Provably Fair TCG Sites:
Which Ones You Can Actually Verify

Every pack site wears the label, so this list ranks provably fair Pokemon box sites on one question: when a roll decides between the chase card and the bulk slot, can you prove the number landed where the site says it did? Of 17 platforms we track, 9 have a game our tool reproduces. Among card sites, two clear it end to end, one gets you a verified number but not the card, and the rest publish odds or nothing.

CheckMyPull is not a pack site and never appears as an entry here. Each site is ranked only by whether its fairness claim verifies, using a verifier you run yourself.

What a card site owes you

On a plain number game, verifying the draw is the whole job. Card ripping adds a second half, and for a collector the second half is the one that stings when it is missing. The roll is a number; the pull is a card. A roll of, say, 96.31 either sits inside the chase card's published slice of the range or one notch outside it, and that notch is the difference between the alt art and the bulk box.

So a card site owes you two proofs. First, that the roll came from values committed before you clicked, which is the standard commit-and-reveal check. Second, that the roll maps to the card the site actually handed you, which requires the site to publish a range for every item in the box. Plenty of sites manage the first and skip the second. A site that publishes a formula but no ranges lets you confirm the number was honest while telling you nothing about whether that number owed you the Charizard.

The strongest card sites publish both. That is the bar this list applies.

The comparison at a glance

Three details decide whether a check succeeds, and a site can publish two of the three and still be impossible to reproduce:

How we ranked these

A site reaches the top tier when an implementation built only from its public materials reproduces a real outcome. Reading a fairness page does not qualify a site, and neither does an on-site verify button, because a button that grades the operator's own work proves nothing to an outsider. Within a tier, sites are listed alphabetically, and nothing else orders them.

Pull value, bonuses, shipping speed and star ratings all matter when you choose where to rip, and none of them moves a site between tiers. Mixing those judgements is how the label got reduced to a homepage badge in the first place. Once the tier is set, though, what a site stocks and how it treats a collector decide which verifiable option fits you, so each entry below covers both.

Fully verifiable: the two card sites you can check end to end

Both sites in this tier earned it the same way: an implementation built from public materials returns the operator's own numbers. Neither has yet been checked against a captured roll from a real purchase, which is the outstanding item for both.

Ripster.gg, if you are chasing one card

Ripster.gg covers Pokemon, One Piece, sports cards, and Disney Lorcana, with boxes from $1.91 to $562.47 when last read in September, and its shelves are built around what a collector is actually trying to do. Chasing one card takes you to Holy Grails. Filling a set takes you to By Set. A favourite character takes you to a Farm box. No other site on this page organises itself by intent, and for anyone who has scrolled a franchise-sorted shelf hunting one specific card, the difference is not cosmetic.

On the fairness side it publishes the complete scheme: an HMAC-SHA256 keyed with the server seed over clientSeed:nonce, the first 8 characters of the result converted to a roll from 0 to 100, with copy-paste verifier code and an in-browser check on its fairness page. Every item in a box carries a percentage range, so the roll-to-card half of the proof is checkable too. An independent implementation of the published method returns the same roll, 52.5587, as Ripster's own verifier.

Two caveats carry the same weight as that number. The match is code-level, not a captured roll from a live rip. And it is the one cross-check on this list that is not independent of the site being checked, because Ripster.gg is operated by the company that operates CheckMyPull. That is a fact about the evidence, not a footnote, and it is why the tier is shared rather than ranked. Ripster.gg is also a newer platform with a public track record still building; verifiability and reputation are separate things, and this list scores only the first. Check a real rip on the Ripster.gg verifier.

PackDraw, singles with a lottery on top

PackDraw runs Pokemon and sports card singles, with packs reaching $22,972.46 in September and a top-opens rail above the cards that on 14 October ran from a PSA 10 1st Edition Base Set Charizard at $545,000 to a 2027 Corvette ZR1X at $221,000, PackDraw's own valuations. What arrives from a pack is a specific, identified card, not a sealed gamble, and it pays out as a shipped item or an instant crypto withdrawal.

