Server Seed, Client Seed and Nonce Explained

Every provably fair result on a Duel Original is built from a few values. The server seed is Duel's secret, the client seed is yours, the nonce counts rounds and the cursor counts steps inside a round. This page explains what each one is for, how they are combined, and what happens to the outcome when one of them changes.

These are the definitions Duel publishes for its own system. The worked example further down is Duel's published Dice round, recomputed with our own code.

The roles#

Server seed#

Duel describes the server seed as a 64-character hex string generated with crypto.randomBytes(32), which is the cryptographically secure random generator in Node.js. That is 32 random bytes, written as 64 hex characters.

You do not see it while it is in use. You see its SHA-256 hash, which works as a sealed envelope: Duel cannot later produce a different seed that matches the hash, and you cannot recover the seed from the hash. If you could see the seed itself, you could compute every upcoming result, so it has to stay hidden until you are finished with it.

Client seed#

The client seed is the part you control. Duel describes it as a string chosen by the player, or generated automatically if you do not choose one.

Its purpose is ordering. Duel commits to its server seed first, then your client seed enters the calculation. A casino that could choose its server seed while already knowing your client seed could search for a seed with a bad run for you and commit to that one. Setting a client seed of your own, after the hash is on screen, removes that possibility. Duel states the same condition: the scheme is sound as long as you can set a client seed after the hashed server seed has been shown.

Nonce#

The nonce is the number of the round you are on. Duel documents that it increases by 1 for every round across all house games, so the Originals share a single counter for your seed pair. Duel's published examples show this: one seed pair appears in the Plinko example at nonce 8796, in Mines at 9521 and in Beef at 9837.

Two practical consequences:

• Take the nonce from the bet detail instead of counting. Ten Dice rolls followed by a Mines round put that Mines round at the eleventh nonce, not the first.
• Duel does not document the nonce of the first round on a new pair, so do not assume 0 or 1.

Without the nonce, the same two seeds would produce the same result on every bet. With it, every round has its own result, all fixed the moment the pair was created.

Cursor#

Dice needs one number per round. Other games need several: a card at a time, a left or right at each Plinko row, a swap at each step of a shuffle. The cursor is the counter for those steps. It starts at 0 in every round and goes up by one per step.

How they combine#

The construction is HMAC, a keyed hash defined in RFC 2104, with SHA-256.

digest = HMAC-SHA256(key = server seed as bytes, message = "clientSeed:nonce:cursor")
number = first 4 bytes of digest, read as a 32-bit integer
result = game formula applied to number

The digest is 32 bytes that look random and cannot be predicted without the key. The first 4 bytes become a number from 0 to 4,294,967,295. If that number falls in a small rejected band at the top of the range, the next 4 bytes are used instead; this removes the slight bias a plain remainder would have. The game formula then turns the number into a roll, a card, a direction or a shuffle step.

One detail is easy to get wrong and is not spelled out in Duel's documentation: the key is the server seed decoded from hex into 32 bytes, not the 64 characters as text.

Worked example: Duel's Dice round#

Dice uses the message clientSeed:nonce and the formula number mod 10001, divided by 100. This Node.js snippet uses the seed pair from Duel's published Dice example at three consecutive nonces, then changes one character of the client seed.

// Duel Dice: one seed pair at three consecutive nonces, then with one character of the client seed changed
const crypto = require("node:crypto");

const serverSeed = "e8c83961a3961baee67cc08da34ada1c00a4515450a3cdbd2b1db81a35ca7f72";

function roll(clientSeed, nonce) {
  const digest = crypto
    .createHmac("sha256", Buffer.from(serverSeed, "hex")) // key: the seed as 32 bytes, not as text
    .update(`${clientSeed}:${nonce}`)
    .digest("hex");
  const value = parseInt(digest.slice(0, 8), 16); // first 4 bytes as a number
  return [digest.slice(0, 8), value, ((value % 10001) / 100).toFixed(2)].join("  ");
}

for (const nonce of [21, 22, 23]) console.log(nonce, roll("UzR5CIqog4DXox5H", nonce));
console.log("21, client seed ending in I:", roll("UzR5CIqog4DXox5I", 21));

Output:

The first row is Duel's published example: 604,508,772 divided into groups of 10,001 leaves 8,328, and 8,328 divided by 100 is a roll of 83.28. Dice therefore has 10,001 possible results, from 0.00 to 100.00.

The last row shows what a one-character change does. Nonce 21 rolls 76.78 instead of 83.28, with no relation between the two. This is why a verifier is so sensitive to copy errors, and why Duel cannot plan a seed against a client seed it has not seen.

For a multi-step game, the same thing happens once per cursor value. In Duel's Plinko example, 16 rows mean 16 HMACs with the messages ending :0 to :15; 14 of the 16 numbers are odd, each odd number moves the ball right, and the ball lands in bucket 14.

What happens when each value changes#

No change to any of them affects the odds. The probability of each outcome is set by the game formula, and the house edge with it. On Duel.com the Originals carry a 0.1% base edge, refunded inside the daily Zero Edge allowance; see house edge and RTP explained.

Crash and Castle Roulette are different#

A per-player client seed and nonce suit single-player games. Crash and Castle Roulette are shared rounds, so Duel replaces the client seed with a value from drand, a public randomness beacon whose values nobody, including Duel, can predict or choose. Before each round Duel shows its hashed server seed and the ID of a drand round that has not been published yet. The nonce is always 0.

The idea of committing first and revealing later is the same; the inputs differ. See the drand section in provably fair explained.

Practical tips#

• Copy the hashed server seed somewhere outside the site before you start betting on a pair
• Replace the default client seed with your own random string
• Take the nonce from the bet detail; the counter is shared by all Originals
• Paste seeds exactly, with no trailing space or line break
• When you verify, decode the server seed from hex before using it as the HMAC key
• Rotate to audit a block of bets, never to change your luck

Next steps: how to verify a bet has scripts for every documented game, and how to rotate your seed covers the reveal.

Summary#

The server seed is Duel's committed secret and the HMAC key. The client seed is your input, useful because it is chosen after the commitment. The nonce gives every round its own result and is shared across the Originals. The cursor gives every step inside a round its own number. Together they make each outcome reproducible once the server seed is revealed. They prove the result was fixed in advance; they do not change the odds.