SSL Secured·Provably Fair·Rankings powered by real deposit volume data·Updated Jul 2026·18+ Gamble Responsibly
Crash Verification · 8 Min Read · Jun 2026

HOW TO VERIFY PROVABLY FAIR CRASH

AM
Alex Mercer · ProvenlyFair.com Editorial Team
Updated Jul 20268 min read
In Crash, a multiplier climbs from 1.00x and you must cash out before it busts. A provably fair Crash game lets you prove the bust point was fixed before the round began — not lowered the instant you placed a big bet. Below we lay out the exact formula that converts an HMAC-SHA256 digest into a bust multiplier, explain why roughly 1 round in 100 dies instantly at 1.00x (that is the house edge showing itself), and derive a complete bust point by hand from published inputs so you can test every step against our browser-based verifier.

Recompute a Bust Point in Seconds

Suspicious about a round that died under your target? Pull the revealed server seed, your client seed and the round's nonce from the fairness page, feed them to the tool, and watch the same multiplier fall out of the math — locally, with nothing uploaded anywhere.

Recompute a Round

What Fixes a Bust Point Before Anyone Bets

Three values determine where a round dies, and their timing is the whole trick. First, a secret server seed: the casino locks itself to it up front by publishing the seed's SHA-256 fingerprint — swap the seed later and the fingerprint stops matching. Second, a client seed under your control, which means bust points could not have been ground out against your account in advance. Third, the nonce, a simple round counter that makes each bet on the pair distinct.

The specific fear this addresses in Crash is early busting: the suspicion that the rocket died at 1.3x because your stake was large. Verification kills that theory or confirms it — the multiplier is a pure function of inputs that predate your bet, so once the retired server seed is disclosed, you can replay any round and compare. (New to seed pairs and rotation generally? Start with the all-games verification primer, then come back for the crash-specific math.)

How the Hash Becomes a Multiplier: The Real Formula

There are two crash formulas in common use, and it matters which one your casino uses. This guide covers the Stake-compatible model, as implemented in the widely used open-source reference verifier lucasholder/fair (explicitly built to match Stake's output). Here are the steps:

  • 1
    Build the HMAC. The server seed is the HMAC key; the message is clientSeed:nonce. Computing HMAC_SHA256(serverSeed, "clientSeed:nonce") produces a 32-byte hash (64 hex characters).
  • 2
    Read the first 4 bytes as an integer. Take the first 8 hex characters and read them as a big-endian 32-bit unsigned integer, giving a whole number int from 0 to 4,294,967,295 (that is 2³² − 1).
  • 3
    Apply the crash formula. crashPoint = max(1, (2³² / (int + 1)) × 0.99), then floor to two decimals. The × 0.99 is the 1% house edge; the max(1, …) guarantees the result is never below 1.00x.

The instant 1.00x — how the house edge bites. When int is very large, 2³² / (int + 1) drops below 1, and after the × 0.99 the value is ≤ 1. The max(1, …) then pins the round to exactly 1.00x — an instant bust. This happens for the top ~1% of integer values, so about 1 in 100 rounds busts immediately. It is fully determined by the hash, not chosen live by the casino. (Note: the classic Bustabit formula instead reads 52 bits and forces 1.00x when the value is divisible by a constant — a different mechanism for the same purpose.)

Prefer Not to Do 32-Bit Arithmetic?

Fair enough. The verifier implements the whole chain above — HMAC, integer extraction, edge multiplier, clamp — and prints the bust point for any seeds and nonce you give it, entirely client-side.

Run the Formula For Me

A Bust Point, Derived by Hand

Now the full derivation with concrete inputs. Every number below is genuinely computed — run the same HMAC in any implementation and the digest will match character for character.

InputValue
Server seedserverSeed123
Client seedclientSeed456
Nonce7
  • 1
    Compute the HMAC. HMAC_SHA256("serverSeed123", "clientSeed456:7") =
    2582e59bd17a0f39282f13349ff7b3f803c57fa6a22315403869a9c6da6de5bc
  • 2
    Read the first 8 hex characters as an integer. 2582e59b in decimal is 629,335,451.
  • 3
    Apply the formula. (2³² / (629,335,451 + 1)) × 0.99 = (4,294,967,296 / 629,335,452) × 0.99 = 6.8246 × 0.99 = 6.756. Since that is above 1, max(1, …) keeps it, and flooring to two decimals gives 6.75x.

