Provably Fair Vs Rng Slots Guide

Both systems can be honest; only one lets you verify the math yourself

Crypto casino lobbies in 2026 ship two distinct fairness systems running side by side. In-house Originals — Stake Dice, BC.Game Crash, Roobet Plinko, Cloudbet's variants, and the Spribe Aviator family — use provably fair cryptography that lets a player verify the outcome of any round in their browser using published SHA-256 or HMAC-SHA512 hashes. Third-party slots from Pragmatic Play, Hacksaw Gaming, Nolimit City, NetEnt, Play'n GO and other studios use audited random number generators certified by labs such as iTech Labs, eCOGRA, GLI, BMM Testlabs and similar. Both systems can produce mathematically fair outcomes; the verification methods are completely different. A provably fair round can be checked in two minutes; an RNG slot relies on the lab's signed audit report and the operator's compliance with technical standards. This guide explains both models in detail, the exact verification process for each, why the industry runs them in parallel, and the rare edge cases where one or the other fails. Understanding the distinction lets you tell when a casino's "provably fair" claim is genuine and when it is marketing decoration.

What provably fair actually means

Provably fair is a cryptographic commit-and-reveal protocol. The casino commits to a secret string (the server seed) before any bet is placed, by publishing the SHA-256 hash of the seed to the player. The player contributes their own randomness (the client seed). The casino combines both with a counter (the nonce) to produce a deterministic outcome via HMAC-SHA512 or similar one-way function. When the player rotates seeds, the server seed is revealed, and the player can hash it themselves to confirm it matches the original committed hash — proving the casino did not modify the seed between the commitment and the reveal.

The system was first publicly implemented by SoftSwiss/BGaming in 2014 on bitsler.com and has become the default expectation for any in-house crypto-casino game. Stake, BC.Game, Roobet, Shuffle, Cloudbet, BetFury, Mega Dice, Duel and BGaming all publish working verifiers. Spribe (Aviator) embeds an in-client verifier. The mathematical guarantee is hard — any single character change in the server seed produces an entirely different hash, so tampering is detectable in seconds.

The system has two limitations. First, provably fair guarantees the outcome was not altered after the player committed to the bet — it does not eliminate the house edge. Stake Dice runs 99% RTP; the 1% house edge is the casino's mathematical entitlement and provably fair confirms only the 1% is the maximum edge. Second, provably fair applies to games where the casino controls the math. Third-party slots from studios like Pragmatic Play do not run provably fair because the studio, not the casino, controls the outcome — and the studio relies on a different trust model.

What audited RNG actually means

An audited RNG slot uses a pseudorandom number generator running on the studio's game server. Common algorithms include Mersenne Twister (in older slots), Fortuna, Yarrow, or proprietary derivatives, typically seeded from cryptographically secure sources such as Intel's hardware RNG and the operating system's /dev/urandom. The output drives every game decision — reel positions, bonus triggers, multipliers, paylines.

The fairness guarantee comes from independent certification. Labs run statistical analysis on millions of generator outputs — chi-square tests, autocorrelation tests, monobit tests, NIST SP 800-22 test suite — to verify the output is statistically indistinguishable from true random. The lab issues a signed certificate covering the specific game build, RNG implementation, and the operator-level integration. Operators must re-certify on every meaningful update.

The trust model is therefore "trust the lab + trust the operator does not run an unaudited variant". The reasonably rigorous labs — iTech Labs (Sydney), eCOGRA (London), GLI Gaming Laboratories International (Las Vegas), BMM Testlabs, Trisigma — have decades of track record. The risk is operator-side: a casino running an unauthorised RTP variant of a game, or routing players to a clone of a popular slot with different math.

How to verify each system step by step

Provably fair round verification. Open the bet in your history. The fairness panel shows server seed (revealed after rotation), client seed, nonce, and the published hash of the server seed at commitment. Hash the revealed server seed with SHA-256 — the result should match the published hash. Then concatenate client seed, nonce, and game-specific cursor; HMAC-SHA512 with the server seed as key; convert the first eight characters of the hex output to a decimal float between 0 and 1; map to the game's outcome space. Stake's verifier (and open-source mirrors at GitHub) embeds the full JavaScript and lets you paste your inputs to confirm.
Provably fair seed rotation. The player should rotate seeds periodically — typically before any session where they want to verify subsequent rounds. Rotation reveals the old server seed, lets you verify past rounds, and commits to a new hash for future rounds.
RNG slot audit verification. Open the game's info panel (usually accessible through the slot menu). The RTP, volatility rating, and audit certificate reference should be listed. Visit the lab's public certification site — iTech Labs maintains a search portal, eCOGRA publishes its certification register — to confirm the specific game build is certified. The certificate should reference the exact provider, game name, build version, RTP, and date.
Operator-side RNG check. Crypto casinos that take third-party slots typically list "certified by iTech Labs" or "tested by GLI" in the games' info screens. The provider's signed audit covers the math; the operator's integration is covered by the operator's own audit. Both layers should be verifiable.
Suspecting a clone. If a slot looks like Sweet Bonanza but the RTP shown is 92% instead of 96.48%, the operator may be running a low-RTP variant — Nolimit City explicitly allows operators to choose between 84% and 97% RTP versions of the same game. Always check the displayed RTP in-game versus the studio's official published RTP.

