What "provably fair" actually means
"Provably fair" is a cryptographic guarantee that the game operator cannot secretly manipulate rolls after you place your bet. It works by committing to the randomness ahead of time, then revealing the secret so anyone can audit it.
If a site can't show you the inputs that produced a roll, it isn't provably fair — it's just "trust us." Rollit publishes every input so the math is out in the open.
The three ingredients of every roll
Each dice roll on Rollit is produced from three values hashed together:
- Server seed — a secret 64-character hex string generated by the server before the round starts. It is hashed and shown to you in advance so the server cannot change it later.
- Client seed — a value you provide (or your browser auto-generates). Because you control part of the input, the server cannot predict or bias the outcome.
- Nonce — a public counter that increases with each roll in the round. It guarantees every roll in a session has a unique result, even if the seeds stay the same.
How the roll is calculated (step by step)
- Before the round, Rollit generates a server seed and shows you the SHA-256 hash of that seed. This is the commitment — the server is now locked in and cannot change the seed without producing a completely different hash.
- You provide (or refresh) your client seed.
- When it is time to roll, the server combines the raw server seed, your client seed, and the current nonce into a single string.
- That combined string is run through HMAC-SHA256 using the server seed as the key and the client seed + nonce as the message.
- The first 8 bytes of the hash are read as a large number, then divided by the maximum possible value to produce a number between 0 and 1.
- That number is mapped to a dice result: for 2d6 we multiply by 11 (the number of possible sums from 2–12) and add 2, giving a final roll from 2 to 12.
How to verify a roll manually
After a round ends, Rollit reveals the raw server seed. You can then:
- Hash the revealed server seed with SHA-256 and confirm it matches the hash you saw before the round started.
- Concatenate the server seed, a dash, the client seed, another dash, and the nonce.
- Compute HMAC-SHA256 of that string using the server seed as the key.
- Take the first 8 bytes, convert to a decimal, divide by
2^64, multiply by 11, add 2, and round down. - Compare the result to the roll you saw in the game. They will match exactly.
You can do this with any SHA-256/HMAC calculator, a Python script, or even a spreadsheet. The point is: you don't need to trust Rollit — you can trust the math.
Why client seeds matter
If the server controlled both seeds, it could technically brute-force a pair that produces favorable results. By letting you set (or re-roll) your own client seed, you eliminate that attack vector. The server knows the hashed server seed, but it does not know your client seed until you submit it, and by then the server seed is already committed.
Nonce prevents repeat rolls
Without the nonce, two rolls with the same seeds would produce identical results. The nonce increments by one for every roll in a session, ensuring each result is unique even if you keep the same client and server seeds for multiple rounds.
How this compares to regular "provably fair" crypto dice
Classic crypto dice sites (house-banked) often use a similar seed-commitment scheme, but the result still plays against an unbeatable house edge. Rollit applies the same transparency standard to a PvP format: you roll against real people, not an algorithm designed to take your money slowly.
The fairness mechanism protects the randomness. The PvP format protects your bankroll from a built-in house edge. Together, they mean you are only paying a 5% rake on pots you actually win — and you can verify every single roll that decided whether you won or lost.
Still have questions?
If you want to audit a specific round, open the round history in your account, copy the server seed hash and the revealed seed, and run the steps above. If the math doesn't match, contact support and we will investigate publicly.