Every round on a conventional online slot rests on a chain of trust nobody outside it can inspect. The studio writes the number generator, a laboratory examines it under a confidentiality agreement, a licensing body files the certificate, and the symbols landing on your screen arrive carrying nothing you could check. Provably fair games swap one link in that chain for arithmetic you can run on your own machine. 7Bit Casino documents its version in full, worked example and real hash included, which makes it a useful specimen for explaining what the technique delivers and where it stops.
What follows is the published mechanism, the values a player ends up holding, the check a reader can run without specialist software, and the longer list of things a verified round still cannot tell you. That last part matters most.
The gap provably fair is built to close
Certified randomness is a historical claim. A test house samples billions of outputs, runs statistical batteries against them, and issues a document saying the generator behaved properly during that examination. The document covers the software; it does not cover your Tuesday evening. Nothing ties the certificate to the particular spin you just lost, and nothing in it is addressed to you.
That arrangement is normal and, with a competent regulator behind it, defensible. It falls apart in two situations. The first is when no laboratory is named, so there is nothing to look up. 7Bit’s terms state at clause 6.1 that the games use “certified Random Number Generators”, and across every page we captured on 20 October 2026 no test house is identified anywhere: not Gaming Laboratories International, not iTech Labs, not eCOGRA. The claim is made; the evidence for it is not produced. The second situation is when the licensing authority is far enough away that a complaint reaches nobody who can act on it, which is the structural position of any offshore casino serving Canada.
Provably fair attacks the problem from the other end. Rather than asking you to trust a generator, it hands you a receipt before the round and the underlying data afterwards, and invites you to confirm the two match. What you have to accept shrinks from “this company and its auditors are honest” to “this company cannot produce a second input that hashes to the same receipt”. The second claim is mathematical, and testable at your end.
Commitment and reveal, before any cryptography
Strip the hashing away and the idea is older than computers. A dealer writes the order of a shuffled deck on a card, seals it in an envelope, and lets you examine the flap. You name the cut. The hand is dealt, the envelope is opened, and if the writing inside matches both the deal and the cut you chose, nothing was rearranged once your money was down. The seal does that work and no more. It says nothing about whether the shuffle was a good one, or about the house edge in the game you agreed to play.
Digital commitment replaces the envelope with a one-way function. 7Bit uses SHA-256, the hash the United States National Institute of Standards and Technology publishes as part of the Secure Hash Standard. Feed it any string and it returns 256 bits, written as 64 hexadecimal characters. Two properties make it usable as a seal: you cannot work backwards from output to input, so publishing a fingerprint early gives nothing away, and finding a second input that produces the same 64 characters is computationally out of reach, so an operator is stuck with the string behind the one it published.
The order of operations is the whole mechanism. Fingerprint first. Stake second. Reveal third. Reverse any two and the exercise becomes theatre: a hash shown after the reels have stopped tells you only that the operator can run SHA-256, which was never in doubt.
How 7Bit assembles a round
7Bit’s own fairness page names three components. A server seed comes from the casino side. A client seed is generated through the player’s browser. A nonce increments with every subsequent bet, so one seed pair cannot quietly produce the same outcome twice.
For card games the published sequence runs as follows. The server generates a number it calls the Secret. A Fisher-Yates shuffle then produces the arrangement, which 7Bit calls the Result. Fisher-Yates, in the in-place form Richard Durstenfeld published in 1964, walks a list backwards from its last position, swapping each entry with one drawn from the positions at or before it; given a uniform source of numbers, every possible ordering comes out equally likely. That is why it is the standard shuffling choice rather than one of the ad hoc methods that quietly favour some arrangements. The numbers driving the swaps come from a Mersenne Twister generator, which gets its own section below.
The Result and the Secret are then concatenated and hashed. The resulting digest is the fingerprint 7Bit shows in the provably fair widget before the hand begins. In the operator’s words, a player sees “a ‘fingerprint’ of the shuffled deck and the Secret value”, created by hashing the data with SHA-256. Your own input arrives next: you name a position, the deck is cut there, and the hand plays out of the cut arrangement.
