"Trust us, it's random" is the weakest sentence on the internet. Provable fairness replaces it with something better: a mathematical construction that lets anyone, with no special access, confirm that an outcome was fixed before it mattered and that the operator could not have changed it. This guide explains the standard construction, then walks through Bustabid's implementation of it as a concrete worked example.
What problem is being solved?
In any game where a server generates outcomes, the server has two obvious ways to cheat: pick the outcome after seeing what players do, or pick outcomes in advance but reorder them opportunistically. Provable fairness closes both doors with one tool: the commitment. The operator publishes a fingerprint of every future outcome before the first round runs. After each round, the outcome is revealed and anyone can check it against the fingerprint.
What is a hash chain?
A cryptographic hash function like SHA-256 turns any input into a fixed-size digest, and it is one-way: from the digest you cannot recover the input. A hash chain exploits this. You generate one random seed, hash it, hash the result, and repeat millions of times:
hash[i] = sha256(hash[i + 1]) seed -> hash[9,999,999] -> ... -> hash[2] -> hash[1] -> hash[0]
The final digest, hash[0], is the commitment. Publish it, then consume the chain in reverse: round 1 reveals hash[1], round 2 reveals hash[2], and so on. Each reveal is checkable in one line: sha256 of the newly revealed hash must equal the previously revealed one. The one-way property means the operator could not have computed the chain backward from a chosen commitment, and the chain structure means outcomes cannot be skipped or reordered without the very next verification failing.
Why is the salt chosen after the commitment?
A chain alone has a loophole: an operator could generate thousands of candidate chains, inspect the outcomes each would produce, and commit to the one it likes best. The fix is elegant. After the commitment is public, mix in a salt that nobody could have predicted, typically a Bitcoin block hash from a block mined after the commitment date. The outcome of each round is then derived from both values:
roundHash = HMAC-SHA256(chainHash, publicSalt)
Because the salt did not exist when the chain was built, cherry picking a chain buys nothing: the operator could not have known what any chain would produce once salted. Commitment first, salt second. The order is the whole trick.
How does Bustabid implement this?
Bustabid runs the textbook construction at full scale:
- Before launch we generated a chain of 10 million SHA-256 hashes and published the terminal commitment in the footer of every page on this site, before round 1 ever ran.
- The public salt is the hash of the first Bitcoin block mined after the commitment was published, so the salt is anchored to a public timeline nobody controls and we could not have chosen the chain with knowledge of it.
- Round n consumes hash[n]. When the round busts, its chain hash is revealed, the round hash is computed as HMAC-SHA256 of the chain hash and the salt, and the first 32 bits of that round hash determine the bust multiplier through a fixed public formula (the formula and its consequences get their own treatment in the house edge math guide).
How do you verify a round yourself?
Every settled round in the round history links to a verification page at /verify/[roundId]. That page recomputes everything in your browser: it hashes the revealed value to confirm it links to the previous round's reveal, applies the HMAC with the public salt, extracts the 32 bits, and derives the bust point, then compares it to what the round actually did. No server round trip is involved in the check, so there is nothing for us to fake at verification time. If you prefer not to trust our JavaScript either, the scheme is simple enough to reimplement in a few lines of any language with a SHA-256 library.
What does this prove, and what does it not?
Provable fairness proves the bust points were fixed before launch and cannot be chosen or reordered per round. It does not prove the distribution is generous; the distribution is public math and you can read exactly how it behaves. On Bustabid the stakes of that distinction are unusually low, because chance never touches what you paid for: an entry buys leaderboard placement that holds at face value in every outcome, and the multiplier only adds a bonus to a non-cash score. Fairness here protects the drama, not a payout, because there is no payout. Watch it hold up round after round on the live board.