Trading card pack sites have taken the "provably fair" label straight from the wider mystery box world, and it now sits on the front page of almost every Pokemon, One Piece, and sports card ripping site. This list ranks provably fair Pokemon box sites on one question: can you take a real result and confirm it from the site's own published inputs? Not pull value, not bonuses. Of the 17 platforms we track, 9 pass and 8 do not.
CheckMyPull is not a pack site and never appears as an entry here. Each site is ranked only by whether its fairness claim verifies, using a verifier you run yourself.
The comparison at a glance
| # | Site | TCG focus | Algorithm | Seeds exposed | Verifiable? |
|---|---|---|---|---|---|
| 1 | Ripster.gg | Pokemon, One Piece, Disney Lorcana, sports cards | Full method + code | Yes | Yes |
| 2 | PackDraw | Sports cards, Pokemon | Full method | Yes, in-account | Partial, unconfirmed |
| 3 | Boxed.gg | Pokemon, Magic, Yu-Gi-Oh | Partial, one step off-page | Yes, after 24h | Partial |
| 4 | Pullbox.gg | Pokemon, Magic, Lorcana, One Piece | States scheme | Login-gated only | No, outside tool |
| 5 | ArenaClub | Sports cards, Pokemon | Not published | No | No |
| 6 | Packz.io | Sports cards, Pokemon | Not published | No | No |
How we ranked these
What verifiable means on this list
A site reaches the top tier when its published algorithm is complete enough that an implementation built only from public materials reproduces a real outcome. Reading a fairness page does not qualify a site. Neither does an on-site verify button, because a button that grades the operator's own work proves nothing to an outsider.
That standard is stricter than it sounds. Three details decide whether a check succeeds: the hash function, the exact string being hashed including its separators and ordering, and the conversion from digest to outcome. A site can publish two of the three and still be impossible to check.
| Site | Hash it publishes | Exact string hashed | Outcome |
|---|---|---|---|
| Ripster.gg | HMAC-SHA256 | clientSeed:nonce | Roll, 0 to 100 |
| PackDraw | SHA-512 | clientSeed:serverSeed:nonce | Ticket, 1 to 1,000,000 |
| Boxed.gg | HMAC-SHA512 | Client seed, salt and nonce, no separators | Ticket, 0 to 999,999 |
| Pullbox.gg | HMAC-SHA512, stated only | Not published, behind a login | Not published |
| ArenaClub | None published | None | Not applicable |
| Packz.io | None published | None | Not applicable |
What the ranking deliberately ignores
Pull value, deposit bonuses, shipping speed and star ratings are all worth weighing and none of them move a site between tiers. A card site can be generous and unverifiable, or verifiable and disappointing, and mixing the two judgements is exactly how "provably fair" got reduced to a badge on a homepage. Once the tier is set, what a site actually stocks decides which verifiable option fits you, so each entry below covers both.
Why the card mapping matters more here
On a plain number game, verifying the draw is the whole job: reproduce the roll and you are done. Card ripping adds a second step that matters just as much, because the number has to land on a specific card. The strongest card sites publish per-item ranges, so a roll of, say, 96.31 out of 100 maps to a defined slice of the range that belongs to one card and no other. That two-part check, the roll is honest and the card it produced was the correct one for that number, is what separates a site you can fully verify from one where you can only confirm half the process.
This is also where trading card sites can be checked more thoroughly than most number games, and where a published odds table alone falls short. An odds table tells you a chase card is a 0.5 percent hit before you buy. A per-item range plus exposed seeds lets you prove, after the fact, that your specific pull fell inside or outside that card's slice exactly as claimed. Ripster.gg and Boxed.gg both publish those ranges, which is a large part of why they rank where they do. When a site shows odds but no ranges and no seeds, you are back to trusting the number, which is the thing provably fair is supposed to remove.
Fully verifiable: you can reproduce a real result
Ripster.gg and PackDraw are the card sites where the "provably fair" label survives an actual check.
