Provably fair

How a spin is decided

1. Commitment. Before you spin, the server generates a random 256-bit server seed and shows you only its SHA-256 hash. The seed cannot be changed afterwards without the hash changing.
2. Your input. You control a client seed (change it any time on the wheel page) and each spin uses the next nonce (1, 2, 3…).
3. The roll. resultHash = HMAC-SHA256(serverSeed, "clientSeed:nonce").
4. Tier. The first 8 hex characters of the hash (32 bits) are taken modulo 10,000 to give a number from 0 to 9,999. Tiers are laid out in order with widths equal to their odds in hundredths of a percent; the number falls into exactly one tier.
5. Product. The next 6 hex characters (24 bits) modulo the number of products in that tier pick the product, each equally likely.
6. Reveal. After the spin, the server seed is revealed and a new one is committed for your next spin. Every spin stores the seeds, nonce, hash and a snapshot of the odds in force, in a table the database refuses to modify.

Known bias: 2³² is not a multiple of 10,000, so rolls below 7,296 are favoured by about 1 part in 429,000 (roughly 0.0002% of a 1% tier). Product selection uses 24 bits for at most a handful of products, a bias below 1 in 1,000,000. Both are disclosed here rather than hidden.