Provably fair

Before you rip, we lock in a secret server seed and show you its SHA-256 hash. Each pull is decided by HMAC-SHA256(server seed, "client seed:nonce:step"). When you rotate seeds, we reveal the old one so you can check every pull it made. We can't change a result after the hash is shown.

// Node.js — reproduce any roll
const { createHmac } = require("crypto");
const roll = (serverSeed, clientSeed, nonce, step) =>
  parseInt(createHmac("sha256", serverSeed)
    .update(`${clientSeed}:${nonce}:${step}`)
    .digest("hex").slice(0, 13), 16) / 2 ** 52;
// step 0 picks the tier by its odds; step 1 picks the card:
//   poolIndex = Math.floor(roll(..., 1) * poolSize)
// where the tier's pool is its cards sorted by (value, id)