Provably fair means the casino locks in the result of each round before you bet. After the round, you can check that the result was not changed. It does not mean the odds are good for you. The casino still wins over time.
Full list and what you can check on each: see the table below.
- ✓ 30+ provably fair crash games: Aviator, JetX, Spaceman & more
- ✓ 10% weekly cashback for every player, paid automatically
- ✓ Crypto only: BTC, ETH, USDT and 9 more coins accepted
- ✓ Extra value: 2x monthly bonus and up to 125 Friday Fun Spins
🛡️ How to verify a round yourself
To verify a round you reveal the server seed the operator hid, hash it yourself, and confirm it matches the commitment that was published before you bet. The process is the same on any genuine provably fair game and takes under a minute with a free hash calculator. Most players never do it, but the fact that you could is the whole point. You can practise the check on one free round a day in our Daily Crash game.
Open the fairness panel and reveal the seed
Every honest implementation has a fairness or verify section. Rotating or changing your client seed forces the operator to reveal the previously hidden server seed for past rounds, so it can no longer be used to alter anything.
Copy the revealed seed and the original hash
Note the revealed server seed, the pre-round commitment hash, your client seed and the nonce for the round you want to check.
Hash the revealed seed and match the commitment
Paste the revealed server seed into any hash calculator using the function the operator states, and confirm the output equals the hash that was published before the round. This proves the seed was not swapped.
Re-run the formula and match the multiplier
If the operator publishes its mapping formula, re-run it on the seeds and nonce and confirm it produces the crash point you saw. Stake and the Bustabit lineage publish theirs in full, so this step is fully reproducible.
Aviator is the example most people meet first. After each round it shows a green shield icon that opens a panel with the hashed server seed, the revealed seed and the client seeds. Spribe’s exact way of folding the seeds together into a multiplier is specific to that game, and we walk through it in detail in the Aviator guide.
🔍 Worth noting
Some operators expose the seeds and the hash but never publish the formula that turns them into a result. Spribe and Roobet are examples. With those, you can confirm the hash did not change, but you cannot independently reconstruct the multiplier from scratch. That is a weaker promise than the published-formula games, even though both wear the same badge.
◆
See the check for yourself: the demo below shows the result’s fingerprint before you play, then lets you match it after the round.
🔒 Free tool: provably fair check
Can the casino change the result after you bet?
Before you play, the casino picks the result and shows you its fingerprint.
This demo needs a secure https page to do the maths, and this page is not one. Open it over https.
Want to check a real round from a casino? Use our provably fair verifier. See which crash games let you check.
A demo only. No real money. 18+. Real games show the fingerprint as a long code of letters and numbers (a SHA-256 hash of a secret that sets the result). Stake-style formula, 1% house edge.
🔍 The black box problem provably fair was built to solve
Provably fair exists because you cannot watch the dice. A casino shows you a result, but the random number generator that produced it is hidden, so historically the entire product was your willingness to trust that the operator did not tilt the outcome once it saw your stake.
The traditional answer is third-party audit. Labs such as GLI, eCOGRA, BMM Testlabs, iTech Labs and QUINEL review the source code, run heavy statistical batteries against millions of outputs, and confirm the live return matches the design. Regulators including the UKGC and the MGA require this before a game launches and again whenever the code changes meaningfully.
The weakness is structural. The audit covers the game in aggregate, but you, the player, still cannot verify any individual round, and you are relying on a lab you did not hire and that the operator pays. Provably fair flips the problem around: the operator commits to the outcome in public before bets open, then reveals the secret afterwards so anyone with a hash calculator can check it.
📖 Definition
A commitment scheme is a way of locking in a value in public without revealing it yet. Think of a sealed envelope handed over before a bet: the contents are fixed, nobody can see them, and nobody can swap them later without it being obvious. Provably fair is that envelope, built from a one-way hash function.
The idea did not begin with crash games. It grew out of the early Bitcoin gambling scene, where the code was open and the players were technical enough to demand proof, then spread into the mainstream when crash games took off.
SatoshiDice, the first verifiable Bitcoin game
Erik Voorhees launched an on-chain dice game whose results could be checked retroactively. It predated the actual phrase, which was applied to it later.
The term is coined
A bitZino developer used the phrase “provably fair” publicly, and a Forbes article that August carried it into wider use.
Just-Dice sets the template
The server-seed, client-seed and nonce model run through a keyed hash became the standard that almost every later game copied.
The first crash game, MoneyPot
Eric Springer built the first provably fair crash game. It was later bought and rebranded as Bustabit, which popularised the investor-funded bankroll model.
Aviator takes it mainstream
Spribe’s Aviator carried provably fair out of the crypto-native niche and into millions of regulated and grey-market casinos, making it the default consumer reference point.
