Home

Casino RNG Testing: Labs, Certificates, and What They Mean

You hit a big bonus. Then the slot goes ice cold. You start to think, “Did they flip a switch?” This thought is common. The truth is less dramatic. Games use a random number generator (RNG). That RNG is tested by labs. The tests are formal. The rules are strict. But a badge on a footer is not the whole story. This guide shows what labs do, what certificates say, and how you can check them fast.

We will keep it plain. We will show names you can trust. We will also show the gaps, so you know when to ask more.

First, what “random” means in casino games

Three parts matter here. RNG is the engine that picks outcomes. RTP (return to player) is the long-term payback rate from the math of the game. Volatility is how bumpy the ride feels spin to spin. The RNG does not change the RTP. It just turns the math plan into results. This is key when you judge a test or a badge.

If you want to see real, tested brands and how we check them, see independent reviews and fairness checks at no-account-casino.org. We group operators by license, lab tests, and public cert links where we can.

There are two main RNG types. A PRNG (pseudo RNG) is software. It uses a seed and a formula. It runs fast and is the norm online. A TRNG (true RNG) uses noise from hardware. It is more rare online. A good PRNG with strong seeding is fine for games. Labs focus on how it is built, how it is fed with entropy, and how the code handles versions and changes.

Labs that test RNGs need formal approval. The base is ISO/IEC 17025 accreditation. This shows the lab can run tests, keep records, and stay independent. It is not a game badge. It is the base rule for the lab itself.

Who tests, and who watches the testers

Accreditation says a lab can test. It does not say a game passed. To add trust, labs are part of a global deal of peer trust. You may see “ILAC MRA” on a lab site. The ILAC MRA is a list of bodies that agree on how to judge labs. This reduces “lab shopping” and keeps methods aligned across borders.

How do labs test? Two paths. “White-box” checks the source code, build process, seeding, and logs. “Black-box” treats the RNG as a sealed unit. The lab runs large data sets and checks stats. Good labs do both. They also check change control: if the code or build number changes, the cert may need a re-test.

Many tests are tied to GLI standards. GLI is a big lab and a standards author. For machines, see GLI-11: Gaming Devices. It sets rules for RNGs, meters, and game logic. For online play, see GLI-19 standard. It covers servers, security, and fairness for remote games.

What gets tested, exactly

Scope matters. A lab can test a game engine (shared RNG), a single game math model, or a full platform. eCOGRA runs RNG and game tests, plus reviews of change control and audits at set times. See their page on eCOGRA RNG testing for the kinds of checks they do.

Another large lab is iTech Labs. They test PRNGs with long sample runs, check seed use, and review code and builds. Their method is public here: iTech Labs RNG testing.

BMM Testlabs is also well known. They test online RNGs, platform links, and game rules end to end. See an overview here: BMM Testlabs online gaming.

Labs run standard stat tests. A common set is from NIST. The suite is called NIST SP 800-22. It checks bits for bias (too many 1s), runs (too many streaks), and other patterns. It looks at blocks, ranks, FFT, and more.

Some labs also use heavy tools like the TestU01 battery. It has “SmallCrush,” “Crush,” and “BigCrush.” These suites stress a PRNG in many ways. Code that passes these is hard to fake and is stable for long runs.

Standards cheat sheet (quick read)

GLI-11: device rules for RNGs, meters, and logic (land-based focus).
GLI-19: online gaming systems, security, and fairness.
UKGC RTS: core rules for online play in the UK (we linked it above).
Other EU-recognized labs include QUINEL and SIQ Gaming.

Major RNG testing labs at a glance

Not all labs show the same level of public detail. Some host public lookups. Others issue PDFs to the game provider, who may or may not post them. Use the table to see who tends to publish more, where their work is often accepted, and how to verify.

Gaming Laboratories International (GLI)	Yes (multiple sites)	Varies by client; some PDFs public	GLI-11, GLI-19, UK/EU/US rules, NIST tests	North America, EU, UK, LATAM, APAC	Often cited by regulators; public links depend on provider
eCOGRA	Yes	Often yes; seal pages for clients	RNG, RTP audits, security, platform	UK, EU, many dot-coms	Clear client lists; some cert PDFs
iTech Labs	Yes	Often yes; client certificate pages	RNG, RTP, platform, markets rules	EU, UK, ANZ, parts of North America	Many public client certs; detail varies
BMM Testlabs	Yes	Limited; more via client sites	RNG, platform, security, device	US states, EU, UK, Canada, LATAM	Press notes and client PDFs more common than a search portal
TRISIGMA	Yes	Limited	RNG, devices, online platform	EU, select other markets	Public info tends to be case by case
Gaming Associates	Yes	Some client cert pages	RNG, security, ISO audits	ANZ, EU, dot-coms	Look for client subpages for cert PDFs
QUINEL	Yes	Limited; client PDFs	RNG, devices, online	EU, LATAM	Public proof often hosted by clients
SIQ	Yes	Limited	RNG, devices, platform	EU	Check with operator or regulator for cert copies

How to read an RNG or game certificate

A real cert is not a logo. It is a document. It should show: the product or provider name, the game or engine ID, version/build number, the standard used (GLI-19, UKGC RTS, etc.), the date, and the scope (what was tested). Many also include a file hash or signature for the build. In some regions, the regulator also runs its own test lab. New Jersey is a good model. See the New Jersey DGE game testing page for how they do it.