Its disclosure is the kind we rate highest: not a description of the method but the working JavaScript its site runs, hashing clientSeed:serverSeed:nonce with SHA-512 and reducing the digest to a ticket between 1 and 1,000,000. Runnable code beats a worked example, because an example proves one case and code reproduces every case. Running that published code independently reproduces our implementation ticket for ticket, including tickets 268,760 and 122,022.

The honest caveat is the mirror of its strength: PackDraw publishes no numbered worked example, so there is no known-good input and output pair to confirm an implementation against before trusting it. One practical detail catches people too: the commitment fingerprint runs 128 characters rather than the 64 most sites show, so save the whole thing. Your seeds sit in your account profile and pack purchase history, and because the reveal happens per purchase rather than on rotation, a rip from last month is still checkable today. See the PackDraw verifier.

JemLit, which changed shelves in 2026

The cleanest disclosure in this whole space used to belong to a site that sold the wrong things. JemLit publishes runnable code, per-item win ranges, and a numbered worked example: a set of seeds and the exact roll they produce, 22.0231, which reproduces exactly. A known input-and-output pair converts a description into a testable claim, and it remains the best single disclosure decision in the niche.

Until recently that praise came with a shrug, because JemLit sold phones and streetwear. Since September 2026 it also runs a Packs shelf of cards and sealed product, in its own words "packs filled with cards and sealed products whose value follows the market". On 14 October it held 15 packs: Pokemon Fossil at $7, Yu-Gi-Oh 25th Anniversary at $9.99, Pokemon Basic at $14.99, One Piece OP13 at $49.56, Charizard Madness at $58.24, Green Leaf at $105.87 and Rayquaza at $313.82 among them.

Here is the catch, and it is the reason JemLit stays a note rather than an entry. Its published algorithm covers its eBox rolls only. Re-read in September 2026, JemLit's fairness page documents one method, for boxes, and publishes nothing at all for Packs, Battles, Upgrader or Mining. So the shelf that sells cards is the shelf the worked example does not reach, and the site with the niche's best single disclosure has that disclosure pointed somewhere other than its newest product.

That is not a fairness accusation. It is a coverage gap, and a common one: modes get added faster than fairness pages get updated. But it means a JemLit card pack is not something you can currently check end to end, and this list ranks on exactly that. The wider provably fair mystery box sites ranking covers its goods catalogue and its box algorithm in full.

Boxed.gg: the full calculation, without the ranges

Boxed.gg is a cards-and-skins site; published reviews list six card games, among them Pokemon, Magic: The Gathering and Yu-Gi-Oh, with boxes running roughly $1.97 to $30.51 on its Gems currency (Deadspin). It also answers two questions collectors ask that no fairness page covers. An unwanted pull has a third exit: its Marketplace takes cards from your inventory as payment toward a specific graded slab Boxed.gg has listed, rather than only shipping them or selling them back. And its shipping is the kind a careful seller would use: reviewers describe cards arriving double-sleeved in a top loader and a bubble mailer, from 550 gems (about $5.50) within the US for up to 15 cards withdrawn together, to 22 countries and territories.

On fairness it publishes more of the machinery than most: a hashed server seed committed before you open, the real seed revealed every 24 hours, and a per-account salt joining the usual client seed and nonce, which is a fourth input almost nothing else here uses.

Re-read in September 2026, its published sandbox carries more than an earlier version of this page credited. It contains the full pipeline, not just the hashing stage: an HMAC-SHA512 over your client seed, salt and nonce run together without separators, then a conversion that reads the digest in five-character windows until it lands under a million. Checked against Boxed.gg's own sample values, the commitment check reproduces exactly. So the ticket number is reproducible, and this page previously said it was not.

Where it still stops is the mapping. The fairness material publishes no per-item ticket ranges, so nothing there connects your verified number to the card you received; reviewers report the ranges are viewable in-product under each drop table's More Info panel, which is a different thing from publishing them where a checker would look. One more wrinkle worth knowing before you try: the sandbox Boxed.gg links has not been updated since August 2024 and now fails to load at all.

