appearing to.
- Before playsha256(server seed)published as the commitment
- You chooseclient seedunder your control, editable
- Per roundhmac_sha256(seed, client + nonce)one digest per bet
- Mappingdigest to a number in rangeimplementation specific
- After rotationserver seed revealedhash must match the commitment
- 01
Server seed controlled by: Operator
Generated in secret, then committed to by publishing its hash before you play.
- 02
Client seed controlled by: You
Chosen or editable by the player, so the operator cannot fix both inputs alone.
- 03
Nonce controlled by: Counted
Increments by one each bet, so a single pair of seeds yields a different result per round.
Why the client seed has to be yours
Suppose the operator supplied both the server seed and whatever value it is mixed with. It would then be free to search for a server seed that produces a chosen sequence of outcomes, and to do so before publishing anything, because it knows both inputs to its own search. The published commitment would still verify against the revealed seed, because it really is that seed, and the whole verification would succeed while proving rather less than it appears to.
A client seed under your control, fixed before the bets, removes that freedom. The operator must publish its commitment before it learns your input, so it cannot search for a seed that suits outcomes it has not seen yet. This is why the ability to set and change your own client seed is not a cosmetic setting. An implementation that generates the client seed for you, from operator-chosen material, has quietly given the operator back the ability it was supposed to give up.
Two questions worth asking of a real page
Can I set my own client seed, and did I set it before the bets I am checking? If either answer is no, the guarantee is weaker than the arithmetic suggests, however correct the digests turn out to be.
What the nonce is for
One pair of seeds would otherwise produce one result, which is not much use for a sequence of bets. The nonce solves that by being a counter: it increments by one for each bet, so the same seeds produce a different digest, and therefore a different result, for each round. A nonce is not a secret and is not meant to be one. Its job is to make outcomes reproducible per round while the inputs stay fixed.
Two practical consequences follow. First, when you verify, you are checking a specific round, which means you need that round's nonce or bet identifier as well as the seeds. Second, a rotation resets the situation: a new server seed, a new published commitment, and a nonce that starts again. That is why an operator that rotates often gives you more verifiable material, and one that never rotates gives you almost none.
Disclosure: this page carries an affiliate link to gamdom.com/r/csgo2026. If you open an account through it we may earn a commission. It costs you nothing extra and it does not change what we write. 18+. Gambling involves risk and can cause serious financial harm. Provably fair is a transparency property, not an advantage: a verifiable result can still lose, and the house margin still applies.