The three ingredients
- Server seed — a random secret the site generates and commits to before you play.
- Client seed — a value you choose (or the default one the site assigns).
- Nonce — a counter that increments with each roll.
The commitment step
Before you start rolling, the site publishes a hash of the server seed (e.g. SHA-256). The site can't change the server seed after this — any change would produce a different hash. You have a cryptographic guarantee that the secret is locked in.
The roll itself
For each roll, the site computes HMAC-SHA256(server_seed, client_seed + nonce)and maps the result onto the dice outcome. Same inputs always produce the same outcome.
The reveal step
When a session ends (or you rotate seeds), the site reveals the server seed. You hash it and confirm it matches the earlier commitment. Then you recompute every roll yourself — if any result doesn't match, the site cheated.
What provably fair does NOT guarantee
- That the house edge is small.
- That the site will pay you out.
- That your bankroll is safe.
Provably fair only certifies that the random number wasn't tampered with. Trust the math, verify the operator separately.
Verifying a Rollit roll
Go to your account → roll history. Each round shows the server seed hash, your client seed, the nonce, and the revealed server seed. Any open-source provably-fair verifier (or a few lines of JS) will confirm the result.