Stake Server Seed Rotation: The Paranoid Player's Ritual

Published 2026-04-05 · Tags: guides, verifier, fundamentals

The server seed is where Stake's honesty is cryptographically locked in. When to rotate, how to verify, and the specific patterns that maximize protection.

The server seed is the most important cryptographic primitive in Stake's provably-fair system. Rotating it at the right time is the difference between "verified clean session" and "trust the casino." This post is everything you need to know about server seeds on Stake, what they are, when to rotate, how to verify the old one, and the specific rotation patterns that maximize your protection.

What a server seed is

The server seed is a secret random string Stake generates for you that's used as the secret key input to HMAC-SHA256 for every bet in your session. Combined with your client seed and a nonce (a counter), it produces the cryptographic output that determines your bet's outcome.

Before any bet is placed, Stake gives you the SHA-256 hash of the server seed, not the seed itself. You can't reverse the hash to get the seed, but you can verify any seed reveal matches the original hash.

This is the cryptographic commitment that makes provably fair work. See our how provably fair works post for the full explanation.

Why the hash-first commitment matters

Here's the cheating attempt that hash-first prevents:

Without the commitment: Stake could look at what you bet (say, roll under 50 on Dice), then choose a server seed that produces an adverse outcome (roll 67 for you → you lose). If the seed was chosen AFTER you bet, they could pick any seed.

With the hash commitment (how Stake actually works): Stake chose the seed and showed you the hash before you bet. Now they're locked in — they can't change the seed without breaking the hash.

When you rotate and reveal the old seed, you can SHA-256 it yourself and confirm it matches the pre-bet hash. If it does, the commitment was honest.

The three reasons to rotate

1. End a session cleanly

Rotating forces Stake to reveal the server seed you've been using, which lets you verify every bet in that session. Before rotation, you have only the hash, you can't check anything yet.

2. Guard against leakage

If your server seed somehow leaks (your client logs it, your browser is compromised, Stake's systems get breached), an attacker could see all your future bet outcomes before you place them. Rotating invalidates the old seed.

Realistically, server seed leakage is extremely rare, the seed lives only between Stake's server and your browser memory. But rotation is free insurance.

3. Audit a suspicious session

If a session felt terrible, rotating reveals the seed so you can plug it into our Stake Verifier and confirm every bet was computed correctly. If all match: bad variance. If any mismatch: actual problem (has never been caught in practice).

When to rotate: the specific playbook

Rotate every 1,000 bets maximum. This is the engineering-strength recommendation — the longer you go without rotating, the more outcomes depend on a single commitment.

Rotate after any "was that fair?" feeling. The 60-second verify is trivial compared to months of doubt.

Rotate when you step away from the machine. Especially on mobile, coming back to a session after hours feels like a new session anyway; start fresh.

Rotate before a large bet. Purely paranoid, but if you're about to bet $1,000 on a single Dice roll, do so with a fresh commitment so the seed is definitely not "stale" or cached anywhere.

Rotate after you get KYC'd or change any account settings. Not strictly necessary but hygienic, clean slate.

How to actually rotate on Stake

1. Open any Originals game (Dice, Limbo, Crash, Mines, etc.)
2. Click the seed info icon (usually a small cog or "Provably Fair" tab near the game controls)
3. You'll see:

• Server seed hash — the commitment for the current server seed
• Client seed, your (changeable) string
• Nonce, the counter

4. Click "Rotate Server Seed" (or "New Seed" / "Change Server Seed")
5. The old seed is revealed to you — copy it
6. The hash of a new seed appears
7. Your nonce resets to 0

The old server seed is now revealed and useless for future bets, Stake has generated a new secret seed whose hash is shown to you.

How to verify the rotation

The moment of truth: did Stake deliver the seed they committed to?

1. Take the revealed server seed
2. Hash it with SHA-256 (browsers have crypto.subtle.digest("SHA-256",...))
3. Compare the result to the hash Stake originally showed you at session start

Our Stake Verifier does this automatically, paste the revealed seed and the original hash, it tells you if they match.

They will always match. If they don't, you've caught Stake in a cheat, and that's worth a fortune (nobody has ever caught one). But the verification is free and takes 10 seconds, so do it.

Rotating + verifying every bet

Once you have the revealed server seed, you can verify every bet that used it:

1. Take the revealed server seed
2. Take your client seed (unchanged during the session unless you changed it)
3. Take the nonce range (0 to N where N is the total bet count)
4. For each nonce, compute HMAC-SHA256 (server_seed, "client_seed:nonce")
5. Apply the game's math to get the predicted outcome
6. Compare to what Stake paid you

Manually: tedious for 1,000 bets. With our Stake Verifier: you paste in the three values and it computes every outcome in the nonce range, letting you filter and scan.

If you're using the Deep Dive feature, you can even scan for specific multipliers: "find every nonce from 0 to 1,000 where a 10× hit on Limbo would have fired." Useful for "I almost hit X" analysis.

The client seed's role

The server seed is secret. The client seed is yours. It's visible, you can change it, and you can't cheat with it (the game still picks random outcomes based on the HMAC-SHA256 input).

Many players change their client seed for psychological reasons (feeling like fresh luck). That's fine, though the math doesn't care. The more important thing is the server seed, which is where the provably fair commitment lives.

See our client seed post for the deeper dive.

The nonce thing

Each bet in a server-seed session increments the nonce by 1. Starting at 0, going up 0, 1, 2, 3,...

The nonce is public (visible in the bet info). This allows anyone to verify any bet — just feed the server seed, your client seed, and the nonce to HMAC-SHA256.

Why this is important: Stake can't skip nonces. If you placed 500 bets, nonce 0 through 499 must all exist and be verifiable. If Stake skipped nonce 237 (say, to "filter out" a big win they didn't want to pay), it would be caught on verification.

Rotating more often than needed

Is it possible to rotate too often? Not really. The mild downside:

• Small UI overhead (3 clicks to rotate)
• Slight latency (Stake's backend takes ~200ms to generate a new seed)

No cryptographic downside. You're always more secure with fresh commitments.

The tradeoff is convenience vs paranoia. Once per session is the default; once per 1,000 bets is paranoid; after each bet is overkill but not wrong.

What rotation doesn't protect against

• Front-running your bets, not possible with provably fair, addressed by the hash commitment
• The house edge, rotation doesn't change the math; you still lose 1% of volume in expectation
• Luck variance — rotation is about fairness, not outcomes; a bad streak on a rotated seed is just bad variance
• Seed leaking during the session, if somehow someone else has your server seed during active use, rotation ends their advantage immediately but doesn't recover lost bets

A simulation experiment you can do

If you're a skeptic, try this:

1. Play 1,000 Dice bets on Stake
2. Record every server seed hash, client seed, and nonce range
3. After each session, rotate and reveal
4. Feed into our Stake Verifier
5. Confirm every single bet's HMAC-SHA256 produces exactly the outcome Stake paid you

Expected result: 100% match across thousands of bets. This has been done millions of times across Stake's user base. Zero mismatches ever documented.

If you ever find one: you've proven Stake cheats (has not happened), and you have evidence for a regulatory complaint + a viral social media moment. The verification is free, and the finding would be worth a lot.

Summing up

The server seed is where Stake's honesty is cryptographically locked in. Rotating it converts "trust" into "verified." Do it at session end, after any suspicious moment, every 1,000 bets, or any time you remember. Verification takes 60 seconds with our Stake Verifier and costs nothing. In 10 years of provably fair, no cheat has been caught, but the verification being available is what makes cheating impossible.

Verify your revealed server seed right now. Open the Stake Verifier →