Where slots and card games part company
The committed object differs by game, and a reader expecting one explanation to cover the lobby will get confused at the widget.
In slots, 7Bit generates a reel model for each reel, described as a list of tiles in the order they appear. A stop position per reel is then drawn from the Mersenne Twister, and those stops constitute the Result. The player’s contribution is modest and specific: an option, in the operator’s phrasing, to add “an extra push to each reel by specifying a particular number from 1 to 9”. Open the widget and you see the fingerprint of the spin beside the random Secret.
In card games (Bitcoin poker, baccarat and blackjack are the examples 7Bit names) the committed object is a shuffled deck and your contribution is a cut position. The published instruction at the end of a hand is to compare four things, “the Result+Secret, the fingerprint/hash code, your chosen position/client seed, and the Final Result”, and the test is that they “should point to the same deck, with one version cut at the player’s chosen position”.
Roulette is described separately again: the wheel stop comes from the Mersenne Twister, the numbers are hashed with SHA-256, and a player may contribute by choosing a number from 0 to 36 or taking a randomly selected one. 7Bit’s own summary is blunt and worth keeping in mind: “Provably Fair algorithms vary from game to game.”
The values the widget leaves you holding
Whatever the game, the widget leaves you holding a small set of strings. Knowing what each is for turns an intimidating block of characters into a two-minute check.
| Value | When you get it | What you do with it |
|---|---|---|
| Hash of Result+Secret | Before the round, in the widget | Record it. This is the receipt you will compare everything against |
| Result+Secret | After the round | Hash it yourself and see whether the digest equals the receipt |
| Client seed | You supply it before the round | Your contribution: the cut position, reel push or wheel number |
| Final Result | After the round | The part you were paid on, which should be the committed arrangement cut at your seed |
| Nonce | Tracked per bet | Keeps rounds distinct, so an identical seed pair cannot repeat an outcome |
Only the first two rows are involved in the step a reader can perform unaided, and that step is the one carrying the proof.
The published example, line by line
7Bit prints a complete round on its provably fair page, which is unusual; most operators advertising the feature stop at a diagram. The values below are the operator’s own, taken from the page as captured on 20 October 2026. Nobody on this desk played the round.
The Result+Secret block is a JSON object. It opens with a symbols array holding twelve groups of five entries - ["man","j","beast","beast","j"] is the first - followed by "card":"JD", then "game":"AztecMagicDeluxe", and finally "secret":"4b344a85…", a 32-character hexadecimal value. The named game is a BGaming title, and 7Bit credits BGaming as the first developer to integrate provably fair solutions into its games.
The client seed is 82013. The published hash of Result+Secret begins 4b1bc790… and runs to the full 64 characters. The Final Result is a second, much shorter JSON object: three groups of five symbols and "card":"JC".
| Published value | What it is | What a reader does with it |
|---|---|---|
{"symbols":[…],"card":"JD","game":"AztecMagicDeluxe","secret":"4b344a85…"} | The committed reel data plus the server’s secret | Run SHA-256 over it, exactly as rendered |
4b1bc790… | The fingerprint published before the spin | Compare character by character with your own digest |
82013 | The client seed the player contributed | Confirm it is the number you entered, not one substituted later |
{"symbols":[…],"card":"JC"} | The three reel strips the round actually paid on | Check it sits inside the committed set at your seed’s position |
Three honest observations, because admiration on its own is not much use to a reader. First, the committed block holds twelve strips of symbols while the final one holds three, which tells you the commitment covers a larger arrangement than the round displays; the client seed decides which slice becomes your spin. Second, 7Bit does not publish the function that maps a client seed onto that slice, so a reader can independently verify the hash step and must take the slicing step on the operator’s arithmetic. Third, the slot description offers a push numbered from 1 to 9 while the example’s seed is the five-digit 82013, and the card field differs between the committed block and the final one without any explanation on the page. None of that makes the method dishonest. It does mean the strongest claim a player can make unaided is narrower than “I verified my spin”.
Checking a round for yourself
The practical routine has five steps, and the first one is the one people skip.