Ripster.gg
Ripster.gg is the clearest example on the trading card side, and it is the strongest verifiable option aimed squarely at the TCG crowd, covering Pokemon, One Piece, sports cards, and Disney Lorcana. Its boxes run from $2.02 up to $623.69, arranged by collecting intent rather than by brand: chasing one card takes you to its Holy Grails shelf, filling a set to By Set, and a favourite character to a Farm box. Its fairness page publishes the complete scheme with copy-paste verifier code and its own in-browser check, and each item in a box carries a percentage range so you can map the roll to the card. Running the published method against Ripster's own verifier produces the same roll, 52.5587, so the draw is reproducible in the strict sense.
One note: Ripster.gg is a newer platform, so its public review history is still building the way it does for any site early on. Verifiability and reputation are separate things, and this list scores only the first. On that measure it qualifies, and you can load it in the Ripster.gg verifier and check a real rip yourself.
PackDraw
PackDraw mixes Pokemon and sports card singles with a luxury tier no other card site here carries, packs running $1.00 to $15.00 and a top rail reaching watches and supercars, paid out as a shipped item or an instant crypto withdrawal. On fairness it publishes something rarer than a description of its method: the working code its site runs, hashing to a ticket between 1 and 1,000,000. One practical detail: the commitment fingerprint you save before buying runs 128 characters rather than the 64 most sites show, so save the whole thing.
Running that published code independently reproduces our own implementation ticket for ticket, including tickets 268,760 and 122,022, which is why it sits in this tier rather than below it. The honest caveat: PackDraw publishes no numbered worked example, so a real pack's revealed seeds would still strengthen this from a code-level match to a full end-to-end confirmation. Your seeds sit in your account profile and pack purchase history.
A note on JemLit
If you want the single cleanest verified method anywhere in this space, JemLit publishes runnable code, per-item win ranges and a numbered worked example, and reproduces its published roll of 22.0231 exactly. Its catalog is general merchandise rather than trading cards, so it sits outside the card focus of this list. The wider provably fair mystery box sites ranking covers it in full.
Verifiable, with a catch
Boxed.gg gives you almost everything, but one step is not yet public.
Boxed.gg
Boxed.gg is the most established trading card focused option here, covering Pokemon, Magic: The Gathering, and Yu-Gi-Oh, and it is the site most Pokemon rippers will reach for first. Its boxes run roughly $1.97 to $30.51 on its Gems currency, pulls can be traded on its marketplace for a specific graded card rather than only shipped or sold back, and physical shipping covers the US, Canada and the UK. Its help center documents the fairness inputs (a client seed, a server seed shown hashed before you open and revealed every 24 hours, a per-account nonce, and a permanent account salt), states that each open produces a number between 0 and 999,999 that maps to per-item ranges, and every box shows a drop table with a "provably fair range" for each card. The one catch is that the exact step turning the hash into that ticket number is not printed on the fairness page itself. The published sandbox code shows the HMAC-SHA512 stage but stops before the hex-to-ticket conversion, so a full independent check is possible but takes an extra hop off the page. You can still load a real Boxed.gg result in the Boxed.gg verifier and check the parts that are public.
Publishes a system you cannot fully check yet
Pullbox.gg
Pullbox.gg sits one notch below. It is a genuinely card-first site, covering Pokemon, Magic, Lorcana, and One Piece, and its fairness page states it uses HMAC-SHA512 over the server seed, client seed, salt, and nonce, converted into a number across the box's total weight, with an on-site verifier. The problem for an outside check is that the exact order, separators, and conversion live in a verification snippet that only opens from the login-gated Verify button, so an independent tool cannot reproduce a Pullbox result without an account. On its own site, logged in, the seeds and the built-in verifier are there; from the outside, the method is described but not fully reproducible today. That is a real distinction, and it is why Pullbox lands here rather than in the verified tier.
Not provably fair: publishes odds, not proofs
Two card sites that show up in "provably fair" searches do not actually run a seed-commit system, and that deserves saying plainly.
