Provably Fair Play
Every spin, roll, and drop on LuckLab is cryptographically committed before you play and independently verifiable after. Here's exactly how it works.
We generate a server seed and publish its SHA-256 hash before any round.
You set a client seed. Each bet uses an incrementing nonce so no two outcomes share inputs.
When the seed is revealed, hash it yourself — it must match the committed hash exactly.
The formula
Every game result is derived from a single deterministic call:
HMAC_SHA256(serverSeed, clientSeed + ":" + nonce)The hex output is sliced into bytes and mapped to the game's outcome space — a reel position, a 0–99.99 dice roll, a Plinko bucket index, a card draw. Same inputs always produce the same output.
Verify a result
Paste your revealed server seed, the client seed you used, and the nonce of the bet you want to check. Everything runs locally in your browser — nothing is sent to LuckLab.
Where to find your seeds
Each game session exposes the active server seed hash, your current client seed, and the next nonce in the Fairness panel. Rotate the server seed at any time — the previous seed is then revealed in plain text so you can verify every bet you played under it.
FAQ
What is a server seed hash?+
Before any round, we generate a random server seed and publish its SHA-256 hash. The hash is a fingerprint — it commits us to that exact seed without revealing it. Once a round is finished (or you rotate seeds), the original server seed is revealed and you can hash it yourself to confirm it matches.
Why do you commit a hash first?+
Committing the hash before play means we cannot change the seed after seeing your bet. If the revealed seed hashes to the same value we published, the outcome was locked in from the start.
What is a client seed?+
The client seed is a value you control. Combined with the server seed and an incrementing nonce, it determines the outcome. Because you choose it, we cannot predict the result either.
How is the result calculated?+
We compute HMAC-SHA256(serverSeed, `${clientSeed}:${nonce}`). The hex output is sliced into bytes and mapped to game outcomes (a slot reel position, a dice roll, a Plinko bucket, etc.).
Where can I verify a result?+
Use the verifier on this page. Paste your revealed server seed, client seed, and nonce — it runs the same HMAC-SHA256 in your browser and shows the raw hex result.