RNG in online casinos: how randomness is produced and tested
A casino RNG keeps producing numbers, and the value drawn when you play decides the result. This guide explains how it works, how labs test it and how to check a game follows the rules.
What an RNG does in a casino game
An online casino game needs a way to choose a result without a dealer, wheel or physical dice. The random number generator produces values. The game then scales or maps those values to visible results, such as a reel stop, a card order, a roulette pocket or a dice face.
Gaming Laboratories International says GLI-19 assesses RNG outcomes after scaling, shuffling or mapping, because the raw number is not the same thing as the result shown to the player.
The player sees an animation, but the decisive step is usually upstream of the animation. Some systems cycle in the background rather than waiting passively for a click. BMM Testlabs includes background cycling among the RNG subjects covered by its certification scheme.
Pressing spin or deal does not ask the game to decide whether a player is due a win. It selects or requests a value under the game rules, then the paytable and game maths apply. That distinction matters.
A fair RNG does not remove losing streaks, near misses or repeated outcomes. It only supports the rule that each result is generated through the approved mechanism, rather than through a decision based on the player, the account balance or recent results.
Pseudo-random and hardware generators
Most online casino systems use a pseudo-random number generator, often shortened to PRNG. This is software. It uses an algorithm and internal state, including a seed, to produce values that should be unpredictable to anyone without the necessary internal knowledge.
The UK Gambling Commission says software RNG output should be unpredictable without complete knowledge of the algorithm and seed value. That does not mean the software is magic. It means the output should not be practically forecast by a player, operator employee or outside attacker who does not have the protected internal information.
Hardware generators use physical entropy instead of relying mainly on software. Gaming Laboratories International says software-based RNGs derive randomness from a computer-based or software-driven algorithm, while hardware-based RNGs use small-scale physical events such as thermal noise or photon spin. iTech Labs says RNG implementations may use pseudo-random number generators or hardware generators, so both models can appear in regulated gambling systems. In either case, the generator is only part of the system.
The seed handling, protection of internal state, conversion to outcomes and release version of the game all affect whether the result shown to a player follows the approved design.
How RNG numbers become game results
The key fairness issue is not only the generator. It is also the conversion from generated values to game outcomes. Gaming Laboratories International says scaling, mapping and shuffling algorithms must be unbiased and verified by source-code review.
This is where many misunderstandings start. Players do not bet on a raw stream of numbers. They bet on a game result created from that stream under rules, paytables and mathematical settings.
Slots
In a slot, random values are mapped to reel stops or symbol positions. The reel strips and any weighting are part of the game design. Weighting does not mean the operator adjusts a spin after seeing the stake.
It means the approved game maths defines how often each mapped stop can occur. The visible spin is a presentation of that selected result. Autoplay, turbo modes and bonus animations should not change the underlying mapping. For a fuller slot-focused explanation, see how slot machines work.
Roulette and dice
In virtual roulette or dice games, generated values are scaled to a set of eligible results, such as pockets or faces. A clean mapping avoids accidental bias, such as leaving some outcomes with extra source values.
If a rule gives different results different chances, that must come from the published game design, not from a flawed conversion step. This is why labs review both the RNG output and the scaled output. The same idea applies to game shows with digital wheels, bonus pickers and other animated random choices.
Card games
Digital card games need a shuffled deck rather than a single isolated result. NIST defines the Fisher-Yates shuffle as randomly permuting N elements by exchanging each element with a random element from i to N, and says it runs in linear time.
In casino terms, the RNG supplies the random choices used by the shuffle, and the shuffle algorithm turns those choices into a deck order. The fairness question is not whether the resulting hand looks typical. It is whether the shuffle method gives the permitted deck orders the correct treatment under the rules.
How RNGs are tested and certified
Testing is designed to find bias, predictability and bad implementation. It does not prove that a player will like the next result. A certified game can still produce long losing runs, repeated symbols or unusual-looking sequences, because randomness includes clusters.
Statistical testing looks for patterns that should not be present in a compliant generator or in the outputs created from it. The test house also needs to understand the game, because an apparently clean raw generator can still be weakened by a poor scaling or shuffling method.
