What is a nonce in provably fair dice?
The nonce is a simple counter attached to your seed pair. Bet one uses nonce 0, bet two uses nonce 1, and so on. It is the input that changes between rolls, so identical seeds still produce a different result every bet.
The word comes from cryptography, where a nonce is a "number used once." In dice, the roll function is HMAC-SHA256(serverSeed, clientSeed:nonce). The server seed and client seed stay fixed for the life of the pair; only the nonce moves.
Your fairness panel displays the current nonce at all times, and every entry in your bet history records the nonce it was rolled under. That number is effectively the bet's address: seed pair plus nonce identifies one roll, exactly and forever.
Why does the nonce make every roll unique?
SHA-256 has an avalanche property: changing the input by even one character produces a completely different hash. Incrementing the nonce from 41 to 42 rewrites the entire HMAC output, so consecutive rolls share no statistical relationship.
Without a nonce, a fixed seed pair would hash to the same value forever and every roll would be identical. Appending the counter to the message solves this with no extra randomness needed: myseed:0, myseed:1, and myseed:2 are simply different messages, and HMAC-SHA256 maps each to an unrelated 256-bit output.
Two properties follow:
- Determinism. The full sequence of rolls for a seed pair exists the instant the pair is locked. Nonce 500 is already decided at nonce 0. The house cannot reorder or skip results without the gap showing in your bet history.
- Independence in practice. Although the sequence is predetermined, no one lacking the unhashed server seed can compute roll n+1 from rolls 1 through n. Past results carry zero information about the next one, which is also why streak-based betting reads patterns into noise.
How do you verify a specific past bet with its nonce?
Find the bet in your history and note its nonce. Rotate seeds so the server seed is revealed, then recompute HMAC-SHA256(server seed, client seed:nonce) for that exact nonce. The derived roll must match the recorded result.
The nonce is what makes targeted verification possible. Suppose a suspicious loss sits at bet #38 of your session. The procedure:
- Open the bet in your history; the detail view shows client seed, hashed server seed, and nonce 37 (counting from 0).
- Rotate your seed pair so the site reveals the retired server seed.
- Confirm SHA-256 of the revealed seed matches the original hash.
- Compute the HMAC for nonce 37 and convert it to a roll number.
If the recomputed roll matches the recorded one, that bet was fair, and you never had to check the other 99. Paste the three values into our provably fair dice verifier and it performs the hash check and roll derivation for any nonce in the sequence instantly.
Do certain nonce values roll better than others?
No. Every nonce maps to a uniformly random result; nonce 7 and nonce 7,000 have identical distributions. Skipping bets, timing rolls, or resetting to hunt low nonces changes nothing about expected value.
A persistent myth says early nonces are "seeded to win" so players get hooked, or that specific counter values run hot. HMAC output is uniform across all inputs, and the commitment scheme prevents the site from treating any nonce range differently: favorable early nonces would require a biased roll function, which verification would expose.
Some players also burn seed pairs rapidly, rotating after every few bets to restart at nonce 0. That is harmless but pointless; it just costs time. The only number that governs long-run results is the house edge, identical at every nonce.
Ready to compare dice sites?
We tested the leading bitcoin dice casinos hands-on: deposits, real rolls, withdrawals, and support. See how they rank.
See the Best BTC Dice Sites