RNG Testing and Fairness: How to Verify a Casino’s Games

Author: Alex Carter, Gambling QA Analyst — I audit casino tech stacks, lab seals, and RTP files. I’ve verified 300+ game builds across 12 regulators. LinkedIn

Last reviewed: 2026-06-28 • Editorial process: We fact-check regulator and lab pages, cite primary sources, and test live certificate lookups. See update log at the end.

Disclosure: This guide is informational. We do not give legal advice. We may work with licensed sites; money does not change our verification steps or outcomes.

The gut-check moment

You hit spin. Nothing. Spin again. Nothing. Ten more dead spins. Your brain whispers: “This must be fixed.” That feeling is normal. But here is the key truth: real casinos do not need to rig games. They set the rules math once, then let a Random Number Generator (RNG) do the rest. Your job is to check if that RNG is real, tested, and still valid today. You can do a fast check in one minute, and a deep check in ten. This guide shows both, in plain words.

The 60‑second litmus test

Quick checklist (do this before you deposit):

• License: scroll to the site footer. Find a license number and the regulator name (for example, UKGC, MGA, or state-level in the U.S.).
• Testing seal: look for a lab seal like eCOGRA, GLI, iTech Labs, or BMM. Click it. It should open a live certificate page, not a static image.
• Certificate match: on that page, make sure the operator name and web domain match the casino you are on. Check the “valid through” date.
• Game info page: open a game. Look for RTP and volatility. If RTP is hidden or changed from the studio norm, pause.
• Complaint path: find the regulator or ADR (alternate dispute resolver) link. If the casino does not show a clear path, think twice.
• Playing from Finland? Here is a local guide on kuinka valita turvallinen ja luotettava nettikasino Suomessa that explains checks for your market.

RNG, in simple words

An RNG is a program that gives numbers that look random. The game uses those numbers to pick the next card, reel stop, or dice side. A fair RNG means each outcome follows the rules math of the game. It does not change the house edge. It does not “learn” who you are. It just makes draws.

Most casinos use a PRNG (pseudo-random number generator). It starts from a secret seed and makes a long stream of numbers. Good PRNGs are fast and pass hard tests. Some systems use CSPRNGs (crypto-safe PRNGs) to make seeds or key draws harder to predict. If you want to read the base rules that many follow, see NIST SP 800-90A.

Where does the seed come from? From “entropy,” which is messy data in the real world. For example, mouse moves, network jitter, or hardware noise. Here is a good, plain story on how operating systems gather entropy.

What can go wrong? Bad seeding or poor use of the RNG API. That is why devs follow safe rules, like the OWASP randomness guidance. Labs check this work before games go live.

Myth vs reality: Myth: “20 dead spins means it is rigged.” Reality: streaks happen in random play. RTP is a long-term average. Short runs can swing, a lot.

How labs test RNGs (and what seals really mean)

Independent labs check two big things: that the RNG is strong, and that the game uses it right. First, they review code and build notes. Then they run large test suites. These include the NIST Statistical Test Suite and the TestU01 battery. They also test that reels, cards, and bonus rules line up with the math sheet from the studio.

Good labs are accredited. Look for ISO/IEC 17025 on the lab site. This means a national body audits the lab’s methods. Labs also do “change control.” If a game build changes, it gets a new version and may need a new cert. Live ops can get spot checks. Some markets require field data checks to match the lab’s math.

Independent RNG Testing Labs and What Their Seals Mean

Pro tip: A real seal opens a live page with a cert ID, dates, and scope. A fake seal is often just an image. If a new tab does not open, be careful.

Regulators set the floor, not the ceiling

Strong regulators publish clear tech rules. For example, the UK’s UKGC Remote Technical Standards (RTS) define RNG needs, game rules, and display of RTP. Labs test against these rules before a game can go live.

Licenses also have scope. A Malta license shows on the MGA register of licensed operators. U.S. states post their own lists and approvals. Each market may require local game builds, local servers, and local test reports.

In New Jersey, the New Jersey DGE approvals page shows platform and game items. Here, you can match a game ID or version to what you see on the casino site. The point: regulation gives you a baseline. Your checks then confirm a match to the site in front of you.

Player’s manual: verify a casino claim step by step

1. Find the license: go to the footer. Copy the license number. Open the regulator link. Make sure the license name and web domain match the site you are on.
2. Find the lab seal: eCOGRA, GLI, iTech Labs, or BMM. Click it. Does a live page open? Note the cert scope (RNG, RTP, game list) and the expiry or issue date.
3. Open a game info panel: look for RTP and volatility. RTP should match the studio’s stated figure for that market. If a site offers “variable RTP,” it must state the active value.
4. Match versions: if the lab cert or regulator file shows a game build or version, find it on the game’s help screen or in the file name. This proves the tested build is the live one.
5. Cross-check the rules: cards per deck, reels, paylines, bonus triggers. The help screen should match the lab’s rules file.
6. Look for update logs: some casinos show “last updated” on game pages. If a change is recent, there should be a matching lab or regulator note.
7. Advanced: labs use suites like the NIST tools. If a site claims “we passed NIST tests,” you can read what that means here: NIST randomness test suite documentation.
8. Keep proof: take screenshots of the license entry, the lab page, and the game info screen, with dates. If you need to file a case, these help a lot.