ArenaClub
ArenaClub, the graded-slab pack site co-founded around the sports card and Pokemon audience, does not publish a provably fair algorithm at all. There is no seed-commit page, no exposed server or client seed, and no verification tool. Its public randomness statement is that packs use a Fisher-Yates shuffle to order the cards, and it publishes hit rates per tier along with full checklists. A Fisher-Yates shuffle can be a perfectly reasonable way to randomize, but without committed seeds and a revealed value there is nothing for an outsider to recompute, so the claim cannot be independently verified the way a seed-commit result can. This is not an accusation, just a statement of what the check can and cannot reach.
Packz.io
Packz.io is in the same category for a different reason. It is a legitimate digital pack site that launched in September 2025 and sells third-party graded cards, and it publishes detailed per-pack pull odds up front, which is genuinely useful. But it is a direct digital pack platform with no seed-commit or hash layer, so there is no cryptographic result to reproduce. Published odds tell you the stated chances before you buy; they do not let you prove a specific rip was generated from values locked in beforehand. Those are two different guarantees, and only the second is what this list measures.
How to check any of these yourself
The three values you need
Wherever a site exposes seeds, the check is the same, and you can run it right here. The verifier below runs entirely on your own device.
- Before you rip, save the hashed server seed. This is the commitment.
- Note your client seed and the play count for the pull you care about.
- Rotate your seed so the site reveals the real server seed.
- Paste the values into the verifier. It recomputes the outcome and confirms the revealed seed matches the hash you saved.
Step 1Where did you play?
Using Ripster box / upgrade: HMAC-SHA256 over clientSeed:noncedetails
HMAC-SHA256 keyed with the server seed over clientSeed:nonce. The first 8 hex characters become a 32-bit integer, divided by 2^32 and multiplied by 100 for a roll in [0, 100). Items are sorted by item ID and selected by cumulative probability: the first item whose cumulative probability is at least the roll wins.
Where to find your numbers on Ripster.gg:
- Before rolling, copy the Server Seed Hash from the Provably Fair modal (also recorded per roll in Account History).
- After the roll, open the Provably Fair modal to copy the Server Seed, Client Seed and Nonce.
- Change your Client Seed anytime in Account Settings; doing so reveals the current Server Seed so all past rolls become verifiable.
Source: Ripster.gg's own fairness page
Step 2Paste your numbers
Runs entirely on your device via your browser's built-in cryptography. Don't take our word for it: open DevTools → Network, click the button, and watch: zero requests.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Where the seeds live on each card site
The panel has a different name on every platform, and the revealed server seed almost never appears until something triggers it.
| Site | Where the commitment sits | How the real seed is revealed |
|---|---|---|
| Ripster.gg | Provably Fair modal, before you roll | The same modal afterward. Changing your client seed in Account Settings reveals it for every past roll |
| PackDraw | Your account profile, before purchase | Exposed once the purchase completes. Per-open seeds are in your pack purchase history |
| Boxed.gg | Shown hashed before you open, via the provably fair button on the box page | Revealed every 24 hours. Per-item ranges are under More Info on the drop table |
Rotation is the step almost everyone misses. Save the hashed value before you rip and rotate afterward, because on most sites the real server seed stays hidden until you retire it. Boxed.gg is the exception, rotating on a 24-hour schedule rather than on demand, so there you wait rather than act.
If you are new to what these inputs are, the what is provably fair guide walks through the whole commit-reveal flow, and what is a server seed covers the single most important input in detail.
What this list does not tell you
The bottom line
If your priority is being able to check what a card site actually gave you, Ripster.gg and PackDraw are the two that clear the bar today. Ripster.gg publishes its full HMAC-SHA256 method with copy-paste code and cross-checks at roll 52.5587, and PackDraw publishes the working SHA-512 code that reproduces tickets 268,760 and 122,022. Boxed.gg is the most established TCG-focused option and stops one step short, publishing the hashing stage but not the conversion into its 0 to 999,999 ticket space. Pullbox.gg describes a full scheme you cannot reproduce from the outside without logging in. ArenaClub and Packz.io publish useful things, a shuffle claim and an odds table, but neither runs a seed-commit system, so there is nothing to independently verify. Whichever you use, do not take the label on trust: rotate your seeds, paste a real result into the verifier, and watch it check out for yourself.