Each place has its own twist. In Ontario, the AGCO sets rules for online games and systems. You can read the AGCO iGaming Registrar’s Standards to see what a game and its RNG must meet. The EU often defers to labs on the list of approved bodies, plus ISO rules. The UK relies on approved test houses and the RTS.

Land-based games also have device-level rules. Nevada’s rules are strict and detail heavy. See the Nevada Technical Standards for Gaming Devices. If a device or game math changes, it may need a re-test. Good certs make the version and date very clear so you can tell if a change is covered.

Myths, red flags, and limits

Myth: “A certified RNG pays more.” Not true. RNG is about random picks. RTP is the long-term payback that the math model targets. A fair RNG can drive a low RTP game, and it is still fair. Some PRNGs use crypto-grade parts called DRBGs. If you want to read the core spec, see NIST SP 800-90A DRBG. Labs do not force a casino to set a high RTP. They do force the game to act as its math says.

Red flags: a site shows a “Certified” badge with no link; a PDF with no provider name or wrong version; a cert that is years old while the game shows a new build; a lab that is not on any ISO or ILAC lists; a mismatch between license and test lab name. For crypto “provably fair” claims, look for real details: a seed, a client seed, a server seed hash, and a way to check with SHA-256 or HMAC. The core docs are FIPS 180-4 (SHA-256) and, for the MAC part, FIPS 198-1 (HMAC). Note: “Provably fair” is not the same as a lab cert. It is a public check tool, not a formal audit.

A patch, a re-test, and what happens next (mini case)

Say a studio ships Slot X v1.2.0 with a lab cert. Weeks later they tweak the math to smooth a bonus. The build becomes v1.2.3. That is a change to the math, so the old cert is not valid for this build. The studio sends code and math to the lab. The lab re-runs RNG checks and math checks. The regulator may require a halt until the new cert is in. A good operator will swap in the new cert the same day they ship the patch. If you cannot find it, ask support to share the updated PDF or link to the lab’s page.

Verify a casino’s RNG or game cert in three minutes

Find the casino license on the footer. Note the regulator (UKGC, MGA, NJ DGE, AGCO, etc.).
Open the game. Click “Help,” “About,” or the “i” icon. Write down the provider, game ID, and version/build.
On the casino footer, click the test lab logo. Or search the provider’s site for “certificates” or “RNG.”
Open the PDF or page. Check the provider and game/engine name. Check the standard (GLI-19, UKGC RTS, etc.). Check the date.
Look for a hash or signature if listed. It should match the build or file noted in the cert.
If there is no public link, ask support for the latest cert for that game or engine. If needed, email the lab or check the regulator’s portal.

If you choose to play, set limits and gamble responsibly. Do not chase losses.

For game developers: build for testability

Use a well-known PRNG or DRBG. Manage seeds with care. Log seed source and time.
Support deterministic replays for auditors. They should be able to feed a seed and replay outcomes.
Version everything. Put build numbers in the game “About” screen and in release notes.
Lock change control. Small math tweaks must bump a version and flag a re-test.
Secure your RNG source. Protect against time-based bias, clock drift, or poor entropy.

FAQ

Are online slots rigged if they have a certificate?

No. A real cert says the RNG and the math act as claimed. It does not mean you will win. The game can still have high volatility. A short run can look bad even when the long run is fair.

How often are RNGs re-tested?

It depends. Many labs do annual or periodic reviews. Any change to the RNG engine, the math, or the build that affects outcomes should trigger a re-test. Some regulators also run spot checks.

Who recognizes which labs?

Most regulators accept labs with ISO/IEC 17025 and ILAC MRA backing. Local rules then add more. For example, UKGC, MGA, NJ DGE, and AGCO each keep lists of approved test houses. Check the regulator site if in doubt.

What is the difference between “provably fair” and a lab-certified RNG?

“Provably fair” lets you check a play with public hashes and seeds. It is a player tool. A lab cert is a third-party audit of code, math, and change control. Both can help, but they are not the same thing.

Why certificates still need your eyes

RNG testing is strong when the scope is clear, the version is current, and the lab is accredited. But a logo is not proof. A PDF with no build is not proof. A claim with no lab name is not proof. When in doubt, do the three-minute check. If you want a short list of operators who publish real certs and show current builds, our team keeps notes and links at no-account-casino.org (see the link above in the “random” section).