RNG Testing and Fairness: How Games Are Certified

Reading time: 10–12 minutes • Last updated: 02 Jan 2026

1. Why fairness matters
2. What is an RNG
3. How RNGs work: PRNG, seeding, entropy
4. Who tests RNGs: independent labs
5. How games are certified: step by step
6. What regulators require
7. “Provably fair” in crypto casinos
8. How you can verify fairness claims
9. Common myths and quick answers
10. Conclusion and next steps
11. Responsible gambling help

Why fairness matters

When you play a slot, card game, or roulette online, you want fair results. Fair means no one can guess or change the next number. This is what the Random Number Generator (RNG) does. It picks numbers in a way that is not known in advance.

Good casinos and studios do not ask you to “trust them.” They get their RNG and their games tested by expert labs. These labs follow strict global rules. Regulators check that work. You can check many of these things yourself online. This page shows how it all works and how you can verify claims.

What is an RNG

RNG means Random Number Generator. It is a piece of software or hardware that makes random numbers. Games use those numbers to decide spins, cards, or dice.

Two more terms matter here:

• RTP (Return to Player): the long-term share of money a game pays back. It is set by the math of the game, not by the RNG. Example: 96% RTP means that over a huge number of plays, the game pays back about 96%.
• Volatility: how swingy the game is. High volatility means fewer wins but bigger ones. Low volatility means more small wins. The RNG does not change RTP or volatility; it only makes outcomes random.

A fair game needs two things: good math (RTP as stated) and a sound RNG (no one can predict the next result).

How RNGs work: PRNG, seeding, entropy

Most online games use a PRNG (pseudorandom number generator). It is software that makes numbers that look random and pass hard tests. It starts from a secret value called a seed.

Seeding is how the first secret value is made. To make that seed safe, systems pull in entropy. Entropy means “unpredictable bits,” like secure system events or hardware noise. Good systems also reseed over time so they stay fresh.

Some systems also use hardware random sources. These read tiny noise from the real world. They can help with extra entropy. In practice, most studios use strong PRNGs with solid seeding and reseeding. The key is that no one outside (and not even staff) can predict the next number.

Labs check that the PRNG is the right type, is set up right, and is used right in the game code. They check seeding rules, how often it reseeds, and how the game pulls numbers for each event.

Who tests RNGs: independent labs

Independent test labs check RNGs and games. Leading labs include:

• eCOGRA (also see their seal holders)
• iTech Labs (see certificate listings)
• GLI – Gaming Labs International (see GLI standards)
• BMM Testlabs

Serious labs are accredited to ISO/IEC 17025. This global standard says a lab is competent to test and calibrate. It covers how they run tests, how they keep records, and how they stay impartial.

Labs are not the same as regulators. Labs test and report. Regulators approve, license, and enforce rules.

How games are certified: step by step

Here is a simple view of the path from code to a live, certified game:

1. RNG module review The lab studies how the RNG works in code. It checks the PRNG type, how it seeds, how often it reseeds, how it uses numbers in the game, and how it avoids bias. It also checks the cycle length (how long before values repeat) and that outputs cannot be predicted from past values.
2. Statistical test suites The lab runs big batteries of tests on large samples. Common suites include: NIST SP 800-22 Diehard / Dieharder (see background e.g. dieharder) TestU01 (SmallCrush, Crush, BigCrush) These suites look for patterns. If patterns show up beyond tiny limits, the RNG fails.
3. NIST SP 800-22
4. Diehard / Dieharder (see background e.g. dieharder)
5. TestU01 (SmallCrush, Crush, BigCrush)
6. Game math verification The lab checks that the game’s math matches what is claimed. It verifies RTP, hit rate, and variance by simulation and by math proof, when possible. For slots, the lab checks the reel strips or symbol maps. For cards and dice, it checks shuffles and draws.
7. Security, builds, and change control The lab records the exact build that passed. It takes a hash (a digital fingerprint). Teams store code in secure control systems. Changes need a new test or a scope check. This stops “secret swaps” after a pass. Regulators often require signed builds and secure deployment.
8. Platform and integration tests The lab may test the game inside the casino platform. It checks that calls to the RNG and game logic are the same in live mode as in test mode. It also checks logs, error handling, and time sync.
9. Jurisdiction review and approval The lab sends a report to the regulator if needed. The regulator or a technical unit reviews it. Some places also run their own checks.
10. Ongoing monitoring and re-cert Labs and regulators can ask for new tests after code updates or at set times. They can pull logs, check hashes, and compare behavior over time. If a studio changes RTP options or adds features, that must be reviewed.

• NIST SP 800-22
• Diehard / Dieharder (see background e.g. dieharder)
• TestU01 (SmallCrush, Crush, BigCrush)

What regulators require

Rules change by country or state. But the core goals are the same: fair, random, and secure. These pages show what top regulators ask for:

• UK Gambling Commission Remote Technical Standards
• Malta Gaming Authority: Licensing and compliance and the Licensee Register
• New Jersey DGE: Technical Services Bureau
• Nevada Gaming Control Board: Technology Division
• Many rules refer to GLI standards such as GLI-11 (slot machines) and GLI-19 (interactive gaming).