Trust spread across parties
The newest Bustabit architecture layers an independent third-party signature on top of the hash chain, so no single party can quietly choose the outcomes.
◆
📖 Provably fair works in three steps: commit, play, reveal
Provably fair is a commitment scheme with two properties that pull in opposite directions. It is binding, so the operator cannot change the committed value afterwards, and it is hiding, so you cannot read the value from the commitment before the reveal. Both properties come from the same one-way hash function.
The whole protocol runs in three phases. Understanding these three steps is enough to understand every provably fair crash game, whatever badge it wears.
Before the round, the operator commits
The server generates a secret random server seed and publishes its hash. That hash is the commitment. It cannot be reversed to expose the seed, and the operator cannot later substitute a different seed without the hash failing to match.
During the round, the result is derived
The outcome comes from combining the server seed with a client seed, which carries your browser’s entropy, and a nonce, which is just a round counter. They are run through a keyed hash, and the client seed stops the operator pre-computing a result aimed at you specifically.
After the round, the operator reveals
The server publishes the unhashed seed. You hash it yourself and confirm it equals the original commitment, then re-run the calculation and confirm the result matches the crash point you saw. If both match, the outcome was locked before you bet.
The binding property rests on collision resistance, which for the standard hash means roughly 2¹²⁸ operations to break, far beyond any practical attack. The hiding property rests on the seed being secret and the hash being one-way. A classic result in cryptography says the two properties cannot both be perfect at once, but in practice both are strong enough that no operator can cheat the commitment.
💡 Key insight
The moment the commitment is published, the operator is mathematically pinned to a single outcome. Everything that follows is just confirming that the outcome you saw is the one that was locked in. The casino is not promising to be honest. It is arranging things so that dishonesty would be visible.
“Provably fair proves the operator did not change their mind. It does not prove they were ever on your side.”
🔍 A real example: we rebuilt both of Bustabit’s public hash chains and recreated 9,939,486 rounds, step by step. See how we checked 9.9 million Bustabit rounds.
🔢 Hash chains, a stronger kind of commitment
There are two main flavours of provably fair, and the difference matters because one binds far more than a single round. The per-round model is simpler and more common, while the hash-chain model commits to millions of future rounds at once.
The chain is qualitatively stronger because every outcome is bound by one public value published before the very first round. To stop the operator quietly choosing a chain that favours the house, the better implementations salt each round with the hash of a future Bitcoin block, which is genuinely unpredictable when the chain is created.
⚙️ The hashing that makes it work
Provably fair rests entirely on hash functions, which are one-way and effectively impossible to reverse. The industry has converged on the SHA-2 family because verifier code is portable and the security is well understood.
SHA-256 is the workhorse, used for the commitment on every major game. Where a secret key is involved, operators use HMAC-SHA256, which is provably indistinguishable from random and, unlike plain hashing, is immune to the length-extension trick that could otherwise let an operator bias the output. A few games, including Spribe’s, use SHA-512 for the final result, which is the same security with a longer digest and more random bits per round.
📝 For the record: Quantum computers are not a near-term threat to this. Hash functions are not broken by the algorithm that endangers wallet encryption, and the best known quantum attack only weakens, rather than breaks, SHA-256. NIST, the US body that sets these standards, said in a 2024 draft that it does not expect to replace SHA-256 because of quantum computers. Its 2030 and 2035 deadlines are for RSA and ECC, the signature methods that wallets use, not for SHA-256.
🧮 One made-up hash, worked through to a 4.28x crash point
In the Bustabit family of crash games, the crash point is floor(99 ÷ (1 − X)) ÷ 100. X is a number between 0 and 1 taken from the round’s HMAC-SHA256 output. Below, that formula is run on a made-up output, one step at a time. This hash is an example only and does not come from any real game.
Take the first 13 characters
Made-up output: c4e1b7a093d5f41a03063abd4264dbb139a97bef56bdfd2df74bfa88e9a7639c. The first 13 characters are c4e1b7a093d5f. Thirteen hex characters hold 52 bits.
Change them into an ordinary number
Any hex to decimal converter turns c4e1b7a093d5f into 3,463,579,639,037,279.
Divide by 2 to the power of 52 to get X
2 to the power of 52 is 4,503,599,627,370,496. So X = 3,463,579,639,037,279 ÷ 4,503,599,627,370,496 = 0.769069.
Work out 99 ÷ (1 − X)
1 − 0.769069 = 0.230931. Then 99 ÷ 0.230931 = 428.6998.
Round down, then divide by 100
428.6998 rounded down is 428. 428 ÷ 100 = 4.28, so this round crashes at 4.28x.
When X is below 0.01, the answer in step 4 is under 100 and the round ends at 1.00x. That is about 1 round in 100. Putting 99 in the formula, not 100, is how the house keeps its 1%. Stake Crash and Aviator use other formulas, shown in our guide to verifying a round.
