Verifiable randomness

Every pack opened on CardVault uses commit–reveal, so you can prove for yourself that the result was fixed in advance and not changed after you hit open.

We generate a server seed and publish its hash first

Before anyone opens a pack, the system generates a 256-bit server seed, stores it, and publishes only its SHA-256 hash on the machine page — locking in the result before anyone knows the actual value.

You supply your own client seed

Your browser generates a client seed that feeds into the calculation, so the platform can't pick your outcome on its own.

The roll is computed from an HMAC

roll = HMAC-SHA256(key = server seed, message = client seed : nonce). The first 8 hex characters become a number 0–9999 that's matched against the odds table, and the next chunk picks the card within that tier.

The server seed is revealed after use

Once a seed has been used, we publish the real value — hash it yourself to compare against what was announced, and recompute the roll right on this page.

One extra rule in the player's favor: if the rarity tier you rolled has no cards left in the machine, the result always rolls up to a higher tier, never down. And every pack contains one real card — there's no “nothing” outcome.

Verify a past pull

Copy the values from your pull history and recompute the result yourself.

The formula

seedHash = SHA256(serverSeed)

roll     = HMAC_SHA256(serverSeed, clientSeed + ":" + nonce)
rollBp   = parseInt(roll[0..8], 16) % 10000       // 0–9999
rarity   = first tier whose cumulative odds > rollBp
cardIdx  = parseInt(roll[8..16], 16) % (number of cards in that tier)