- Capture the fingerprint before you stake anything. Open the widget, copy the pre-round hash into a note, or screenshot it. A receipt you only see after the reels stop is not a receipt.
- Play the round. The committed data stays sealed until it ends.
- Copy the revealed Result+Secret exactly. Braces, quotation marks, commas, the lot. Do not retype it: a single added space changes the digest completely, and that is how hashing behaves rather than a glitch.
- Hash the string with SHA-256. Any correct implementation returns the same 64 characters, because the algorithm is a published standard rather than a 7Bit product. A command-line utility, a browser console, an offline page saved to your own machine and the casino’s own widget all agree, which is precisely the point of using a standard. Prefer something local over pasting data into an unfamiliar website.
- Compare, then look at the outcome. Match your digest against the recorded fingerprint, whole string if you can and at minimum the leading and trailing eight characters. Then confirm the Final Result is the committed arrangement taken at the seed you supplied.
That is the whole exercise. It needs no account, no fee, and no cooperation from the operator beyond what it already publishes. It is also why the technique is worth understanding even if you never use it: an operator publishing a method like this has put itself where one provable mismatch would be reproducible on any machine. The same preference for checkable material runs through the way this desk builds its ratings, where published figures get quoted and unpublished ones are left blank.
What a mismatch would mean
Suppose the digests differ. Eliminate the mundane causes in order. A stray character or a trimmed line break in the copied string is the overwhelming favourite. Next is a mismatched pairing: the fingerprint you saved belongs to a different round or nonce, easy to do when several spins run quickly. Third is encoding, if the string passed through a document that rewrote its quotation marks.
If none of that explains it, what you hold is unusually strong for a casino dispute: a specific, dated, reproducible claim that the data revealed after a round is not the data committed before it. Every other complaint a player brings, whether a slow payout, a voided bonus or an account closed mid-review, lands in a he-said-she-said about terms. This one does not. It would go first to the operator’s own complaints channel, and 7Bit allows a six-month window for raising one, then into the licensing chain, which is where the limits of an offshore address start to bite. Our breakdown of the Curaçao licence sets out what that chain does and does not offer a player in Canada.
What the method genuinely establishes
Here is the honest accounting. The left column is the claim; the right is whether a verified round supports it.
| Claim | Supported? | Reason |
|---|---|---|
| The outcome existed before my money was committed | Yes | The fingerprint was published first and cannot be read backwards |
| Nobody swapped the outcome once my stake was in | Yes | Producing a second string with the same digest is not feasible |
| I influenced the round | Partly | Your seed selects the cut, but you never see the arrangement first |
| The arrangement was uniformly randomized | Not proven | That depends on the generator and the code behind it, neither of which is open |
| The game returns a reasonable share of stakes | No | The pay table sits entirely outside the commitment |
| The rest of the lobby is covered | No | Only titles inside the widget participate |
| The casino will pay me what I win | No | Solvency, terms, verification and licensing are separate questions |
Read the first two rows and the technique looks impressive, because it is. Read the remaining five and its scale becomes clear: this is a guarantee about immutability, not about generosity, uniformity, coverage or payment.
The generator question, stated carefully
A commitment scheme is only as useful as the randomness it commits to. Seal a tamper-evident envelope around a predictable shuffle and the seal will not tell you anything is wrong.
Mersenne Twister, published by Makoto Matsumoto and Takuji Nishimura in 1998, is fast, has an enormous period and good equidistribution properties, and passes the standard statistical batteries gambling laboratories lean on. Several programming languages adopted it as their default pseudo-random source for those reasons. It is not, however, a cryptographically secure generator, and its own documentation says so: the widely used variant keeps 624 words of internal state, and that state can in principle be reconstructed by an observer who collects a run of consecutive raw outputs, after which future outputs follow deterministically.
Two qualifications keep that from being an accusation. A player never observes raw generator output, only symbols filtered through a reel model and a pay table, which is a long way from a clean stream of 32-bit integers. And the server secret stands between an outsider and the committed string: 32 hexadecimal characters, as in the published example, carry roughly 128 bits, far beyond guessing. The secret is not decoration.
