Silhouette of a Counter-Strike 2 operator holding a rifle, used as a dark editorial backdrop for the article header
Back to News
Industry

Provably Fair Verification: Six Checks Before Trusting a Result

Save the seed commitment, match the revealed hash and reproduce the correct outcome mapping. Fair verification is not a guarantee of value or withdrawals.

CS2Gambling.com
November 12, 2026

Verify a result, not a marketing badge

“Provably fair” should describe a reproducible process. It does not establish a licence, good value or the ability to withdraw. Before wagering, inspect the operator’s published verification instructions; if they are incomplete, do not assume another site’s algorithm applies.

  1. Save the commitment before playing. Record the hash of the hidden server seed, your client seed and the round nonce. A hash shown only after the result is not proof of an advance commitment.
  2. Get the revealed server seed. This usually requires rotating a seed pair. Do not expose an active unrevealed seed or your login credentials to an outside tool.
  3. Match the hash. Recompute the published hash function over the seed using the exact encoding. The output must match the pre-round commitment.
  4. Reproduce the round. Follow the operator’s actual algorithm: hash versus HMAC, key/message order, separators, nonce and any cursor are significant. Different games can use different conversions.
  5. Check the outcome mapping. Confirm how the random number maps to multiplier, colour or item ranges, and compare the ranges with published probabilities.
  6. Keep the record. Save the round ID, commitment, revealed seed and calculated output. A mismatch needs investigation; never simply replace the recorded nonce until a result matches.

Hash verification alone is not enough

SHA-256 matching demonstrates that a revealed seed fits the commitment. It does not independently verify the mapping from bytes to the displayed outcome. The game may still have a substantial house edge, and a correct result says nothing about custody, trading access or withdrawals.

Why we do not publish one universal formula

Some systems use HMAC-SHA256; others combine inputs differently or use more than one output block. Copying a formula between operators can produce a false mismatch. We have not performed a current implementation audit of named operators for this article, so this checklist is not a certification of any site.

For background, see MDN’s digest reference and RFC 2104 on HMAC. Read our provably fair guide and the game-edge comparison before confusing reproducibility with profitability.