How to Verify a Provably Fair Round

Provably fair means you can check a result after the fact instead of taking our word for it. Gift Club's paid mini-games are built on the standard HMAC-SHA256 commit-reveal scheme, and every input you need to re-run a round yourself is exposed through the app. This page shows exactly how to do that — and, just as importantly, names the part of Gift Club the scheme does not cover.

1. What "provably fair" actually guarantees

It guarantees one narrow, valuable thing: the operator committed to the result before you played, and cannot have changed it afterwards.

The mechanism is a commitment. Before you place a bet, the server generates a secret server seed and publishes its SHA-256 hash. The hash tells you nothing about the seed, but it pins the seed down — once published, the server cannot swap in a different one without the hash failing to match. When the seed is later revealed, you hash it yourself and confirm it is the same seed that was committed to before your bet existed.

What it does not guarantee is that the game is generous, that the odds are good, or that you will be paid. A game can be perfectly verifiable and still run at a 40% return. Verifiability and RTP are separate questions and you should ask both.

2. The three inputs

Every result in a Gift Club paid game is a pure function of three values. No hidden fourth input, no server-side clock, no randomness introduced after you commit.

Those three go into an HMAC-SHA256, keyed on the server seed, over the message clientSeed:nonce:round. The round counter starts at 0 and increments for every 32 bytes needed, which is how a game that needs more than 32 bytes — a 25-tile minefield layout, say — keeps drawing from the same commitment.

Bytes become numbers four at a time, as a base-256 fraction:

That is the same construction Stake documented and that most audited provably-fair implementations use. We did not invent a scheme of our own, on purpose: a novel one would be harder for you to check against anything.

3. Verifying a round yourself

There are two ways to do this. The quickest is inside the app itself; the console snippet below is for anyone who would rather not take our word for what our own verifier computes.

In the app

Open any paid game, tap the shield beside the title, and expand Verify a round. The revealed seed, your client seed and the nonce are filled in for you, and every field stays editable so you can check any round rather than only the one on screen.

The check runs in your browser. The SHA-256 and HMAC-SHA256 are computed locally through the Web Crypto API — nothing is sent back to us, so the result does not depend on us being honest at the moment you press the button. If the commitment fails, the verifier refuses to show you a draw at all: a seed that does not match the published hash describes no round worth reading.

In a console

Rotate your seeds first — that reveals the server seed that was active for the rounds you already played. Then take the revealed server seed, your client seed, and the nonce of the round you want to check, and run this in any JavaScript console:

const crypto = require("crypto");

// From the app: Profile → Provably Fair → Seed history
const serverSeed = "<revealed server seed, hex>";
const clientSeed = "<your client seed>";
const nonce      = 0;      // the round you are checking

// 1. Confirm the seed matches the hash you were shown BEFORE playing.
const commitment = crypto
  .createHash("sha256")
  .update(Buffer.from(serverSeed, "hex"))
  .digest("hex");
console.log("commitment:", commitment);   // must equal the published hash

// 2. Regenerate the round's bytes.
const hmac = crypto
  .createHmac("sha256", Buffer.from(serverSeed, "hex"))
  .update(`${clientSeed}:${nonce}:0`)
  .digest();

// 3. Turn the first four bytes into a float in [0, 1).
const float =
  hmac[0] / 256 +
  hmac[1] / 65536 +
  hmac[2] / 16777216 +
  hmac[3] / 4294967296;
console.log("first float:", float);

Step 1 is the one that matters. If the commitment you compute does not equal the hash the app showed you before the round, the seed was swapped and nothing else on this page is worth reading. If it matches, the bytes in step 2 are the only bytes that round could have used.

Your full seed history — every server seed we have retired, its hash, and the nonce range it covered — is available at GET /api/games/{gameType}/seed-history and in the app under Provably Fair.

4. Rotating your seeds

Rotation does two things at once: it reveals the server seed you have been playing against, and it commits to a fresh one. The nonce resets to 0.

• Change your client seed whenever you like. A new client seed changes every subsequent result, and because we published the server seed hash first, we cannot react to your choice.
• Rotate before you check anything. An active server seed is never revealed — revealing it early would let anyone compute upcoming results, which is the one thing the scheme has to prevent.
• Rotating does not change your odds. It changes which results you get, not how good they are. Anyone telling you to rotate until you are "due" a win is describing the gambler's fallacy.

5. What it does not cover

This is the part most operators leave out, so here it is plainly.

Gift box openings are not provably fair. When you open a box, which prize bucket you land in is decided by a different engine, one that applies dynamic per-user weighting — the XP and luck modifiers described in our honest look at gift game mechanics. Those weights are not part of the commitment, and you cannot reconstruct a box result from your seeds.

In the mini-games, seeds drive layout, not luck. The seed determines where the mines sit, which way the Plinko ball bounces, how the wheel lands — the geometry of the round. That is genuinely the whole game in something like Minefield, where the tile layout is the outcome. It is a narrower guarantee in games where a separate draw picks a payout tier.

So the accurate sentence is: Gift Club's paid mini-game rounds are verifiable; its box openings are not. If a competitor claims "provably fair" across an entire gacha app with no such caveat, that claim is either doing less than it sounds or is not true.

Two further limits worth stating, because they apply to every provably-fair system and not just ours:

• It does not make the game profitable. A verified round can still be a losing round, and the house edge applies to every wager regardless.
• It does not guarantee payment. Verification proves the result was not tampered with. It says nothing about whether an operator will honour a withdrawal — a separate question you should judge separately.

6. FAQ

Can Gift Club see my client seed before choosing the server seed?

No, and the ordering is what makes it work. The server seed is generated and its hash published before the round; your client seed is mixed in afterwards. Changing your client seed at any point invalidates any pre-computation.

Why is the server seed hidden while I'm playing?

Because knowing it plus your client seed lets anyone compute every upcoming result. Revealing it on rotation is the standard resolution: you get the proof, but only for rounds that are already finished.

Which games are covered?

Every paid mini-game in the games hub — if a game takes a Stars wager, its round is covered. Games that only award XP have no wager to verify.

What if my verification doesn't match?

Send us the server seed, client seed and nonce. A mismatch is either a bug on our side or a mistake in the snippet's inputs — usually the nonce, which is 0-based, or the server seed being hashed as text rather than as hex bytes.

Is provably fair the same as a licence or an RNG audit?

No. Provably fair is self-service verification of individual rounds. An RNG certification from a lab such as iTech Labs or BMM Testlabs is an independent review of the whole system, and a licence is a regulatory permission. They answer different questions, and one is not a substitute for another.

Related reading

• 95% RTP Telegram Games With No KYC — the other half of the question: verifiable is not the same as generous.
• Are Telegram Gift Games Legit? — how to check any app, including this one.
• Minefield — the game where the seeded layout is most directly the result.
• Gift Club in Telegram — the Provably Fair panel lives under your profile.