How to verify a provably fair mystery box result
Disclosure: Loot Boxes earns commissions from some links on this site and has a commercial relationship with MrLoot, which we promote. Read how we make money and how we review.
Many mystery box sites advertise a provably fair system, including most of the platforms in our comparison. The phrase means something specific: the site commits to a secret before you open a box, and afterwards you can check that the result came from that secret and your client seed. Here is how it works, what provably fair verification actually shows, a demo you can run right here and, in our view, the limits that deserve more attention than they get.
The three ingredients
- Server seed. A secret value the platform creates, which should be random. Before you play, it shows you only a hash of it, a fingerprint that is quick to compute but practically impossible to reverse.
- Client seed. A value you control, or one the site's page generates for you. Because the platform commits to its hashed server seed before it knows your client seed, it should not be able to pick a server seed that produces a result it wants. That only holds if the hash was shown before your client seed was set and did not change afterwards, so set your own client seed rather than keeping one the site generated. For battles, some sites, including EmpireDrop, Packdraw and HypeDrop, use data from a future EOS blockchain block as the client seed instead of a value you choose.
- Nonce. A counter that usually goes up by one with each opening, so every result uses a fresh combination.
Once the server seed is retired, either when you rotate it or on the site's schedule, the platform reveals it. You hash it yourself. If your hash matches the fingerprint you were shown earlier, the seed was not swapped. You then rerun the formula with your client seed and nonce and confirm you get the same result the site gave you.
Try it: a working demo
This demo uses a simplified scheme for learning: the result is HMAC SHA256 of your client seed and nonce, joined by a colon (for example my-lucky-seed:1), keyed with the server seed, and the first eight hexadecimal characters are turned into a number between 0 and 100. Real platforms each use their own formula, so use the verifier or instructions published by the site you play on. This demo is for learning only and is not connected to any platform.
Worked example you can reproduce
With the default values above, any SHA256 and HMAC SHA256 tool gives the same numbers. The HMAC key is the server seed as text and the message is the client seed, a colon and the nonce (for example my-lucky-seed:1). The first eight hex characters are read as a whole number, divided by 4,294,967,296 and multiplied by 100.
| Step | Value |
|---|---|
| Hash shown before play, SHA256 of the server seed | e1d714d65da5e62d14f491a68ed7d77382bf07a27f836457ece8b416a00461a1 |
| Nonce 1: first 8 characters of the HMAC | edc87132, which becomes 92.8840 |
| Nonce 2 | 32e6b1b2, which becomes 19.8833 |
| Nonce 3 | 60287683, which becomes 37.5617 |
If a box listed a sticker pack at 60 percent, earbuds at 30, a smartwatch at 9 and a console at 1, the results would map to ranges 0 to 60, 60 to 90, 90 to 99 and 99 to 100. Nonce 1 lands on the smartwatch and nonces 2 and 3 on the sticker pack. Change one character of any seed and the whole result changes, so once both seeds are locked in, neither side can nudge the outcome.
What provably fair does not prove
- It does not show how the server seed was made. A matching hash proves the seed was not swapped after you saw its hash, not that it was picked at random. It also cannot protect you if the hash only appeared after your client seed was set.
- It does not make the odds generous. A box can be perfectly provably fair and still return only a small share of its price. Check the odds and values with our odds calculator.
- It does not check item values. If the site values an item higher than you could sell it for, the box's stated value overstates what you could actually get back.
- It does not guarantee payouts. Whether a site lets you withdraw, and how fast, depends on its terms and conduct, not its seeds.
- It only works if you check. The protection comes from players actually comparing hashes. Rotate your seed now and then and verify at least one result.
How to check a result on a real site
- Before opening, note or set your client seed and copy the hashed server seed the site shows.
- Open your box and note the nonce and the result.
- Rotate the seed pair in the site's fairness settings, or wait for its scheduled reveal, to see the old server seed. Timing varies: Boxed.gg, for example, says it reveals server seeds 24 hours later.
- Hash the revealed seed with the algorithm the site names and compare it with the hash you copied. They must match exactly. Several sites use SHA256, but not all: Packdraw, for example, shows a SHA512 hash, and some sites add a salt, so follow the site's own instructions.
- Use the site's own verifier, or its published formula, with the revealed seed, your client seed and the nonce. You should get the same result.
In our comparison you can see which platforms we found publishing a public verification method, and each platform's fact sheet links to its fairness page.