Practical examples — five real games verified

Stake Dice (Stake Originals). 99% RTP. Pure provably fair. Verification via the published Stake fairness algorithm. Server seed is committed as SHA-256 hash before each session; revealed on rotation. HMAC-SHA512 produces the roll value. The four-year track record on the protocol is clean — no published incident of tampering.

Aviator (Spribe). 97% RTP. Provably fair with multi-player consensus. Each round's outcome is derived from a combination of contributions across three independent sources — first server seed, second server seed, and SHA-256 of subsequent block hash. The multi-party derivation makes single-source manipulation impossible. The in-client verifier shows the inputs and the derived multiplier.

BGaming Crash. 99% RTP, 1,000,000x max multiplier. Provably fair via chained server seeds. Each round's server seed is the SHA-256 of the previous round's server seed — the chain is auditable from round one. Combined with client seeds and nonces, the entire history is recomputable.

Sweet Bonanza (Pragmatic Play). 96.48% RTP. Audited RNG. Certified by iTech Labs and GLI for major operator integrations. The math is fixed by Pragmatic's paytable; the RNG produces the symbol grid and the multiplier outcomes. No provably fair verifier exists for the round — the trust is in the audit chain.

Wanted Dead or a Wild (Hacksaw Gaming). 96.38% RTP, 12,500x max. Audited RNG via GLI. Hacksaw publishes detailed math model documentation that lets sophisticated players cross-check the math statistically over many spins, even though no per-round provably fair verifier exists.

Lightning Roulette (Evolution Live). 97.30% RTP. Neither provably fair nor pure RNG — the physical wheel is the random source. Audited by GLI for the physical equipment plus the digital overlay. Live dealer games occupy a third trust model: the physical event is the randomness.

Common mistakes and red flags

Believing "provably fair" applies to slots. Almost never. The studios run their own audited RNGs; the casino can layer a wrapping signed receipt over the bet but the underlying outcome comes from the studio's RNG, not from a provably-fair-style commit-and-reveal. Operators that explicitly label third-party slots as "provably fair" are usually overstating.
No commitment hash before the bet. If a casino's fairness panel only shows the server seed after the round resolves, with no committed hash beforehand, the system is decorative — the operator could have generated the seed after seeing the bet. Real provably fair always commits first.
Closed-source verifiers. Legitimate operators publish the algorithm and a working verifier. Stake's verifier is open-source on GitHub. BGaming publishes algorithm details. Any operator that holds the verifier as a black box that only they can run cannot be independently checked.
RNG slot with unusual RTP. If a popular slot displays a non-standard RTP, the operator may be running a variant the studio allows but most operators reject. Check the provider's official RTP and only play matching builds.
Self-certified audits. Some smaller studios produce "audited by" claims with auditors that are themselves operator-owned or otherwise compromised. The reputable labs are public-record entities with multi-decade track records.

FAQ

Which is more secure — provably fair or audited RNG? Provably fair gives the strongest per-round cryptographic verification. Audited RNG relies on statistical certification of millions of outputs. Both are honest models when correctly implemented; provably fair lets you verify your specific round, audited RNG lets you verify the math at the model level.

Why don't third-party studios run provably fair? Provably fair requires the operator and the player to be the only parties involved. Third-party slot integrations involve provider, operator and player — the provider's RNG outcome is sent to the operator and to the player, and there is no clean commit-and-reveal flow that protects all three. Audited RNG is the practical alternative for the multi-party model.

Can a casino fake provably fair? Theoretically yes if they generate the server seed after seeing the bet. Practically no, because every reputable operator commits the hash before betting opens — and you can screenshot the commitment to confirm. Closed-source verifiers are the warning sign.

Are live dealer games audited? Yes, but through physical-equipment certification (GLI, iTech Labs) rather than RNG audits. The wheel, the shoe, the cards, and the studio operations are the audit subjects.

Does provably fair affect the house edge? No. The protocol guarantees the outcome was not changed; the house edge is built into the payout structure separately. Stake Dice's 1% edge is mathematically published and provably fair confirms only that the edge is honoured exactly.

Updated 22 May 2026.