So the position is: you can confirm the commitment held and recompute your ticket from the published code, and the fairness material does not show which range your card occupied. The parts that are public load in the Boxed.gg verifier, and our is Boxed.gg legit review covers its reviews and shipping record.

Described, but locked behind a login

Pullbox.gg is genuinely card-first, covering Pokemon, Magic, Lorcana, and One Piece, and its fairness section states the right shape: HMAC-SHA512 keyed with the server seed over your client seed, a salt and the nonce, a SHA-256 commitment shown on every box page, and rejection sampling onto the box's weighted item table, with Verify on every roll in your Box History. The byte order, the separators, and the rejection rule, the details that decide the answer, are not published on the page. Logged in, on its own site, the pieces are there. From outside, a formula nobody can read is not a published formula, and that distinction is what holds Pullbox below the verified tier.

Not provably fair: odds and checklists without proofs

Two card sites that surface in provably fair searches do not run a seed commitment at all, and that deserves saying plainly.

ArenaClub, the graded-slab pack site built around the sports card and Pokemon audience, publishes hit rates per tier and full checklists, which a set collector can genuinely use, and slabs sidestep the condition anxiety that hangs over raw singles. What it does not publish is any seed-commit system: no hashes, no seeds, no verification tool. Its randomness statement is a Fisher-Yates shuffle mentioned in a marketing blog post, and a shuffle can be perfectly sound, but with nothing committed and nothing revealed there is nothing for an outsider to recompute. That is a statement about what can be established from outside, not an accusation.

Packz.io sits in the same tier for a different reason. It launched in September 2025 selling third-party graded cards through digital packs, and it publishes detailed per-pack odds up front. Published odds tell you the stated chances before you buy. They do not let you prove a specific rip came from values locked in beforehand. Those are two different guarantees, and this list measures only the second.

The same logic applies anywhere: an odds table with no seeds behind it is a badge, not a proof.

Where the seeds live on each card site

The panel has a different name on every platform, and the revealed server seed almost never appears until something triggers it.

Rotation is the step that catches most people. On Ripster.gg, save the hashed value before you rip and rotate afterward, because the real server seed stays hidden until you retire it. PackDraw reveals per purchase, so there is nothing to trigger. Boxed.gg rotates on its own 24-hour clock, so there you wait rather than act.

How to check a card site result yourself

The verifier below runs entirely on your own device, so nothing you paste reaches us or the operator.

1. Before you rip, save the hashed server seed. This is the commitment.
2. Note your client seed and the play count for the pull you care about.
3. Trigger the reveal, or wait for it, depending on the site above.
4. Paste the values in. The verifier recomputes the outcome and checks the revealed seed against the fingerprint you saved.

You can test the tool before you spend anything. Ripster.gg's own published example, server seed testserverseed123, client seed testclientseed456, nonce 7, should produce the roll 52.5587; paste those in and watch it come out. And pick the right platform before checking a real rip: the formats above are not interchangeable, and a verifier fed the wrong seed order or slice length returns a plausible wrong number, our name for a result that convinces and is false. A failed check is far more often a format mismatch than evidence of anything improper.

One more thing before a cold session sends you here angry. On a card listed at 0.5%, there is a 60.6% chance of pulling none at all across 100 openings. Missing the chase card is what the published odds look like most of the time, and the variance checker will tell you whether your own history sits inside that range. If you are new to the inputs themselves, what is provably fair walks through the flow and what is a server seed covers the value that matters most.

What this list does not tell you

The bottom line

Among provably fair Pokemon box sites, two survive an actual check. Ripster.gg publishes its full method with per-card ranges and cross-checks at roll 52.5587, with the disclosure that its operator also operates this site. PackDraw publishes the running code that reproduces tickets 268,760 and 122,022, with no worked example to confirm against. Boxed.gg publishes the commitment and the full calculation, and keeps the per-item ranges off the page. Pullbox.gg describes its method without publishing the exact formula, and ArenaClub and Packz.io publish odds and checklists rather than proofs.

Whichever you use, do not take the label on trust. Save the commitment, rip something small, rotate, and watch one real result check out on your own device before you spend anything you would mind losing. If any part of this has stopped being fun, take a break and get support.