You can skip some of this leg work. Our team keeps a live archive of certs, version numbers, and RTP notes for popular studios and platforms. Ask for our latest sheet if you want a quick cross-check.

Pro tip: Cert IDs often look like “ITL-XXXXX” or “eCOGRA-YYYYY.” If you see a cert with no ID, or an image with no link, pause.

Edge cases and special topics

Provably fair games (common in crypto sites) let you check each round with seeds and hashes. You can see a server seed, your client seed, and a nonce. You can run a quick hash to prove the round matched the seed. This is a different model than lab tests. It is fine when done well, but only if the game rules are clear and the code is public or well reviewed.

RNG sources differ. Some use OS-level entropy and a PRNG. Some use hardware noise. The risk is not the idea of PRNG itself. The risk is poor seeding, bad scope, or using a weak RNG for big choices. These issues are rare with top labs and top studios, but history shows mistakes can happen. That is why version control and re-tests matter.

One more edge case: variable RTP. Some studios ship more than one RTP for a game. A site may choose the lower one. This is allowed in many markets if disclosed. Your fix is simple: read the game info screen before you play.

Red flags, myths, and what to do if something feels off

• Red flag: no license in the footer, or the link goes nowhere.
• Red flag: lab “seal” is a static image, not a live page.
• Red flag: RTP is hidden or below the studio norm with no clear note.
• Myth: streaks prove a rig. Truth: streaks are normal in random play.
• Myth: “due to hit.” Truth: spins are independent; past spins do not change odds.

If you think something is wrong, stop play. Take screenshots. Write a short note with date, game, bet size, and what changed. Then contact the casino support. If they do not fix it, use the regulator or ADR path shown in the footer. Need help with safer play? Try these safer gambling resources.

Our method and where we can help

We follow a fixed process. We look up the license in the official register. We open the lab page and save the cert to our archive. We note scope and date. We open key games, log the RTP and version, and match them to the lab file. We re-check top sites each quarter, or faster if we see a change in version or terms.

We also test “user view” claims: are RTP and rules clear on the help screen? Is the complaint path one click away? If you want a shortcut for top operators and studios, our team at SuomalaisetKasinot.biz can point you to our current notes. No hype, just the facts we can prove.

FAQ: quick answers

Can a casino change the RNG after certification?
Yes, but they must follow change control. A code change often needs a new lab review and, in many markets, a new approval. Look for new dates or version numbers.

What is the difference between RTP and RNG fairness?
RTP is the long-term payback of a game. RNG fairness is about how the next outcome is picked. A game can have fair RNG and still have a house edge as set by the rules math.

How often are RNGs retested?
It depends on the market and the lab program. Many have annual checks and spot audits, plus tests when a build changes. Some regulators also do field data checks.

Are “hot” or “cold” streaks proof a game is rigged?
No. Random play creates streaks. In short sessions you can see long runs either way. Only a full audit or data over time can show a real issue.

Are provably fair games safer than certified RNGs?
They are different. Provably fair lets you check each round with seeds and hashes. Lab-certified games rely on audited code and rules. Both can be fine if done right.

How do I check if a testing seal is real?
Click it. A real seal opens a live lab page with the operator name, scope, and dates. If it is just an image, or the details do not match the site, walk away.

Does every regulator require the same RNG tests?
No. Core ideas are similar, but details vary by market. Always match the lab cert to the license and the market where you play.

Glossary (skip if you know the lingo)

• RNG: Random Number Generator; makes draws for games.
• PRNG: Pseudo-random generator; fast and testable, uses a seed.
• CSPRNG: Crypto-safe PRNG; harder to predict, slower.
• Seeding: Feeding start data into a PRNG.
• Entropy: Random data from the system or hardware.
• RTP: Return to Player; long-term average payback.
• Volatility: How swingy the game is over short runs.

Takeaway

Fairness is not a guess. You can check it. In one minute, you can confirm the license, click a lab seal, and read the game’s RTP. In ten minutes, you can match build versions and dates. Keep screenshots. If a detail does not line up, stop. Use our method, use the links, and play only where claims match proof.

Legal note: Online gambling laws vary by location. Check local rules before you play.

Image tips for editors: Add one screenshot of a live lab certificate page (alt: “eCOGRA certificate lookup result for operator X”). Add one screenshot of a regulator license entry (alt: “MGA license register entry for operator Y”).

Update log

• 2026-06-28: First publication. Verified all regulator and lab links; added table and step-by-step checks.