PackOpeningSites
WATCHDOG & AUDITS
Claim Codes
Cryptographic Technology Guide

What is Provably Fair in Pack Opening?

The cryptographic mechanism that guarantees the site operator could not have tampered with your pack pull after you paid.

1. The Problem with Black-Box Mystery Boxes

In traditional mystery box sites or video game loot boxes, the server decides what you win behind closed doors. The operator could theoretically adjust the win rate based on your balance, decrease high-tier pulls when traffic spikes, or deliberately ensure that you never hit a high-value grail card like an Umbreon VMAX or 1st Edition Charizard.

Provably Fair algorithms eliminate this trust requirement. By using cryptographic hash functions, the platform commits to an outcome before you purchase, while ensuring neither party can manipulate the final result.

2. The Three Core Pillars of Provably Fair

  • The Server Seed (Hashed): Before opening any pack, the platform generates a randomized secret string called the Server Seed. They run this string through a SHA-256 algorithm and give you the resulting hash. A SHA-256 hash is a one-way mathematical fingerprint: you cannot determine the original string from the hash, but once revealed, anyone can verify that the hash matches the original string.
  • The Client Seed: This is a random string provided by your web browser (or customizable by you in your account settings). Because the server did not know what client seed you would use when it created the server seed, it could not have pre-rigged the result against you.
  • The Nonce: An incremental counter (1, 2, 3...) that tracks how many packs you have opened with the current seed pair. This guarantees that every unboxing produces a distinct cryptographic output even if your seeds remain unchanged.

3. Step-by-Step: How a Pull is Mathematically Generated

When you click "Open Pack", the following mathematical process occurs:

  1. The system concatenates: [Server Seed] + [Client Seed] + [Nonce].
  2. It generates an HMAC-SHA512 hash of that combined string.
  3. It takes the first 8 characters (hexadecimal) of that hash and converts them into an integer between 0 and 100,000,000.
  4. This integer is mapped directly against the public drop table percentage brackets of that mystery box.

4. Which Platforms are Provably Fair?

During our audits, platforms like Courtyard.io (via smart contracts on Polygon), Boxed.gg (client-server seed generator), and Gemma Cards (pre-purchase SHA-256 locking) scored highest in verifiable fairness. Platforms with proprietary RNGs (like Packz and JemLit) were downgraded due to lack of third-party mathematical verifiability.