HMAC
A hash function that takes a secret key; provably fair games run HMAC-SHA256 over the server seed, client seed and nonce.
HMAC stands for hash-based message authentication code. It is the standard method for mixing a secret key into a message through a hash function. The HMAC-SHA256 variant relies on SHA-256 and returns 32 bytes.
Its role in seed-based games
The dominant scheme uses the server seed as the HMAC key. The message is your client seed, the nonce and a round number, separated by colons:
HMAC-SHA256(serverSeed, clientSeed:nonce:round)
Those 32 bytes are cut into 8 chunks of 4. Each chunk is read as a base-256 fraction (first byte over 256, plus the second over 256 squared, the third over 256 cubed and the fourth over 256 to the fourth power), which yields a float from 0 to 1. The game logic then maps the floats to outcomes.
Why not just hash a joined string
HMAC was built precisely for combining a secret key with public data. It also avoids the length-extension issues that can affect a plain hash over concatenated strings.
Implementation differences
Casinos do not all follow this exact layout. Some reverse key and message, include additional fields or convert bytes differently. Always verify using the scheme the casino documents.