What we cannot tell you is which variant 7Bit runs, how it is seeded, or how often it is reseeded, because none of that is published. Other published commitment schemes avoid the question by deriving outcomes from an HMAC built on SHA-256 itself, so the generator is a cryptographic primitive rather than a statistical one. 7Bit names Mersenne Twister. That is a design choice made by the studio, documented openly, and it is the correct thing for a reader to know about rather than a scandal.
Verifiable and generous are unrelated properties
This is the misunderstanding that does real damage. A verified round confirms the arrangement was sealed before your bet. It says nothing whatsoever about how much that arrangement pays when it lands.
Return to player is a property of the reel strips and the pay table, both set by the studio and both committed to faithfully. A game can seal every spin beyond reproach and still hold back twelve per cent of turnover rather than four. Verification would succeed on every round; the player would simply lose faster. Take two verifiable slots, one returning 96 per cent and one 88: across C$40 of stakes at a dollar a spin that gap vanishes into variance, and across a year of weekly sessions it separates an expensive hobby from a steadily emptied chequing account.
For the reader’s purposes the gap is wider still, because 7Bit publishes no return figure at all, for any game or category, and no theoretical range. That absence is noted rather than filled in. A verifiable spin on a game whose return is undisclosed gives you certainty about the mechanics of one round and nothing about the economics of a thousand.
How much of the lobby this covers
7Bit advertises over 10,000 games from roughly a hundred studios. The widget reaches a small, named corner of that: slots, dice, roulette and card games in its own crypto-facing set, BGaming titles prominent among them. The great majority of the lobby comes from third-party studios running conventional generators under the unsupported certification claim in clause 6.1.
Live dealer sits outside the method entirely, and necessarily so. There is no hash to publish over a physical shoe or a real wheel; the assurance there is a camera, a floor supervisor and whatever the licence requires. For a Canadian player the live floor is narrower again, because the terms record that Evolution, NetEnt and Red Tiger content is blocked for Canadian addresses at the studios’ insistence. Our walk through what the catalogue actually opens from Canada counts what is left.
The realistic scope, then: individual rounds can be verified on a minority of the games, nothing can be verified on the majority, and no named auditor backs either group. That is messier than either “7Bit is provably fair” or “provably fair is marketing”, and both summaries are circulating.
Four ways a casino can assure you, compared
Provably fair is one mechanism among several, and they assure different things on behalf of different parties.
| Mechanism | What it assures | Who stands behind it | What it never reaches |
|---|---|---|---|
| Provably fair widget | One round was sealed before the bet | The operator, through a method it publishes | Pay tables, returns, non-widget games, your payout |
| Named test-house certification | The generator and pay table met a published standard | An accredited laboratory such as GLI, iTech Labs or eCOGRA | Your individual round; a certificate may predate the current build |
| A regulator’s own testing requirement | Compliance is a licence condition, with a complaints route | The licensing authority, which can act on breaches | As far as that authority’s reach and appetite extend |
| No disclosure at all | Nothing | Nobody | Everything |
7Bit occupies the first row properly and the third weakly. Its licence from the Curaçao Gaming Authority, numbered OGL/2023/147/0081, is genuine, and the footer identifies the licensee without the layered sub-licence arrangements common in that jurisdiction. What the regime does not give a Canadian is a body within reach that will take up an individual case, which is the difference between a licence that exists and one that helps.
The second row is the one 7Bit leaves unfilled. Asserting certification without naming the certifier is the easiest gap here for an operator to close, and it stays open.
Who should care about this, and who should not
Being straight about it: for most players, an audited generator plus a regulator you can actually complain to is worth more than the ability to verify a spin. Disputes almost never turn on whether a round was rigged. They turn on a withheld payout, a voided bonus, an account frozen halfway through verification. No commitment scheme touches any of those, and a regulator that answers the phone touches all of them. In Ontario, where registered operators sit under iGaming Ontario and the province’s Alcohol and Gaming Commission, a player has that route by default; the comparison between the registered market and an offshore licence works through the duties each one imposes.
