Guide

How random number generators are verified in online casinos

Every spin, card and dice roll at an online casino comes from a random number generator, and the question of whether the games are fair is the question of whether that generator is what it claims to be. The answer is a process: an independent laboratory reviews the algorithm, tests its output, checks the game's use of it against the published return, and certifies a specific build under a named standard. This guide sets out each step, who runs it, and what a player can see of it from outside.

Written by Checked by GnomVRN

Illustration for RNG verification

What is being tested

Two things, and they are separate. The generator itself is an algorithm, seeded from a source of entropy, that produces a stream of numbers with no pattern a test can find and no way to predict the next from the last. The game is the mapping from those numbers to outcomes: which number ranges land which symbol on which reel, how the feature triggers, how the paytable turns positions into money. A fair generator behind a mapping that pays less than its paytable claims is an unfair game, and an honest mapping fed by a predictable generator is an exploitable one, so a certification covers both. Online, both live on the studio's servers; the casino embeds the game and cannot reach either.

What the certificate is for

A regulator accepts a laboratory's certificate as evidence that a licensee's games meet its technical standard. Malta, the UK, Curaçao under the LOK and the rest all require it in some form; the game's certificate is the studio's, the platform's is the casino's.

The steps of a certification

The laboratory receives the source code and the build. It reviews the algorithm and, more importantly, the seeding: where the entropy comes from, how often the generator is reseeded, whether the seed or the internal state could be read or influenced from outside. It then runs statistical batteries on long output streams, tests of distribution, of runs, of serial correlation, of the kind a cryptographer would run on a cipher, and a generator that shows any bias fails. Next it tests the game: it simulates many millions of rounds through the real mapping and compares the measured return with the RTP the studio publishes, checks that every outcome the paytable promises is reachable at the stated probability, and checks the feature triggers and the maximum win. Finally it seals the build, records a version or a checksum, and issues a certificate naming that build, the standard applied and the date. A change to the build means a new certification.

What "within tolerance" means

A simulation of millions of rounds lands close to the theoretical RTP and never exactly on it; the standard sets how close, and the certificate records the measured figure. Trackers such as Slot Catalog report the published figure, which is the theoretical one.

The laboratories and the standards

Gaming Laboratories International publishes the standards most regulators cite: GLI-11, Gaming Devices, for the machine and its generator, and GLI-19, Interactive Gaming Systems, for the online platform, both in their third versions. BMM Testlabs, iTech Labs and eCOGRA test to the same standards and to regulators' own technical requirements, and each publishes lists of the suppliers it has certified. A studio the size of Pragmatic Play holds certificates from several laboratories for several jurisdictions, because each regulator accepts particular laboratories; a casino's platform, the software that runs accounts, cashier and the game lobby, is certified separately from the games inside it. Regulators such as the Malta Gaming Authority also run their own compliance audits on licensees' live systems after launch, which is the difference between a certificate and supervision.

Provably fair

Crypto casinos often add a second mechanism for their own games: a hashed server seed published before play, a client seed the player sets, and a result that can be recomputed afterward. It verifies individual rounds, leaves the generator itself untested, and applies to the casino's in-house games only; studio slots are outside it.

What a player can see

From outside, four things. The laboratory's certified-supplier lists, which name the studios and platforms it has tested. The casino's footer, where a platform certificate is sometimes linked and where the licence, which requires the certification, is stated; the licence guide covers checking that. The game's info screen, where the RTP printed is the certified theoretical figure for the version in play, and where a casino serving a version with the rules removed has answered the question. And the shape of the results over time, which is the least useful of the four, because a certified high-volatility slot produces exactly the streaks that look like something is wrong; the hot and cold guide covers why.

What a player cannot see is the generator, and no reputable casino offers to show it, because a generator whose state could be observed would fail its certification. The check is the certificate and the regulator behind it, and the reviews on this site record the licence each brand holds because that is where the chain of trust starts.

The brands here

Every scored brand on this site carries studio games that run on the studios' own certified servers, and several crypto brands add provably fair in-house games; the reviews say which. The trust mark reflects the licence, since the licence is what makes the certification a condition.

Where this applies first

The two lowest-wagering codes we verified, with the slot, the multiplier and the cap on each card.

Questions about RNG verification

Who tests the random number generator

Independent laboratories accredited by regulators: Gaming Laboratories International, whose GLI-19 standard for interactive gaming systems is the one most regulators cite, BMM Testlabs, iTech Labs and eCOGRA among them. The studio submits the generator and the game; the laboratory tests and certifies; the regulator accepts the certificate as a licence condition.

Is the RNG at the casino or at the studio

At the studio. An online slot runs on the studio's servers, and the casino embeds the game frame. The casino chooses which RTP version to license and cannot touch the generator or the spin outcomes, which is why a certified game plays the same at every casino running that version.

What does a certificate actually say

That a specific build of the generator and the game, identified by a version or a checksum, was tested against a named standard on a stated date and met it: the output passed the statistical tests, the mapping to reels matched the paytable, and the measured return matched the published RTP within tolerance. A certificate for one build says nothing about another.

Can I verify it myself

You can find the certificate: laboratories publish lists of certified suppliers, and a casino's footer may link a certificate for its platform. What you can also do is check the RTP on the game's info screen, which is the studio's certified figure for the version in play. Provably fair games, common at crypto casinos, let you verify each result against a seed you hold; the casino pages here say where they are offered.

Last updated - Checked by: Karssen Avelar