A serious assessment looks beyond the raw generator. Labs also examine the source code, the seed handling, scaling, shuffling and the final game output. That matters because a strong generator can still produce unfair game results if the conversion step is wrong.
Source-code review is also different from playing a few demo rounds. A short play session cannot prove that outcomes are distributed correctly.
Testing uses controlled samples, implementation review and certification records tied to a submitted product. The certificate should relate to the actual game build, RNG implementation or platform component being used, not just to a logo copied onto a website.
Test house or standard | What it covers |
|---|---|
GLI-19 is the Interactive Gaming Systems v3.0 standard. Chapter 3 sets RNG requirements, RNG statistical tests are evaluated at a 99% confidence level, and outcomes are assessed after scaling, shuffling or mapping. | |
eCOGRA says it offers RNG testing and certification in Great Britain, Malta and the Czech Republic. It says its certification applies to RNG-driven games such as slots, table games, virtual sports and video poker. | |
iTech Labs says RNG testing includes source code evaluation and testing of raw RNG output and scaled or shuffled output. It says an RNG certification is issued when the RNG and scaling pass testing. | |
BMM Testlabs | BMM Testlabs lists mathematics and RNG testing among its services. Its certification scheme covers hardware or physical RNGs and software pseudo-RNGs, including seeding, reseeding, scaling and background cycling. BMM says product certificates that can be uniquely identified and authenticated are generally valid indefinitely. |
NIST SP 800-22 Rev. 1a is titled A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications and was published in April 2010. It is a statistical test suite, not a casino licence. |
What regulators require
Regulators set the compliance rules that licensed operators and suppliers must meet. The detail differs by jurisdiction, but the common thread is that the RNG, the conversion to outcomes and the released game build must be testable. These rules are not the same as a strategy guide.
They do not make a game favourable to the player. They set controls for randomness, auditability, approved testing and game approval. The strongest practical signal is consistency between the operator licence, the game certificate, the supplier identity and the rules visible inside the game.
Regulator | Requirement |
|---|---|
RTS 7 applies to gaming including bingo, lotteries and betting on virtual events, and requires random number generation and game results to be acceptably random. Its implementation guidance says RNG output should be uniformly distributed over the entire output range, scaling must maintain RNG qualities, and adaptive behaviour, also called a compensated game, is not permitted. Its testing strategy says RTS 7A requires an approved third-party test house to perform statistical analysis of RNG and outputs before release. | |
The Malta Gaming Authority requires an RNG Test Certificate from an independent EU/EEA-based testing lab for approval of new games. | |
Office for the Regulation of Gambling, Slovak Republic | Slovakia's Gambling Act refers to a verified random number generator as the mechanism that generates the outcome of individual gambling games. |
How to check a game is certified
No single badge proves everything. Treat certification as a chain of checks: lab, licence, game rules and supplier identity should point in the same direction. If one part is missing, be cautious.
A real-money game should not rely on vague claims such as fair play, random results or audited software without a named licence, identifiable supplier and a certificate path that can be checked. Certification is also not a promise that withdrawals will be smooth or terms will be fair, so it should sit alongside wider checks on the operator.
- The test house seal and certificate: look for a named test house and a certificate that can be authenticated, not only a copied image in a footer. If the certificate names a platform or game component, check that it actually relates to the product being offered.
- The licence in the site footer and the regulator's register: compare the licence claim with the regulator's public information. For context on one major regulator, see the UK Gambling Commission licence guide. A licence claim should name the legal operator, not just a trading name.
- The game rules and RTP in the paytable: open the game information screen and check that the rules, bet limits and return information are visible. The concept is explained in how RTP works. If the rules are vague or unavailable, the player cannot properly understand what the RNG output is being mapped into.
- The game provider's own page: confirm that the game title, rules and supplier identity match the version you are playing. Fake copies often borrow familiar artwork or names, so the supplier trail matters as much as the logo.
Provably fair games
Provably fair games add a player-checkable audit trail. Provable.io describes a model using a server seed hash, a client seed and a nonce, then revealing the server seed after the outcome so anyone can check the hash and reproduce the result.