Provably fair earns its keep in exactly the circumstance where that route is missing, which is the offshore position in every province without a registered market of its own. If the only authority behind a casino is thousands of kilometres away and reachable by email, a check you can run yourself is one of very few assurances left that depends on nobody’s goodwill. A thin layer, but a real one.
The readers who should pay attention are a narrower group than the marketing suggests: players staking meaningfully on card games where a shuffle dispute is plausible, anyone who wants a dated record of a contested hand, and readers who want to know which of a casino’s claims can be tested rather than taken on faith. For everyone else, spend the attention on terms instead - the wagering conditions, the withdrawal ceilings, the clause that puts a turnover condition on every deposit before a payout, because that is where money is won and lost. Our full assessment of the operator works through those clause by clause, including the ones provably fair has no bearing on.
Frequently asked questions
Does a provably fair game pay better than a certified one?
No. Verification covers the sealing of a round, not the return built into it. A provably fair slot and a laboratory-certified slot can hold back identical shares of turnover, or wildly different ones, and the hash will not reveal which.
Can a round be checked after the game window is closed?
Only if you kept the values. The decisive one is the pre-round fingerprint, and reopening a game later does not reconstruct what you were shown before you staked. Copy it at the time or the check is unavailable afterwards.
Is SHA-256 likely to be broken?
No practical collision attack on SHA-256 is known, and it remains the hash specified in the United States federal Secure Hash Standard. Treat it as sound for this purpose, while noting that commitment schemes are expected to migrate as standards evolve.
Why does the casino keep a secret value at all?
Because a hash of the outcome alone could be attacked by guesswork. With a limited set of possible reel arrangements, an outsider could hash each candidate and read the committed one. An unguessable secret concatenated with the outcome makes that search hopeless.
Is Mersenne Twister suitable for gambling outcomes?
It is a well-tested statistical generator, not a cryptographic one, and its documentation is explicit about that. In this design the server secret carries the unpredictability. 7Bit does not publish its variant or its seeding, so this describes the named algorithm rather than their build.
Do I need special software to check a hash?
No. Any correct SHA-256 implementation produces the same output, which is the property that makes independent checking possible. A command-line tool or an offline page on your own device is preferable to pasting game data into a site you do not control.
Are live dealer tables provably fair?
They cannot be. A physical shoe and a real wheel produce no string to commit to in advance, so the assurance there rests on camera coverage, dealer procedure and licence conditions. Anything described as provably fair is software-dealt.
What if an operator will not show the fingerprint before a round?
Then the feature is decorative. A hash produced after the reels stop demonstrates nothing more than an ability to compute one. The published order of fingerprint, then stake, then reveal is the part doing the work, and an implementation that reverses it proves nothing.
Which is worth more, verification or a reachable regulator?
A reachable regulator, for most readers. Verification answers a question that rarely causes disputes, while a licensing body with authority over payouts and account closures answers the questions that do. Verification matters most precisely where no such body is in reach.
Sources
- 7Bit Casino, Provably Fair Games. The operator’s published method, read 20 October 2026: the server seed, client seed and nonce components, the separate descriptions for slots, roulette and card games, and the complete worked round quoted above, hash and all.
- 7Bit Casino terms and conditions. Clause 6.1 carries the “certified Random Number Generators” wording; clause 4.3 records the studio-level block imposed on Evolution Group titles for Canadian addresses.
- FIPS 180-4, Secure Hash Standard. The specification defining SHA-256, its 256-bit digest and the security properties a commitment scheme leans on.
- Matsumoto and Nishimura, Mersenne Twister (1998). The original description of the generator, its period and its equidistribution, and the basis for treating it as statistically strong but cryptographically unsuitable.
- Durstenfeld, Algorithm 235: Random Permutation (1964). The in-place shuffling procedure now known as Fisher-Yates, and the source of the guarantee that every ordering is equally likely given uniform inputs.
- Alcohol and Gaming Commission of Ontario. The registrar’s standards for internet gaming, covering what a regulated Canadian market demands on game integrity and independent testing.