In most places, a casino or studio must list its license number on its site. You can search that number on the regulator’s public register. For example, see the UKGC public register or the MGA register.

“Provably fair” in crypto casinos

Some crypto sites use “provably fair.” This is a check you can run yourself after a bet. A common model is: the server has a secret seed, you add your client seed, and a counter called a nonce. The site shows a hash of the server seed first. After a set of bets, it reveals the seed. You can then verify that the hash was honest and that your results match the formula.

This is good for transparency. But note two points:

• It does not replace a license in regulated markets. It is a tool, not a full audit.
• It depends on safe hashing. See NIST on SHA-2 (SHA‑256).

In short: provably fair can help you verify single bets. A lab test and a regulator license cover the full system, the code, and the long-term math.

How you can verify fairness claims

You do not need to be a coder to do basic checks. These quick steps catch most issues:

1. Check the regulator Find the license number in the footer. Look it up on the official site. Examples: the UKGC register and the MGA register. The name, address, and status must match.
2. Check the lab Look for a lab seal that links to a live certificate page, not just an image. You can cross-check on eCOGRA, iTech Labs, or GLI. Check the date, the scope (RNG or game), and the version number.
3. Check RTP info If a game lists RTP options (for example 96% and 94%), the casino must say which one it uses. If it does not, ask support or pick a site that states it clearly.
4. Check build integrity Many lab pages show a hash or version. If the live game shows a different version, be careful. Updates should have new approvals.
5. Red flags Beware claims like “RNG certified” with no lab name, broken links, no license, or bonuses that look unreal. If basic facts are hidden, walk away.

Want a shortcut? This independent guide keeps current links to lab certificates and regulator registers, and explains how to read them step by step.

Common myths and quick answers

• Myth: “Casinos can flip a switch and rig a live game.” Fact: Certified builds are locked by version and hash. Changes need new tests and approvals. Logs make silent swaps risky and easy to spot.
• Myth: “RTP is what I will get today.” Fact: RTP is a long-term average over huge samples. Short runs can be up or down. That is normal.
• Myth: “All RNG certificates are the same.” Fact: Scope matters. Some certs cover only the RNG module. Others cover the full game and platform. Read the scope line on the lab page.
• Myth: “Provably fair means no need for a license.” Fact: It helps for checks after the bet. It does not replace full audits, rules, or player protections that a license brings.

Short glossary

• RNG: Random Number Generator. Makes the numbers that drive game outcomes.
• PRNG: Software RNG that looks random and passes strict tests.
• Seed: Secret start value for the PRNG.
• Entropy: Unpredictable input used to make strong seeds.
• RTP: Long-term payout rate of a game.
• Variance/Volatility: How big and how often wins can be.
• Hash: A one-way fingerprint of data. Used to lock builds and prove no changes.
• Nonce: A counter value used once per bet in provably fair systems.

Conclusion and next steps

Fair play is not a vague promise. It is a process you can check. Labs test RNGs with hard suites like NIST SP 800‑22 and TestU01. Regulators set rules and enforce them. Good casinos and studios show live links to certificates and license pages.

Before you play, take one minute to check the license and the lab link. If you prefer a faster way, use a trusted guide that keeps verified links in one place. And always play within your limits.

Responsible gambling help

Gambling is entertainment. You can lose money. Set a budget. Take breaks. If you need help, please reach out:

• UK: BeGambleAware and GamCare
• US: National Council on Problem Gambling (call or chat via site)
• Global: Check your local health services and regulator help pages

FAQ

How are casino RNGs tested?

Labs like eCOGRA, iTech Labs, GLI, and BMM run large test suites (for example NIST SP 800‑22) and review how the RNG is built and used. They also check game math and version control.

Are online casino games truly random?

In a licensed market with certified games, outcomes are as random as modern tests can show. You cannot predict the next result. Over time, results match the game’s math (RTP and variance).

Which labs certify casino RNGs?

Leading labs include eCOGRA, iTech Labs, GLI, and BMM Testlabs. They are accredited to ISO/IEC 17025.

What is the difference between RNG certification and RTP?

RNG certification checks that outcomes are random and safe. RTP is the long-term payout rate set by the game math. A fair game needs both: a sound RNG and the stated RTP.

Can a casino change the RNG after certification?

Not without review. Certified builds are locked. Any change needs testing and approval. Regulators can check logs and hashes to spot unsanctioned changes.

What does ISO/IEC 17025 mean for testing labs?

It means the lab meets a global standard for test competence and quality. It covers staff skills, tools, methods, and impartial work.

Is “provably fair” the same as being regulated?

No. Provably fair helps you verify single bets via seeds and hashes. Regulation covers the whole system: code, math, security, player funds, and dispute rules.

Further reading (authoritative sources)

• NIST SP 800‑22 Statistical Test Suite
• TestU01 documentation
• GLI standards index (GLI‑11, GLI‑19, and more)
• eCOGRA seal holders and certificates
• iTech Labs certificate listings
• UKGC Remote Technical Standards
• MGA Licensee Register
• New Jersey DGE Technical Services
• Nevada Gaming Control Board Technology Division
• NIST: SHA‑2 (hash functions)
• ISO/IEC 17025 overview