Provably Fair Hi Lo Game: How to Verify Each Card

A provably fair hi lo game draws each card from a keyed hash of a server seed, your client seed, the bet number and the card's position in the round, then turns that hash into one of 52 cards. Once the server seed is revealed, you can rerun the same calculation and confirm every card in a past round. What the check cannot confirm is the payout table, which is where the house edge sits.

How a hi-lo card is generated from the seeds

Each card is the output of HMAC-SHA256 over four inputs, and the same four inputs always give the same card. Wolfbet's hi-lo page documents the recipe: it combines the client seed, server seed, nonce and sub-nonce with HMAC-SHA256.

The inputs, and who controls them:

The sub-nonce is the detail most hi-lo explainers leave out. A single hi-lo bet can run a long streak of higher or lower calls, and each card in that streak gets its own position number. So the third and fourth cards of the same bet are separate HMAC inputs with separate outputs, and you verify them one at a time.

Why the server seed is the HMAC key

In HMAC, the server seed is the secret key and the seed string built from the other inputs is the message. The IETF definition in RFC 2104 computes the keyed hash as two nested passes: H(K XOR opad, H(K XOR ipad, text)), where K is the key and text is the message.

The two padding constants are fixed. ipad is the byte 0x36 and opad is the byte 0x5C, each repeated to the hash's block length. Nothing about them is casino-specific, which is the point: any standard HMAC-SHA256 library will produce the same output as the operator's server for the same key and message.

This also explains why you cannot check a round before the server seed is revealed. Without the key, the message alone tells you nothing about the output.

NIST's FIPS 198-1 standard for HMAC, published July 2008, specifies the same construction for use with any approved iterative hash and a shared secret key. NIST has since announced it plans to withdraw FIPS 198-1 and move its content into a new Special Publication (SP 800-224), as of October 2026. The construction does not change, so verification code written against RFC 2104 still applies.

How the hash becomes a card

The hash output is turned into a number between 0 and 1, multiplied by 52 and rounded down. Per Wolfbet's documentation, that whole-number result picks a card from a standard deck.

Written as a formula, the card index is floor(U x 52), where U is the 0 to 1 value taken from the hash. One consequence follows:

• The index still has to be mapped to a rank and suit. That table belongs to the operator, so a verifier needs the operator's own index order to translate the number back to the card shown on screen.

How to verify a past hi-lo round step by step

Verification means rebuilding the HMAC input for one card, hashing it with the revealed server seed, and confirming the resulting index matches the card you were dealt. The steps for any one card:

1. Record the client seed, the nonce of the bet and the sub-nonce of the card you want to check.
2. Wait until the server seed for that seed pair is revealed, then copy it exactly.
3. Build the message from the client seed, nonce and sub-nonce in the format the operator documents.
4. Compute HMAC-SHA256 with the server seed as the key and that message as the text.
5. Convert the hash to the 0 to 1 value the operator documents, multiply by 52 and round down.
6. Look up the index in the operator's card table and compare it with the card shown in your bet history.

If the card matches, the seeds produced that card. If it does not, the likely causes are a formatting difference in the message (separators, order, number formatting) or the wrong sub-nonce, which is the first thing to recheck in a long streak.

What hi-lo verification does not prove about house edge

A matching card proves the draw followed the seeds. It does not prove the payouts are fair, because the house edge lives in the multipliers, not in the card generator.

Wolfbet states hi-lo runs at a 1% house edge (99% RTP) across all predictions, as of October 2026. That figure is a claim about the payout table, and no seed check touches it.

You can still sanity-check it against the odds. With a 7 showing, higher and lower are each about 46% and a same-value call is about 7.7%, per Wolfbet's own probability figures. The 7.7% follows from the formula: four cards of each rank out of 52. If a payout for a call times its probability comes to less than 1, the gap is the edge on that call, and you can compute it yourself without any seed at all.

So treat the two checks as separate:

Questions on this

What does the client seed do in hi-lo?

It is one of the inputs to the HMAC message, next to the nonce and the sub-nonce.

Why does each card in a streak need its own sub-nonce?

One bet in hi-lo can draw many cards. The sub-nonce records the card's position in the round, so each draw is a separate HMAC input with its own result rather than a reused hash.

Can you verify a hi-lo round before it is played?

No. The recomputation needs the server seed itself, and that is the secret key in the HMAC. A check only works on rounds whose server seed has already been revealed.

Does a passed verification prove the house edge?

No. It proves the shown card matches the seeds. The edge comes from the payout table, which you check separately against the card odds.

Sources and on-chain links

• Wolfbet, Best Crypto Hilo Card Game, undated page, accessed 16 October 2026
• IETF, RFC 2104: HMAC: Keyed-Hashing for Message Authentication, February 1997
• NIST CSRC, FIPS 198-1, The Keyed-Hash Message Authentication Code (HMAC), July 2008