HMAC

HMAC (hash-based message authentication code) is a standard way to combine a secret key with a message using a hash function. HMAC-SHA256 uses SHA-256 and produces 32 bytes of output.

How it is used in provably fair games

In the most common scheme, the server seed is the HMAC key and the message is the client seed, the nonce and a round number joined with colons:

HMAC-SHA256(serverSeed, clientSeed:nonce:round)

The 32 output bytes are split into 8 groups of 4 bytes. Each group becomes a float between 0 and 1 by treating the bytes as a base-256 fraction: byte1/256 + byte2/256^2 + byte3/256^3 + byte4/256^4. Games turn those floats into results.

Why HMAC rather than a plain hash

HMAC is designed for exactly this case, combining a secret key with public input, and is resistant to the length-extension weaknesses that a simple hash of joined strings can have.

Note

Not every casino uses this exact format. Some swap the key and message, add extra fields or use a different conversion. Verification must follow the casino's own documentation.