Fair play
SpyDota uses the Provably Fair algorithm so that any player can verify the fairness of a game. The result of a case or an upgrade is determined by a server seed fixed in advance, your client seed and the game number, so it cannot be tampered with once the game has started.
How to verify your game
The server seed is the secret value your game result is calculated from. To recalculate a game, the seed has to be revealed — the game card does it for you.
- HistorySkinCase
Night Terrors Hat
Shadow Shaman
Belt of the Forlorn MazeShadow ShamanOpen your history
Click your avatar in the header, open the “History” tab and choose “Cases” or “Upgrades”.
- Date22 October 2026 at 11:3222 October 2026 at 11:3222 October 2026 at 11:32
Click “Verify”
The button is at the end of the game row (on a phone, scroll the table to the right). In the card that opens, click “Verify” again.
- Game #2 of the seed pairRolled number37,847,706 of 100,000,000
To verify the game, the server seed must be revealed. We will create a new seed pair: the current seed will be revealed and filled into the check, and game numbers will restart.
Reveal the seed
If the seed is still secret, the card offers “Rotate seeds and verify”. The old seed is revealed, and then every game played with it can be verified. New games start counting from 1; games already played do not change. If the seed is already revealed, there is no such step.
- Matches
Your browser recalculated the game from the revealed seed and the result matches the server’s record.
Rolled number37,847,706- Belt of the Forlorn Maze29,376,71035,693,291
- Night Terrors Hatdropped35,693,29241,180,434
Censer of Gliss41,180,43547,096,768
Calculation details
Messagecase:dota2:e784b35edb9c33afec77526dac3faa49:2HMAC-SHA25660e3df4be0729100…0cc8Number from the hash1,625,546,571sha256 of the server seeda6d071c29474dfc7…b787Compare the result
The verification page opens. “Matches” means your browser recalculated the game and got the same result the server recorded. Compare the item marked “dropped” with the row in your history; for an upgrade, look for “Win” or “Loss”.
Games played before Provably Fair was launched, gifts and grants have no “Verify” button. If an item was replaced, the check covers the original drop. If you see “Does not match”, save the server seed and contact support.
The result is fixed in advance
Before the game you see the hash of the server seed, so the server can no longer silently replace the source data.
Your data is part of the calculation
Your seed and the game number take part in the calculation, so the result is not formed by the server alone.
Game data
Enter the data of a game. The calculation runs in your browser and nothing is sent to the server.
Verification result
Fill in the game data and press “Verify”: the rolled number and the item will appear here.
Server seed + Your seed + Game number = Fair result
How the calculation works
The server’s commitment
The server picks a random server seed and shows only its SHA-256 hash. The seed cannot be swapped afterwards: the hash would stop matching.
The game hash
HMAC-SHA256 is calculated for every game. The key is the server seed as a 64-character hex string, exactly as it is, not decoded into bytes. The message is built from the kind of game, the game, your client seed and the game number.
The ticket
The first 8 hex characters of the hash give a number from 0 to 4,294,967,295. It becomes a ticket from 1 to 100,000,000: floor(number × 100,000,000 / 2^32) + 1.
Case
In the odds table at the time of the game every item has its own ticket range. The item whose range contains the ticket drops.
Upgrade
The threshold is floor(chance × 100,000,000). The upgrade wins if the ticket is not greater than the threshold.
The reveal
The server seed is revealed when you rotate your seeds. After that any game of the pair can be recalculated in your browser on this page or with your own code.
The formula
- Message
- kind:game:clientSeed:nonce
- HMAC key
- HMAC-SHA256(serverSeed, message)
The key is the server seed’s hex string as it is (64 characters), not the bytes decoded from it. This is where most self-made checks go wrong.