Verify a pull

Your cards come from a secret number we pick before you buy. We show you a fingerprint of it up front — enough to prove we had it, not enough to work it out. Your own seed is mixed in, so neither side chooses the result alone.

Whenever you like, rotate your seed. That retires the secret number and shows it to you, and you can then replay any pack you opened with it. Same cards means the outcome was settled before you paid.

Replay a pack

Revealed server seedPublished commitment hashClient seedWhich pack (the first one you opened is 0)Pack

The algorithm

bytes  = HMAC_SHA256(serverSeed, `${clientSeed}:${nonce}:${cursor}`)
float  = Σ  bytes[i] / 256^(i+1)     for i in 0..3

Each 4-byte window yields one float in [0,1). Floats are consumed in
order: two per card slot (tier, then which card), remainder reserved
for the value-floor top-up.

This is a standard, published commit-reveal construction rather than anything we invented, so an independent verifier written for that scheme checks our outputs unmodified. You do not have to trust this page — you can compute the result yourself.