How RNGs and game fairness are certified

What an RNG does

Every modern slot, virtual table game and digital draw is driven by a random number generator. Each time a game needs an outcome, it draws a value from the RNG and maps it onto a result — a reel position, a card, a number. For the game to be fair, those draws must be unpredictable and evenly spread across all possible values, with no bias that a player or operator could exploit.

Testing for unpredictability

To certify an RNG, a laboratory subjects its output to a battery of statistical tests. These look for any departure from true randomness: repeating sequences, values that appear more often than they should, or correlations between one draw and the next. The output has to pass recognised randomness test suites before the generator is considered sound. Because the analysis is statistical, it is run over enormous samples rather than a handful of rounds.

Verifying return-to-player

Alongside randomness, the laboratory checks return-to-player (RTP) — the share of total stakes a game returns to players over the long run. The maths model behind a game states a theoretical RTP; the lab verifies it by simulating the game across a very large number of rounds and confirming the measured payout matches the model within statistical tolerance. If the code and the model disagree, the game fails.

Standards and re-testing

For online games this work is usually carried out against the GLI-19 standard, by a laboratory accredited under ISO/IEC 17025. The resulting certificate is tied to a specific build of the game. Any later change to the paytable, the feature logic or the RNG implementation invalidates the certificate and requires the game to be tested again.

True randomness versus a pseudo-random generator

Almost every digital game uses a pseudo-random number generator — an algorithm that produces a stream of numbers which, though ultimately deterministic, is statistically indistinguishable from true randomness when it is correctly designed and seeded. The distinction matters to testers. A pseudo-random generator is judged not on being unpredictable in principle, but on whether its output withstands a battery of statistical tests for uniformity, independence and the absence of repeating cycles within any realistic amount of play. A poorly seeded or weak generator can betray patterns; a sound one does not, and telling the two apart is precisely the laboratory’s task.

Seeding, entropy and cycle length

Two properties receive particular attention. The first is the seed — the initial value from which the sequence is generated, which must itself come from an unpredictable source of entropy so the stream cannot be reproduced or anticipated. The second is cycle length: the point at which a sequence would eventually repeat. A generator used in gaming must have a period so long that repetition is impossible within any conceivable amount of play. Testing examines both, along with the mapping that turns raw numbers into game outcomes — since even a flawless generator can be undermined by a biased mapping.

Why any change means re-testing

A certificate describes one build at one moment. If the paytable, the feature logic or the generator implementation is altered — even slightly — the guarantees no longer hold, and the modified game must be submitted again. This is why the version identifier on a certificate matters: it ties the guarantee to a precise build that a regulator can match against the software actually running at a casino.

Reading on: how to read a certification report, and how to verify a casino’s licence.