Understanding RNG Testing and Game Fairness

You spin. The slot reels fly. Two wilds land, then a near miss. Your heart jumps. You think, “It knows.” It does not. But your brain wants a story. This guide cuts the noise. It shows how labs test the random number generator (RNG), how rules guard fair play, and what you can check yourself before you trust a game.

Quick takeaways

RNG decides results. RTP decides long-term payback. They are not the same.
Labs test RNG with strict stats and process checks. They also check change control and logs.
Real signs to trust: a valid lab certificate, a license from a known regulator, and fresh updates.
No test can promise wins. Tests only show that the game does not bias results on purpose.

What RNG is not

RNG does not make you win more after you lose. It does not “warm up.” It does not change because it is night. Random means runs and streaks will happen. You can get ten losses in a row and still be in fair land. Also, RNG is not RTP. RTP is the math plan for the game over a long time. RNG is the way each spin is picked. To see what rules say on this, read the UKGC Remote Technical Standards.

RNG 101, in plain words

An RNG is a tool that makes a stream of numbers that look random. In games it is usually a PRNG (pseudo random number generator). It starts from a seed, runs a function, and makes a long line of numbers. A CSPRNG (a crypto version) is stronger and harder to guess. Both need good seeds. Seeds come from things like system noise, time, or a special chip. Good entropy (hard-to-guess bits) is key.

How labs test: more than “pick a few spins”

Labs do not just spin a slot and say “looks fine.” They look at code, logs, and build control. They also run stats tests on big data sets. They check if numbers are spread out well (frequency), if runs are not odd, if bits do not “echo” each other (serial, auto-correlation). They use p-values to judge if a result fits the random model. Some tests will fail by luck, so they look at the set as a whole. A classic suite is the NIST Statistical Test Suite (STS).

From standards to real papers you can read

Many markets use the GLI rule set for online games. It maps what labs must check, from RNG to logs and security. If you want a base doc, here is the GLI-19 interactive gaming standard. A lab can test a game or a platform against GLI-19 and then issue a report or a letter.

Who else checks: eCOGRA, and what that seal means

eCOGRA is a known lab. If you see their seal in a site footer and click it, it should take you to a live page with a cert ID and scope. Here is where to learn what that seal is: eCOGRA RNG certificate. The key is the link must point to their domain, not just an image.

Why “ISO/IEC 17025 accredited” matters

This line means the lab itself was checked and meets global rules for how to test and report. It is a meta-check on lab skill. You can read what it covers here: ISO/IEC 17025 accredited. It adds trust that methods and gear are sound.

Reality check: what you can and cannot verify

You can check the casino license page and see the regulator.
You can click the lab seal and see a live cert page with an ID and date.
You can search the lab’s site for the cert ID and see if it is still valid.
You cannot re-run full lab tests at home on a live slot. You do not have the raw number stream.
You cannot see secret seeds or keys. Labs can, under NDA, and regulators can audit.

Rules differ by place: a quick tour

In New Jersey, tech rules are strict, and the regulator has its own lab. Read the New Jersey DGE technical requirements. They check RNG, security, and change control before games go live.

In the EU: what MGA looks at

Malta is a key hub for online play in the EU. The MGA fairness requirements point to lab checks and strong logs. Many providers that serve the EU carry Malta or other EEA licenses.

One place where your research helps (and a note on bonuses)

As a player, you want all facts in one spot: the license, the lab, and the cert page. Good review sites collect this and add simple notes on audits. If you also want a clear, no-fluff guide on how casino bonuses work, see this resource: how casino bonuses work. It explains bonus terms in plain steps, which helps you avoid traps while you focus on game fairness checks.

How to read an RNG certificate

Issuer: the lab name and address.
Certificate ID: a number or code you can copy and search on the lab site.
Scope: what parts were tested (RNG module, game math, platform).
Version: build or game version tested. This ties the cert to code.
Date: issue date and, if shown, expiry or review cycle.
Owner: the company that holds the cert (studio, platform, or casino).
Verify link: a URL on the lab site that shows the live record.

Deep tests: when do they use TestU01?

For very deep checks, some labs or dev teams use the TestU01 battery. It is hard, long, and picks up subtle flaws. It is not a “cert,” but it adds extra proof that a stream holds up under stress.

Common RNG tests and what they really prove

The table below links tests and standards to what they check, who uses them, what proof you get, and how that helps you as a player.

NIST STS (Frequency, Runs, etc.)	Uniform spread, independence, bit patterns	Labs, dev teams	p-value report, pass/fail per test	No simple bias in sample data	Not a product cert; used inside lab work	NIST STS project
TestU01 (SmallCrush, Crush, BigCrush)	Hard stress tests for deep flaws	Researchers, senior QA	Long report; research notes	High bar for RNG quality, not a legal need	Not tied to a license by itself	TestU01 page
GLI-19 (Interactive Gaming)	RNG controls, game logic, security	Labs, regulators	Compliance letter or cert	Meets a wide, known industry bar	Periodic reviews; scope lists modules	GLI standards
eCOGRA RNG	RNG design review + stats tests	Labs, platforms	Public cert page with ID	Seal links to live record; check date	Renewal cycle varies by client	eCOGRA site
iTech Labs RNG	RNG code review + test report	Labs, studios	Public cert page per client	Shows module passed lab checks	Scope may be per game or engine	iTech Labs directory
ISO/IEC 17025 (Lab level)	Lab skill and method quality	All accredited labs	Accreditation record	Trust the lab’s process, not a game	Ongoing audits of the lab	ISO page

Other labs you will see

BMM is one of the oldest gaming labs. They issue game and platform certs and list methods on their site. See BMM Testlabs certification for their scope and news.

