Verify your CSGORoll roll

What CSGORoll publishes

CSGORoll's provably fair page links out to runnable code for each game mode rather than describing the algorithm in words. That is the useful kind of documentation: it removes the guesswork that prose always leaves behind.

The case-opening code from that source, run independently, reproduces its output exactly, including the roll 90,455,280 that CSGORoll's own published example produces. That example is not a static figure on a page; the operator's hosted project executes on load with its inputs pre-filled, so anyone can watch it produce the number. That is what allows the verifier above to accept CSGORoll pulls rather than showing an awaiting-confirmation notice.

The formula, precisely

combined = BOXES-serverSeed-clientSeed-nonce      (hyphen separators)

HMAC-SHA256( key = combined, message = EMPTY )
        |
        v
  first 13 hex characters of the digest
        |
        v
  ( value / 2^52 ) x 100,000,000, rounded down  =  your roll

The second line is the part that matters, and it is easy to read past. The combined string is used as the HMAC key, and the message is empty. CSGORoll's published code builds the HMAC from the seed string and then never feeds it any data.

That is not the same as hashing the combined string with plain SHA-256, and it is not the conventional arrangement where the server seed keys an HMAC over the client seed and nonce. Both alternatives produce entirely different digests. A verifier written for almost any other platform returns a number that looks completely reasonable and is wrong, which is what this site calls a plausible wrong number and the most common reason a CSGORoll check appears to fail.

The BOXES prefix at the front of the string is literal and must be included. Battles under the newer PvP system replace it with a longer salt describing the round and seat, so a battle check needs that string rather than BOXES.

Rolls land between 0 and 99,999,999.

The sister-platform detail that catches people

CSGORoll and HypeDrop run the same engine, which is unsurprising once you notice how similar the two sites are.

They do not share parameters.

CSGORoll's case opening multiplies by 100,000,000. HypeDrop's unboxing multiplies by 99,999,999. The gap is one unit, and because that value is the final multiplier before rounding down, using the wrong one shifts a roll by at most one. Across play counts 0 to 9,999 on HypeDrop's example unboxing seeds, 4,916 rolls moved by exactly one and the rest did not move. That rarely changes an item, but it is enough to stop a result matching exactly.

Why the one-unit gap exists at all

Read the right-hand column again. HypeDrop's own battle mode multiplies by 100,000,000, the same as CSGORoll, while its unboxing mode uses 99,999,999. The inconsistency is not between the two platforms so much as inside one of them, which is why a tool set for HypeDrop unboxing still matches a CSGORoll case only about half the time, and fails on a HypeDrop battle for a bigger reason: battles hash a different prefix, PVP_BOX, with a block hash and bet ID as inputs.

There is a further wrinkle worth knowing if you read HypeDrop's page directly. Its unboxing section states in prose that there are 100,000,000 possible roll numbers, immediately above code that uses 99,999,999. Both are live operator statements and they cannot both be true. Our implementation follows the code, because the code is what runs when you open a box, but you should know the page disagrees with itself rather than discovering it mid-check.

If you are checking a CSGORoll pull with a tool built for HypeDrop, the multiplier is almost certainly why it disagrees.

The version history, and the one mode it skips

Most platforms in this space publish a current algorithm and leave you to guess whether it applied to your round. CSGORoll does the opposite, and it is the best version disclosure of any platform we cover.

Dated legacy code is worth more than it sounds. Runnable current code lets you check a round if you already know which algorithm applied to it; dated legacy code tells you which one applied. Clash.gg and RustClash changed their case algorithm and published neither a date nor a cutoff, which leaves their historical rounds unverifiable in practice. CSGORoll's boundaries are exact down to the play ID and, in several cases, the timestamp.

Against that standard, case opening standing alone without a notice is conspicuous. It may simply never have changed. Nothing published says either way, and the absence is worth knowing before you conclude that an old case result failing to reproduce means something.

What is confirmed, and what is not

Case opening and dice are both confirmed, each against an answer CSGORoll states itself.

Dice runs a different machine

Dice is not a variant of the case engine. It runs HMAC-SHA512 keyed with the server seed over the client seed, the nonce and an iteration counter, then reads the digest five characters at a time, skips any chunk that lands at or above 1,000,000, and reduces the first accepted one to a value from 0 to 9,999. The site divides that by 100 for display, which is why a roll reads 88.02 rather than 8802.