✅ Your hash does not match? Run these six checks first
A hash that will not match is usually an input slip on your side, not a rigged game. Go through these six checks before you decide anything.
- ✅ Nonce. Every bet has its own nonce. Copy it from the details of the exact bet you are checking, not the one before or after.
- ✅ Seed order. HMAC-SHA256 takes a key and a message. Put each seed in the slot the game’s own fairness page names. The other way round gives a totally different hash.
- ✅ Spaces. One stray space or line break at the start or end of a seed gives a completely different hash.
- ✅ Capitals in seeds typed as text. A seed is read as text, so ABC and abc are two different inputs with two different hashes. Paste it exactly as shown.
- ✅ Paste the seed, not the hash. The hash shown before the round is what you check your answer against. Put the revealed seed into the calculator, never that hash.
- ✅ Function. SHA-256, SHA-512 and HMAC-SHA256 each give a different answer from the same seed. Use the one the game states.
Still no match? Our full verification walkthrough goes through Aviator, Stake and BC.Game step by step.
◆
🏆 Provably fair versus audited RNG
These two regimes solve different problems and should not be ranked against each other. Audited RNG proves the game behaves correctly over millions of rounds, while provably fair proves a single round was not switched after you bet. The strongest games do both.
So can a game be both? Yes, and increasingly that is the default. Spribe holds MGA and UKGC software licences and has Aviator certified by iTech Labs and BMM Testlabs, while also offering provably fair verification. BGaming ships provably fair across a catalogue built on a certified RNG, and Stake runs certified RNG on third-party studio games with provably fair on its own originals.
The hybrid pattern, certified RNG underneath for the regulator and a provably fair overlay for the player, is the emerging industry standard. Crash games lean on provably fair more than slots do, because the genre was crypto-native and a single random output per round is uniquely suited to per-round checking.
⚠️ What provably fair does not prove
Provably fair does not prove the odds are fair, the advertised return is real, the game is regulated, or that you can win. This is the part the marketing skips. It proves consistency between the commitment and the result and nothing more: a genuine guarantee, but a narrow one, and four common claims about it are simply wrong.
🔍 Worth noting
An operator could publish a chain in which every single round crashes at 1.00x and never pays out a penny. That game would be fully provably fair and entirely unwinnable. The property says nothing about whether the algorithm produces fair odds.
- It does not prove the algorithm is fair. The cryptography binds the result to a commitment, but a biased mapping is still mathematically valid and provably fair.
- It does not prove the advertised return is real. Nothing in the hashing forces the formula to honour a stated return to player.
- It does not constitute regulation. A badge can be displayed with no published formula and no verifier behind it, and no Tier-1 regulator accepts it in place of testing.
- It does not make the game beatable. The house edge is baked into the published formula, around 1% on the Bustabit and Stake lineage and 3% on Aviator.
That last point is the one that matters most at the table. The expected value of any session is minus the house edge multiplied by your total stake, at every cash-out target you could pick, and no betting system changes it. We set out the full proof, the distribution and why systems fail, on the crash gambling maths hub.
There is also a subtle limitation in the commitment itself. The hash binds the operator to the seed it committed, but if it secretly generated a hundred seeds and committed the one most favourable to the house, the property is quietly undermined. Hash chains salted with a future Bitcoin block defend against this, because part of the input cannot be known when the chain is built. Plain per-round schemes do not.
“The maths can prove the result was sealed before you bet. It cannot make that result a good one.”
None of this stops a fair game from feeling rigged. A genuinely random distribution throws long, ugly streaks of low multipliers as a matter of certainty, and the human brain reads a pattern into them. That perception, plus the predictor apps and signal groups that prey on it, is exactly why Aviator in particular gets accused of being fixed. We take that apart in is Aviator rigged?
⚠️ Scam alert: Any app or group claiming to predict the next crash is a scam. Provably fair means the result is sealed before the round opens and depends on inputs that do not yet exist, so prediction is not just hard, it is mathematically impossible. We break down the full scam ecosystem in our guide to crash game predictor scams.
The speed and constant re-bet loop that make these games engaging also carry real risks of harm. We cover the research evidence, the risk factors and what regulators are doing in a dedicated guide: crash gambling and player harm.
◆
📊 Which crash games are provably fair?
Not every provably fair crash game offers the same guarantee. Some publish the full algorithm and let you reconstruct the result, while others only expose a hash you can confirm did not change, and a few claim the property with no working verifier at all. The table below focuses on the fairness lens, and the full catalogue with returns and providers lives in our complete crash games list.
The pattern is clear. Where the operator publishes its formula, you get the strong version of the guarantee, and where it does not, the badge shrinks to “the hash did not change”. A claimed badge with no verifier behind it is worth very little.