For developers: how to prepare for an audit

Keep strong logs: RNG calls, seeds (not values, but events), and build hashes.
Manage seeds: use good entropy; never reuse; record how seeds are made.
Repro builds: lock versions, pin deps, and tag releases.
Access control: limit who can change code; record all merges and hotfixes.
Change management: document every change to math or RNG; update cert scope.

Another lens: Canada’s AGCO

Ontario set strict rules for iGaming. They point to lab checks and to strong security. Read the AGCO Registrar’s Standards to see how they frame fairness and logs.

CSPRNG vs PRNG: when to use which

For games, a high grade PRNG is often fine if seeds and code are strong. For secure draws, shuffles, or where the stream must resist guess work, a CSPRNG is better. Weak seeds kill both. If an attacker can guess the seed, they can track the stream.

Myth-busting

“The casino flips a switch after lunch.” No. Live changes go through controls and audits. Labs check this.
“A cert lasts forever.” No. Code changes can need a new review. Check dates.
“High RTP means nicer RNG.” No. RTP is payback math, not randomness.
“I lost ten times, so it is rigged.” Streaks happen in fair play.

Entropy and health tests

Good RNG starts with good entropy. Labs may look at how entropy is made and if the system runs health tests to spot faults. For a deep but clear standard, see NIST SP 800-90B. It sets how to judge entropy sources.

Do this now: a simple fairness check

Find the casino license in the footer. Click it. See if the page is on the regulator’s site.
Look for lab seals (eCOGRA, GLI, iTech Labs, BMM). Click to the live cert.
On the cert page, check owner name, scope, date, and a verify link.
Search the cert ID on the lab site. If no match, ask support or be careful.
Do not mix RTP with RNG. A 97% RTP game is still random spin by spin.
Avoid sites with no license info or fake seals (images with no link).

A quick case: reading a public RNG cert

Say you click a seal and land on a lab page. You see: Issued to “ABC Studio Ltd,” Certificate ID “RNG-2026-045,” Scope “RNG v3.4.1, platform v2.9,” Date “2026-04-18,” and a “Verify” button. Good signs: the domain is the lab’s; the scope names the module; the date is recent; the owner is the studio, not a random shell. If the site updates the game to v3.4.2 next month, look for an addendum or a fresh entry.

State labs exist too

In Nevada, the regulator runs its own test lab and works with suppliers before release. This adds one more line of defense. Read more at the Nevada Gaming Control Board lab.

iTech Labs: where to confirm a cert

Many providers use iTech Labs. They keep a public list by client. To check a claim, go to the iTech Labs RNG testing directory and search the company or cert ID. The page should match what the casino shows.

What audits do not cover

User behavior: labs do not rate “how fun” or “how sticky” a game is.
Bankroll risk: RNG can be fair while variance is still high.
Your device or link: lag or browser bugs are outside scope.
Bad bonus terms: lab work does not police promo fine print.

For B2B teams: controls you should lock down

Version control: tag RNG module and math tables; audit trail on merges.
Supply chain: pin crypto libs; watch CVEs; sign builds.
Independent code review: fresh eyes on RNG, seeding, and error paths.
Rollout plan: staged releases; hash check post-deploy; alert on drift.

FAQ

Can casinos flip a switch after certification?
No. Changes go through change control. Labs and regulators can demand new tests. Sudden, secret changes risk license loss.

What is the difference between RNG fairness and RTP?
RNG fairness is about random choice each spin. RTP is long-term payback by design. A fair game can still drain a bankroll fast due to variance.

Are crypto “provably fair” systems better than lab-certified RNGs?
They are different. Provably fair lets you check seeds and hashes for one session. Lab certs check code, process, and stats across builds. Some sites use both.

How often do RNG certifications need renewal?
It depends. Some are per version; some have a review cycle. Any code change to RNG or math can need a new review or addendum.

Can I run NIST STS or TestU01 at home to verify a slot?
Not on a live game. You do not get the raw RNG stream. Labs test with direct access to the generator and code.

Do different places require different RNG standards?
Yes. The UK, NJ, Malta, Ontario, and Nevada all have rules. Many use GLI-19 or a close match. Always check your market’s regulator page.

Read the fine print, then act

Fair play is not an icon in a footer. It is a chain: good seeds, strong code, strict labs, clear scope, and fresh updates. You can spot most of this in minutes. Check the license. Click the seal. Read the cert. If it is missing or stale, pick another site. Your choices push the market to stay honest.

Educational only. Not legal advice. Gambling has risk and may be restricted where you live. 18+ or 21+ as your laws require. We may receive compensation when you visit partners via our links.

Last updated: 20 June 2026 • Reviewed by: Compliance Editor (iGaming QA)