This does not mean the player can predict the next result before betting. The point is commitment and verification: the operator commits to secret data before the bet, the player-side data is included, and the final revealed data can be checked against the earlier commitment.
-
Server seed hash: before the bet, the game shows a hash commitment for the secret server seed. This is meant to prevent the server seed being changed after the result.
-
Client seed and nonce: the client seed is supplied or accepted by the player side, and the nonce changes as bets are processed.
-
Result: the game combines the inputs and converts the derived value into the game result under its published rules.
-
Server seed revealed and checked: after the outcome, the server seed is revealed, the hash can be checked, and the result can be reproduced.
Live dealer games: no RNG, different checks
Core live dealer results usually come from physical equipment: cards, wheels, dice or balls in a studio. The fairness checks therefore focus less on software number generation and more on procedures, equipment control, supervision and audit records.
The UK Gambling Commission's RTS 17 requires live dealer operations to be fair and independently auditable. That means the key question changes. Instead of asking whether a software generator was mapped correctly, the audit has to show that the physical game followed its approved procedures.
The same UK standard says video surveillance should record dealer activity in enough detail to confirm that procedures and game rules were followed. For live studio setups, the Malta Gaming Authority requires live studio location details and a floor plan, plus a list of all games and their game rules.
Live games can still use software for betting interfaces, result entry, settlement and monitoring, but the random event in the main game may be physical. A recorded and auditable studio process is therefore the live-game counterpart to an RNG certificate.
Can an RNG be rigged?
Yes, in the sense that an unlicensed or dishonest site can show fake games, copied certificates or results that are not produced by a certified system. That is different from a bad run on a legitimate random game.
Random play can look suspicious because clusters, repeats and near misses are normal parts of chance. A player cannot identify rigging just because several results feel unlikely. The better test is documentary: licence, supplier, certification, rules and complaint history. For slot-specific context, read online slots explained.
The practical defence is to avoid unknown operators, check the licence, verify the game supplier and read the rules before depositing. If a site blocks withdrawals, changes terms after play or cannot show credible certification, stop playing and keep records.
For broader warning signs, see how to spot a rogue casino. If gambling is causing stress or feels hard to stop, use gambling helplines and support services.
What this means before you play
A certified RNG is a fairness control, not a way to improve expected value. It helps ensure that the published game maths is followed. It does not remove the house edge, predict the next spin or make a game due to pay.
To understand that part, start with gambling maths, odds and probability. The same point applies across digital slots, virtual table games and shuffled-card games. Randomness can protect the integrity of the draw, but it does not change the underlying price of the bet.
The useful question is not whether a result feels random. The useful question is whether the game has a credible audit trail: regulated operator, certified RNG, clear rules, known supplier and visible return information. If you still choose to play, set limits before the first bet.
The guide to deposit limits, loss limits and reality checks explains the tools that can slow decisions down. If those checks are missing, the safer decision is not to test the site with real money.
Frequently asked questions
Are online casino RNGs truly random?
Software RNGs are usually pseudo-random, not physically random. Gaming Laboratories International describes software RNGs as algorithmic, while hardware RNGs use physical events such as thermal noise or photon spin. For regulated play, the key test is whether the output is unpredictable and statistically acceptable under the relevant rules.
Can a casino change the RNG?
A licensed operator cannot treat the RNG as a private setting to alter freely. The UK Gambling Commission's testing strategy requires approved third-party statistical analysis of RNG and outputs before release, and the Malta Gaming Authority requires an independent EU/EEA lab RNG Test Certificate for approval of new games.
What does provably fair mean?
Provably fair means the player can check that a result matches pre-committed inputs. Provable.io describes a process using a server seed hash, a client seed and a nonce, with the server seed revealed after the outcome so the result can be reproduced.
How do I know a slot is certified?
Check the named test house certificate, the operator's licence, the game rules and the supplier page. eCOGRA says its certification applies to RNG-driven games such as slots, and iTech Labs says testing includes source code evaluation plus raw and scaled or shuffled output.