📝 For the record: Evolution’s Cash or Crash Live is a live game show with a physical ball machine, not a cryptographic crash game, so provably fair does not apply to it. A separate, unrelated RNG title of a similar name from another studio does use a standard scheme. The two are often confused.
The bottom line: read a provably fair badge as a necessary signal, not a sufficient one. It is meaningful when the algorithm is published and you can verify a round, weaker when only a hash is exposed, and close to worthless when there is no verifier at all. It is strongest when it sits alongside independent lab certification and a real licence, never instead of them.
Try it
- Provably fair crash verifier: recompute a real round in your browser
- How to verify a provably fair round: step by step for Aviator, Stake and BC.Game
🎲 Dice, Plinko, Mines and roulette on Stake use the same seeds
Stake’s dice, Plinko, Mines and roulette games each use three inputs: a server seed, a client seed and a nonce. Stake mixes the three with HMAC-SHA256 and turns the output into numbers between 0 and 1. Each game then reads those numbers its own way. A dice roll needs one number. A Plinko drop needs one number for each row of pins.
Mix the seeds
Stake runs HMAC-SHA256 with the server seed as the key. The message is the client seed, the nonce and a cursor, joined by colons.
Split the output into groups of 4 bytes
One HMAC-SHA256 output is 32 bytes. Stake uses 4 bytes per number, so one output gives 8 numbers. When a game needs more than 8, the cursor goes up by 1 and a new 32 bytes is made.
Turn 4 bytes into one number
Divide the first byte by 256, the second by 65,536, the third by 16,777,216 and the fourth by 4,294,967,296. Add the four answers. The total is never below 0 and never reaches 1.
Take four made-up bytes: 118, 35, 201 and 7. 118 ÷ 256 = 0.46094, and the other three bytes add about 0.00055, so the number is 0.46148. Here is what each game does with that one number.
🔍 Worth noting
Spribe builds its games differently from Stake. Spribe’s own Plinko documentation names SHA-256 for the commitment and SHA-512 for the result. We have not found a Spribe rule like Stake’s that turns numbers into a board, so on Spribe games you can check the hash, but you may not be able to rebuild the result yourself.
On Stake, you can only check a dice, Plinko, Mines or roulette bet after you change to a new pair of seeds. That is when the old server seed is shown. For the tricks people sell around these games, see is Mines rigged and is Plinko rigged.
❓ Frequently asked questions
What does provably fair actually mean?
It means the operator publicly committed to a round’s outcome before you bet, by publishing a hash of a secret seed, and revealed that seed afterwards so you can confirm the result was not changed. It is a cryptographic commitment scheme, not a promise of good odds.
Can a provably fair game still be unfair?
Yes. The property only proves the result matches the commitment. The algorithm behind it could still be biased or carry a punishing house edge, and the advertised return is not enforced by the cryptography. A game can be provably fair and still a bad bet.
Is provably fair better than a licensed, audited casino?
Neither is better, because they cover different risks. Audited RNG proves correct behaviour over millions of rounds, while provably fair proves a single round was not tampered with. The strongest games combine both, with a regulated licence on top.
How do I verify a round myself?
Open the game’s fairness panel, rotate your client seed to reveal the old server seed, then hash that revealed seed and confirm it matches the hash published before the round. If the operator publishes its formula, re-run it on the seeds and nonce to confirm the multiplier. It takes under a minute.
Does provably fair mean I can win in the long run?
No. The house edge is built into the published formula, so the expected value of any session is negative at every cash-out target and no betting system changes that. Transparency does not alter the odds.
Is Aviator provably fair?
Yes. Aviator exposes its seeds and commitment hash through a shield icon on each finished round, and its RNG is also independently certified. Spribe does not publish the exact mapping formula, so you can confirm the seeds were not changed but cannot reconstruct the multiplier from scratch.
Will quantum computers break provably fair?
Not for the foreseeable future. The hash functions provably fair relies on are not broken by the quantum algorithm that threatens wallet encryption, and the best known quantum attack only weakens their security rather than breaking it. NIST does not expect to replace SHA-256 because of quantum computers. Its 2030 and 2035 deadlines are for RSA and ECC, not SHA-256.
Which crash games actually let me verify rounds?
Stake Crash, BC.Game Crash and Gamdom Crash publish enough to reconstruct results, and Aviator exposes verifiable seeds with an unpublished formula. JetX, Crash X and Roobet Crash claim the property but offer no usable verifier, so they should be treated as certified RNG only. Space XY is certified RNG and is not provably fair despite some guides claiming otherwise.
👉 Keep going
Three things worth a tap next. Everything here uses free play money only.
Crash gambling and harm. 18+, play responsibly.