Provably Fair & House Edge
Committed before you bet
Before a wager is accepted, the server has already committed to a secret seed by publishing its SHA-256 hash. The outcome is a pure function of that seed, a client seed, and a counter. Once the seed is revealed you can recompute every round it produced and confirm the hash you were shown at the start matches it. Neither side can change a result after the fact without breaking the hash.
Three inputs
Server seedSecret until the pair is retired9f2c61b7a04d83e5c1f6d2a8b37e40915ac7d3e82f6b1904ce5a7d38b60f1e24Client seedYours to setfragbet-demoNonceGoes up by 1 per wager0Published firstSHA-256 of the server seedd899a78281c55869606a356bc62383424842dddae30d85099ff6ba234f934fc3HMAC-SHA256
Key is the server seed. Message is the client seed, a colon, then the nonce.
fragbet-demo:0Digest
64 hex characters. The first 8 are 4 bytes, read as a number.
7fcabc5b85f51b4d5a3121c3b289f08acbb63a3a13a7209026bc40c47dca0ce42,143,992,923divided by 4,294,967,296
Outcome
0.49918725
A float in [0, 1). Each game reads it its own way.
Roulette: floor(float x 19) is pocket 9 of 19.
Coinflip: splits on 0.5, and this float sits just under it.
On this page
01What this proves, and what it does not
Provably fair is a narrow, verifiable claim. It is worth being exact about its edges.
The result was not altered
The server could not see your bet and then pick a losing outcome, because the seed was locked to a published hash before the bet existed.
The maths was applied correctly
You can rerun the derivation yourself and get the identical roll, grid, path, or slot, using nothing but a SHA-256 tool.
That the game is break-even
Payouts are priced below true odds on purpose. A perfectly fair draw with an unfair payout is still a losing proposition. See section 05.
Anything, if you check too late
The commitment only binds us if you saw the hash before betting. Reading it for the first time after a loss proves nothing at all.
02The three inputs
Deterministic randomness is derived from three values:
- Server seed
- 32 random bytes, shown as 64 hex characters, generated by the server with a cryptographic random source. Only its SHA-256 hash is published while the pair is active. The plaintext is released when you rotate.
- Client seed
- Yours. Set it to any string up to 64 characters in the Provably Fair panel, or keep the random one issued on signup. Because it feeds the digest, the server cannot predict outcomes for a seed you have not chosen yet.
- Nonce
- A counter that starts at 0 and increases by 1 per wager on the current pair, so no two bets share a digest. Rotating the pair resets it to 0.
- Output: a 64-character digest
- HMAC-SHA256 keyed with the server seed over a message built from the other two. Each game reads that digest differently, as set out below.
03The formula, per game
The digest is always keyed with the unhashed server seed. What varies is the message. Coinflip, dice, plinko, mines and roulette use the base message; tower and chicken append a game tag and an index, because each floor and each lane needs its own independent draw.
Tower draws bombs one floor at a time, and chicken draws one lane at a time:
HMAC_SHA256(key = ServerSeed, message = ClientSeed + ":" + Nonce + ":chicken:" + LaneIndex)
Floor and lane indices start at 0. Getting the message string exactly right, separators included, is the single most common reason an independent verification fails to match.
04From digest to outcome
The first 8 hex characters of the digest are 4 bytes. Read as a big-endian unsigned 32-bit integer and divided by 232 (4,294,967,296), they give a float in [0, 1).
Games that need more than one draw walk further along the digest in 8-character steps, and re-hash the digest with SHA-256 when they run out of characters. From there:
- Coinflip and plinko split on 0.5 — one draw for coinflip, one per row for plinko, with the bucket index equal to the number of right deflections.
- Dice scales the float across the 0.00–99.99 range.
- Roulette takes the floor of float × 19 to pick one of 19 pockets.
- Mines runs a Fisher-Yates shuffle of the grid using rejection sampling, which discards any integer landing in the short tail above the largest exact multiple of the range. That removes modulo bias entirely.
- Chicken compares the float against that lane’s danger threshold. Tower reduces each draw modulo the tile count and skips duplicates, which leaves a bias below one part in fifty million per floor — present, and far too small to affect a result.
The in-game verifier prints each of these steps with its intermediate values, so you can compare them line by line against your own calculation.
05Return to player and house edge
A provably fair draw says nothing about how the win is priced. These are the figures the settlement code actually pays. Return to player (RTP) is the share of stake a bet returns on average over a long run; the house edge is the remainder, and it is how FragBet earns.
| Game | Bet | RTP | House edge |
|---|---|---|---|
| Coinflip | Player vs player | 99.00% | 1.00% |
| Plinko | Every board and risk level | 99.00% | 1.00% |
| Dice | Any target, over or under | up to 96.00% | 4.00%+ |
| Mines | First step, any mine count | about 95% | about 5% |
| Tower | First floor, any difficulty | about 95% | about 5% |
| Chicken | First lane, any difficulty | about 95% | about 5% |
| Mines, Tower, Chicken | Sixth step onward (the edge stops growing here) | about 82-85% | about 15-18% |
| Roulette | Red or black (8 of 19 pockets, pays 2x) | 84.21% | 15.79% |
| Roulette | Gold (1 of 19 pockets, pays 16x) | 84.21% | 15.79% |
| Roulette | Purple (2 of 19 pockets, pays 8x) | 84.21% | 15.79% |
Roulette is the harshest game on the platform
Every bet on the wheel now returns the same 84.21%, so no colour is a trap — but that figure is well below the rest of the site. Dice returns up to 96%, Mines, Tower and Chicken start near 95% and fall as you climb (to roughly 82-85% from the sixth step), and Plinko and Coinflip return 99%. Staking 100 Gold on the wheel costs about 15.79 Gold in expectation, against about 4 Gold on dice. Until 1 September 2026 purple was worse still: it was one pocket in sixteen paying 7x, the price of a two-pocket colour, and returned 43.75%. It now has the second pocket its payout was always priced for.
Blackjack is not a single number: its return depends on the decisions you make. It is dealt from six decks and a natural blackjack pays 3:2.
These figures are long-run averages over many thousands of bets. Any individual session can land far above or far below them, in either direction. RTP is not a schedule and it is not a promise about your next hour.
06Verifying a past round
You need the plaintext server seed, which is released only when the pair is retired.
Note the hash first
Open the Provably Fair panel in any game and copy the active server seed hash before you play. This is the step that gives every later one its meaning.
Rotate the pair
Rotating retires the current seed, reveals its plaintext, and issues a fresh pair with the nonce back at 0. The panel keeps your 15 most recent retired pairs.
Check the commitment
Take SHA-256 of the revealed server seed. It must equal the hash you noted in step 01. If it does not, the commitment was broken — tell us immediately.
Recompute the round
Run the HMAC for that game with the revealed seed, your client seed, and the bet nonce from your bet history. Derive the outcome and compare it to what you were paid.
Any independent HMAC-SHA256 tool will do — the point is that you do not have to trust ours. Your bet history carries the nonce for every wager you have placed.
Check your seeds before you play
The Provably Fair panel is in every game. Note the hash first — that is what makes the rest of it mean something.