Provably Fair
Every original on DONUTACE is decided by cryptography you can check yourself — before, during, and after the bet. This page explains the scheme and lets you verify any past round.
Our slots are the exception, and we would rather say so here than let you assume otherwise. See below.
How it works
1. Commit. Before you place a bet, we generate a secret server seed and show you its SHA-256 hash. The hash locks the seed in place: any change to the seed would change the hash.
2. You contribute. Your client seed is combined into every result. You can set it to anything you like in the fairness modal — we cannot predict it, so we cannot pre-pick outcomes that favor the house.
3. Roll. Each bet increments a nonce and computes HMAC-SHA256(serverSeed, clientSeed:nonce). The first 8 hex characters, divided by 2³², give a uniform roll in [0, 1) that the game math turns into your result.
4. Reveal. Rotate your seed pair at any time to reveal the old server seed. Hash it yourself, compare with the commitment, and recompute every roll it covered.
Per-game mapping
| Game | How the roll becomes the result |
|---|---|
| Mines | Mine positions from a Fisher-Yates shuffle driven by HMAC rounds (nonce fixed, round index appended) |
| Crash | crash = max(1, floor(99 / (1 − roll)) / 100), capped at 5,000× — ~1% instant bust at 1.00× |
| Dice | value = floor(roll × 10,001) / 100, giving 0.00–100.00 |
| Plinko | One 32-bit roll splits into one bit per row; the bucket is the sum of the bits |
| Towers | Bomb positions per floor from successive HMAC rounds |
| Cases | roll picks a ticket in the weighted item table |
| Blackjack | Streaming Fisher-Yates over an 8-deck shoe, one HMAC round per card |
| Roulette | pocket = floor(roll × 37); the wheel animation is steered onto that pocket |
| Slide / Chicken Road | roll picks a ticket in the published segment / lane table |
| Dispenser | Two windows of one HMAC — bytes 0-3 your tag, 4-7 the house’s — each mapped to 1-9 by rejection sampling, so all nine tags are exactly equally likely |
Where a game animates physics (Plinko, Roulette, Slide, Chicken Road), the visual is steered onto the pre-decided fair result — the animation can never contradict the math.
Slots are not provably fair
Deepslate, Harvest, Ominous Vault and Dragon’s Hoard are not on the table above, and that is not an oversight. They cannot be verified the way the games above can, so we do not offer a formula for them and there is no widget on this page that will check one.
What is still true of them. The server decides the entire spin — the grid, every tumble, every free spin and the payout — before the reels move. The result is generated from your seed pair, so we can reproduce any spin you ask us about. And the animation is a replay of a decision already made, which means what you watch can never disagree with what you are paid.
What is not. A slot spin is thousands of draws deep and its reel weights are not published in a form you could recompute against, so you cannot re-derive the result yourself and check our arithmetic. On a slot you are taking our word for it. On every original above, you are not — and if that distinction matters to you, play those.
Each slot publishes its paytable, its maximum win and its measured return under Rules & Paytable on the game page.
Verify a bet
Find your seeds in the fairness modal (shield button on any game page) or in the My Bets drawer, which stores a seed snapshot with every bet. The server seed must be revealed first — rotate your pair in the fairness modal to reveal it.
Shared rounds: crash & slide
Everyone plays the same crash and slide round, so a per-player seed cannot prove it — one result has to be checkable by every player at once. Instead the house commits to a chain of hashes before round 1 and reveals one per round, working backwards: hashing a round’s revealed value returns the previous round’s, ending at a commitment that existed before any round was played.
The check below runs entirely in your browser, against data the server has already published and cannot take back. It walks every link and re-derives each multiplier from its own hash.