Result: these seeds at nonce 7 crash at 6.75x — every single time, on any machine. If the casino had busted you earlier than 6.75x on these exact inputs, the verification would fail and you would know the round had been altered. That reproducibility is the entire point.

Collecting the Inputs From Your Casino

Verification needs the plain-text server seed, and no honest casino shows it while the seed is live — disclosure happens at rotation. The menu paths differ per operator:

CasinoHow to Find Your Seeds
StakeUnder Settings → Fairness: record the committed hash first, rotate the pair, and the outgoing server seed prints in plain text. Each Crash bet's detail view carries its nonce.
RoobetFrom a Crash entry in Game History, open the fairness details; rotating via the avatar's Fairness panel discloses the retired seed next to your client seed and nonce.
BC.GameThe Provably Fair area under your profile lists current and previous pairs; rotate there, then read per-round nonces out of the game log.

The Guarantee, Stated Precisely

A matching recomputation settles two questions and deliberately leaves two others open:

  • ✓Settled: no mid-round tampering. The bust multiplier existed, hash-committed, before betting opened — nobody shortened the flight because your stake was large.
  • ✓Settled: the commitment was honoured. The disclosed seed hashes to the fingerprint published beforehand and regenerates the multiplier the game displayed.
  • ✗Open: the edge stays. That ×0.99 haircut and the resulting ~1-in-100 instant deaths are the design, applied honestly to every round. Verification certifies the design was followed — it cannot make the design generous.
  • ✗Open: everything at the cashier. Withdrawal handling, account treatment and licensing live outside the hash entirely; weigh those via our operator rankings.

Key Takeaways

Provably fair Crash (Stake model) derives the multiplier from HMAC-SHA256(serverSeed, clientSeed:nonce): the first 4 bytes become a 32-bit integer, then crashPoint = max(1, (2³² / (int + 1)) × 0.99). The × 0.99 and the resulting ~1% instant-1.00x busts are the house edge. Our worked example (serverSeed123 / clientSeed456 / nonce 7) crashes at 6.75x, reproducibly. Check your own rounds with our Provably Fair Verifier.

Frequently Asked Questions

On Stake's model the casino computes HMAC-SHA256(serverSeed, clientSeed:nonce). The first four bytes become a 32-bit integer, and the crash point is max(1, (2³² / (int + 1)) × 0.99), rounded down to two decimals. The 0.99 factor is the 1% house edge. The same seeds always reproduce the same multiplier, so you can verify any round after the seed is revealed with our verifier tool.
The instant 1.00x is how the house edge is enforced. Whenever the formula (2³² / (int + 1)) × 0.99 works out to 1.0 or less, the max(1, ...) clamp pins the result at exactly 1.00x. That happens for roughly the top 1% of integer values, so about 1 in 100 rounds crashes immediately. It is fully determined by the hash, not chosen by the casino in the moment.
It proves the crash point was fixed by the server seed before the round began and was not lowered to bust you early. Because the server seed hash was committed in advance and you set the client seed, the multiplier is tamper-proof. Verification does not remove the 1% house edge built into the formula, and it cannot guarantee a casino will pay a withdrawal.
They are related but not identical. Bustabit's classic formula reads 52 bits from the hash and forces an instant crash when the value is divisible by a constant. Stake's model reads a 32-bit integer and multiplies by 0.99, letting the max(1, ...) clamp produce the instant-1.00x cases. Both are verifiable; this guide uses the Stake-compatible formula from the open-source lucasholder/fair reference.
No. Each multiplier depends on the secret server seed, which is only revealed after you rotate the seed pair. Until then its SHA-256 hash gives you nothing usable, and HMAC-SHA256 is not reversible. Verification is strictly an after-the-fact check that a completed round was fair, never a way to forecast future rounds.
AM
Alex Mercer
Alex covers crypto casinos and provably fair gaming for the ProvenlyFair.com Editorial Team. Specialising in cryptographic verification systems and transparency in online gambling.
Free Tool — Verify Any Crash Round
Verify Now