CSGORoll's dice and quick upgrade verifiers carry identical code, and both state the expected answer in a comment: it will output Roll value: 88.02 (Raw value: 8802). The verifier above reproduces that figure. Until October 2026 this page held dice back as awaiting confirmation, because the only stated answer on record came from HypeDrop's copy of the same code; the one in CSGORoll's own verifier is what moved it.

One trap sits in CSGORoll's prose rather than its code. The written explanation says a chunk is skipped when it lands "above 10,000". The code skips at 1,000,000. Follow the code; a checker built from the sentence returns a plausible wrong number.

Where to find your seeds

Four values decide a case check, and they live in three different places.

1. The hashed server seed is shown before you play. Save it then, because it is the commitment you will compare against afterwards.
2. Your client seed is editable in your account. Changing it is what triggers the reveal.
3. The nonce, or play count, ticks up as you open.
4. The unhashed server seed appears only once you update your client seed. Rotating is what makes your past rounds checkable, and until you do, nothing from the current seed can be verified.

Roll history and the seeds themselves sit on the Roll Provably Fair page. For battles, the seeds and nonce live in a separate Provably Fair modal on the PvP Duel page rather than with the rest, so note where a result came from before you try to check it. Rotation is not the site being obstructive: a server seed still in use cannot be published, because anyone holding it could compute every remaining outcome in advance.

Where the check stops

CSGORoll publishes the arithmetic that produces your roll. It does not publish, on its fairness page, the ranges that map a roll to a specific skin.

So a passing check here settles the number and not the item. You can prove the roll came from values committed before you played, and you cannot prove from published material that the roll you got owed you the skin you received. Platforms differ on this: JemLit publishes its roll ranges per box, and CSGORoll does not. Whether the ranges appear somewhere inside a logged-in account is not something we have tested.

That is a statement about what can be established from outside, not an accusation.

What 2,632 reviews describe

On Trustpilot, CSGORoll holds 2.5 out of 5 across 2,632 reviews, on a profile claimed since June 2020. The distribution is 68% five-star and 19% one-star, and Trustpilot notes the company has not recently invited customers to review, so the sample is unprompted in both directions.

Do not read the 2.5 as an average of that distribution, because TrustScore weights recent reviews more heavily than old ones. The two numbers answer different questions: the 68% describes years of accumulated experience, the 2.5 leans on who has written lately.

Sorted by subject, the twenty most recent one-star reviews split as seven about odds or a belief results are steered, five about account restrictions, five about site performance, one about a withdrawal, one about support and one unspecified. That site-performance cluster, covering lag, glitches and mobile breakage after updates, is distinctive: it does not appear at that weight on any comparable platform we have checked, and it is not a fairness issue.

CSGORoll replies to eighteen of those twenty, and the replies are unusually informative about mechanics. One from August 2026 states outright that the company will not disclose its detection signals, "as doing so could compromise our detection systems." Another, from May 2026, names the mechanic behind a restriction directly, describing it as abuse of the rain feature and saying the coins obtained that way were removed while normal deposited balances were not. A third, answering a reviewer who reported being blocked after a large esports win in June 2026, states that restrictions follow esports rules covering suspicious activity, match manipulation and collusion, and are "not related simply to winning a game."

Those are individual accounts and an operator's framing of them, not findings. They are here because account access is the thing a fairness check cannot speak to, and because an operator stating a mechanic on the record is more useful than a summary of complaints.

What a passing check settles

A match proves the round you are checking came from values committed before you played, and that CSGORoll did not alter it afterwards. Given the engine's unusual construction, reproducing a CSGORoll roll from outside the site is a real confirmation rather than a formality.

It settles nothing beyond that one round, and on a skins platform there is a second gap worth naming: a verified roll tells you which item came up, never what that item is worth. Wear tier and float do the pricing, and two copies of the same skin name can be very different goods. Whether a withdrawal completes, how support responds, or what any given case contains are separate questions a fairness check cannot answer, and we keep what verification cannot prove as a standing page for that reason.