How to change your client seed and why it matters

What this guide covers

Your client seed is the one input to a provably fair game that you control. Our explainer on server seeds, client seeds and nonces covers the theory. This guide is practical: when to change it, how to change it, what happens when you do, and how to check that the casino actually used your value.

Why it matters in one paragraph

Before you play, the casino commits to a secret server seed by showing you its hash. If the casino also chose every other input, it could generate many server seeds in advance, simulate them, and commit to one that does badly for players. The hash would still match. Your client seed stops this, because it goes into every result and the casino cannot know it when it commits. That protection only holds if you set the client seed yourself, after the casino has committed.

The same bet with three different client seeds

To show how much the client seed changes, we computed one dice bet three times in Python. The server seed and nonce stay the same; only the client seed changes. The scheme is the common one: HMAC-SHA256 with the server seed as key and clientSeed:nonce:round as the message, the first four bytes turned into a float, and the dice roll as floor(float x 10001) / 100.

Server seed: a7c41e09d5b3f28e6c1d4a90b7e35f12c8d06e4b9a2f71c35e8d0b6a4f19c27e Nonce: 0

Changing one character moves the roll from 74.48 to 95.09. There is no pattern to exploit: HMAC output for one message tells you nothing useful about the output for another. That is exactly why the casino cannot plan around a client seed it has not seen.

You can paste the server seed and any of these client seeds into our verifier to reproduce the table.

When to change your client seed

• At the start of every session. This is the simplest habit and gives full protection for the session.
• After you have recorded the new server seed hash. The order matters; see the next section.
• When you want to verify recent bets. Changing the client seed usually rotates the seed pair, which reveals the old server seed so you can check your bets.
• If you have any doubt about whether the casino generated your current client seed fairly, for example because you never changed it from the default.

Changing it more often than this does not help or hurt your odds. Every seed pair produces results with the same distribution.

The right order of steps

1. Open the casino's fairness or seed settings.
2. Copy the next or new server seed hash and save it outside the casino: a note, a screenshot, a message to yourself.
3. Enter your new client seed and confirm the change.
4. Check that the active server seed hash now matches the one you saved.
5. Play.

If the casino only shows the new hash after you change the client seed, that is still fine, as long as the casino had no way to know your client seed when it created the server seed. Save the new hash immediately after the change.

What happens when you change it

At most casinos that use the common scheme, changing the client seed triggers a seed rotation:

• The previous server seed is revealed. You can now verify every bet made with it.
• A new server seed is generated and its hash shown.
• The nonce resets, usually to 0, sometimes to 1.

Some casinos let you change the client seed only together with a rotation; others have a separate "rotate" button. Read the casino's fairness page so you know which bets belong to which seed pair.

Choosing a value

The client seed does not need to be secret or long. It needs to be something the casino could not predict when it committed. Practical rules:

• Type something yourself. A random word and number, a date and a word, anything you choose at that moment.
• Do not use personal information. Casinos store the client seed with your bets and may show it in bet details. Some casinos display bet details to other players. Do not use your name, email, phone number or a password.
• Avoid unusual characters. Some casinos trim spaces or reject symbols. Letters, numbers and hyphens are safest, and they are easy to copy exactly when you verify.
• Write it down. You will need it, character for character, to verify bets.

A "randomize" button that fills in a value for you is better than leaving the original default, but the value still came from the casino's page. Typing your own removes any question about it.

Check that the casino used your seed

Changing the field is not the same as the casino using it. After your session:

1. Rotate the seed pair to reveal the server seed.
2. Open a bet from the session and check its details show your client seed exactly as you typed it.
3. Check the revealed server seed hashes to the value you saved.
4. Recompute the bet in the verifier with your client seed and the bet's nonce.
5. Compare the result with the bet record.

If the bet details show a different client seed, or the result only matches with a seed you did not set, the casino is not using your input as documented. Keep screenshots and report it.

Mistakes we see players make

Changing the seed mid-verification

If you change the client seed while you are still working through a batch of bets, later bets use the new seed. When you verify, use the client seed that was active for each bet, which is why the bet details matter.

Forgetting about the nonce reset

After a rotation, nonce 0 belongs to the new seed pair. If you verify an old bet using its position in your overall history rather than its nonce, the result will not match.

Thinking a "lucky" seed helps

No client seed is luckier than another. The game's house edge applies whatever value you choose.

Never changing it

Many players never touch the default. That leaves the casino as the source of every input. Protection exists only if you use it.

Red flags

• The client seed field cannot be edited.
• The casino accepts a new value but bet details still show the old one.
• Changing the client seed does not reveal the previous server seed, and there is no other way to see it.
• The server seed hash changes without a rotation you asked for.
• Results only verify with a client seed you did not set.

Any of these defeats the purpose of provably fair play. Our audits check each one; see how we audit.

Quick routine

Sources

• RFC 2104, HMAC: Keyed-Hashing for Message Authentication: https://datatracker.ietf.org/doc/html/rfc2104
• NIST FIPS 198-1, The Keyed-Hash Message Authentication Code (HMAC): https://csrc.nist.gov/pubs/fips/198-1/final
• NIST FIPS 180-4, Secure Hash Standard: https://csrc.nist.gov/pubs/fips/180-4/upd1/final
• Python documentation, hmac module: https://docs.python.org/3/library/hmac.html
• Python documentation, hashlib module: https://docs.python.org/3/library/hashlib.html