Coin Flip.nowFlip a coin

Verify a coin flip

Check any coinflip.now result yourself, in your browser, without asking us anything.

A seed published after the fact proves nothing: the server could have picked it once it knew the result. What makes a flip provable is the order. The server publishes a fingerprint (SHA-256) of its secret seed before the flip, each player adds their own seed, and the outcome comes from all of them. Afterwards the secret is revealed and anyone can check both halves.

The values

Every field comes from a flip’s Fairness panel. Nothing is sent anywhere: the math runs in your browser.

Result

Fill in the fingerprint, the server seed and the digest to check a flip.

Why nobody can rig the flip

The result is locked in before anyone flips, and after the match you can check it yourself.

  1. Sealed before round 1The room picks a secret and shows you only its fingerprint.
  2. You both add a seedEach browser adds a random seed of its own. Nobody sees the secret.
  3. All three make the faceThe face comes from all three at once — change any one and it could land the other way.
  4. Opened and checkedAfter the match the envelope opens: the secret inside matches its fingerprint, and your browser can redo the same mix and get the same face.

How the proof works

  1. Seal Before each match (and before each flip when you flip alone), the server picks a secret server seed and publishes only its SHA-256 fingerprint. The fingerprint reveals nothing about the seed, but it pins the server to that exact value: it can’t swap in a different one later.
  2. Contribute Each player’s browser makes up a client seed, which you can replace with anything you like. The server has already sealed its own, so it can’t pick its seed to suit yours.
  3. Derive The result of round n is HMAC-SHA256(serverSeed, "clientSeedA:clientSeedB:n"). The first hex digit of that digest decides the face — even is Heads, odd is Tails. Sixteen equally likely digits, eight per side, so there’s no bias.
  4. Reveal When the match ends (or right after each flip when you flip alone), the server publishes the server seed. Hash it: it must match the fingerprint from step 1. Recompute the HMAC: it must match the digest published with your result. Both hold, or something’s wrong.

What this does not cover: a server that never publishes a fingerprint up front, or one that shows you a different fingerprint afterwards than the one it showed before. Take a screenshot of the fingerprint if a flip really matters to you.

A million flips, checked

We ran 1,000,000 flips through the same code that flips yours, with fresh seeds for every room. A fair coin never lands exactly half and half: it wobbles around the middle. Here is how this run came out.

Heads · Tails
500,867 · 499,133
Off an exact half
867 flips from a perfect 500,000. That’s ordinary for a fair coin: about 2 runs in 3 land within 500 of half, and 19 in 20 within 1,000.
Every digit
The face is read from one hex digit, 0 to f, eight for each side. Each of the 16 came up 62,064–63,087 times: about 62,500 each, as even as chance gets.
Longest streak
18 of the same side in a row. A million fair flips usually hold a streak of about 20.

Run on 2026-10-07 (v2.1.0): 10,000 rooms of 100 flips. Every run lands a little differently; this one is recorded as it came.

Nothing to check yet? Flip a coin online with friends: one shared room, one synced toss, and a proof like this one behind every result.