What CSGORoll publishes
CSGORoll's provably fair page links out to runnable code for each game mode rather than describing the algorithm in words. That is the useful kind of documentation: it removes the guesswork that prose always leaves behind.
We took the case-opening code from that source and ran it independently. Our implementation reproduces its output exactly, including the roll 90,455,280 that CSGORoll's own published example produces. That is what allows the verifier above to accept CSGORoll pulls rather than showing an awaiting-confirmation notice.
The formula, precisely
combined = BOXES-serverSeed-clientSeed-nonce (hyphen separators)
HMAC-SHA256( key = combined, message = EMPTY )
|
v
first 13 hex characters of the digest
|
v
( value / 2^52 ) x 100,000,000, rounded down = your roll
The second line is the part that matters, and it is easy to read past. The combined string is used as the HMAC key, and the message is empty. CSGORoll's published code builds the HMAC from the seed string and then never feeds it any data.
That is not the same as hashing the combined string with plain SHA-256, and it is not the conventional arrangement where the server seed keys an HMAC over the client seed and nonce. Both alternatives produce entirely different digests. A verifier written for almost any other platform will return a number that looks completely reasonable and is wrong, which is the most common reason a CSGORoll check appears to fail.
The BOXES prefix at the front of the string is literal and must be included.
The sister-platform detail that catches people
CSGORoll and HypeDrop run the same engine. The published code is byte-identical, which is unsurprising once you notice how similar the two sites are.
They do not share parameters.
| CSGORoll case | HypeDrop unbox | HypeDrop battle | |
|---|---|---|---|
| Engine | HMAC-SHA256, empty message | Identical | Identical |
| Game prefix | BOXES | BOXES | PVP_BOX |
| Final multiplier | 100,000,000 | 99,999,999 | 100,000,000 |
| Value we reproduced | 90,455,280 | 19,569,993 | 35,864,249 |
CSGORoll's case opening multiplies by 100,000,000. HypeDrop's unboxing multiplies by 99,999,999. The gap is one unit, and because that value is the final multiplier before rounding down, using the wrong one shifts the result by an amount small enough to look like a rounding quirk and large enough to be a different item.
If you are checking a CSGORoll pull with a tool built for HypeDrop, this is almost certainly why it disagrees.
What is confirmed, and what is not
Case opening is confirmed. Dice and quick upgrade are not, and the distinction is deliberate.
Why dice is held back
The dice engine is a different algorithm: HMAC-SHA512 keyed with the server seed, read in five-character chunks, skipping any chunk at or above 1,000,000, with the first accepted chunk reduced to a value from 0 to 9,999. We have implemented it, and we have confirmed that implementation against HypeDrop's identical published code. What we do not have is a CSGORoll-native result to check it against.
That is why the table above shows dice as awaiting confirmation rather than verified. The engine is almost certainly right, given the platforms publish the same code. "Almost certainly" is not the standard we ship, so we say so rather than rounding it up.
Games before October 2022
CSGORoll changed its random number generation on 19 October 2022, with separate cutoff IDs per game mode. Anything played before those cutoffs ran on legacy code that this tool does not implement.
We have not built the legacy path because we cannot confirm it against a published result, and shipping an unverified implementation would mean handing you an answer we cannot stand behind. If an old result will not reproduce, the cutoff is the likely explanation.
Where to find your seeds
The hashed server seed is shown before you play. The unhashed seed is revealed when you update your client seed, so rotating is what makes your past rounds checkable. Roll history and the seeds themselves live on the Roll Provably Fair page, and for PvP the seeds and nonce are in the Provably Fair modal on the PvP Duel page.
What a passing check settles
A match proves the round you are checking came from values committed before you played, and that CSGORoll did not alter it afterwards. Given the engine's unusual construction, reproducing a CSGORoll roll from outside the site is a real confirmation rather than a formality.
It settles nothing beyond that one round. Whether a withdrawal completes, how support responds, or what any given case contains are separate questions that a fairness check cannot answer, and we keep what verification cannot prove as a standing page for that reason.