How RNG Certification Works for Online Table Games
RNG certification is the backbone of fair online gaming. Here is how it actually works, what gets tested, and what companies like eCOGRA and GLI verify.
Random Number Generation is the foundation of all online casino games. When you click deal on a blackjack hand, a random number generator (RNG) selects the cards. When you spin a slot machine, an RNG selects the reel outcome. The question is: is it actually random? And how do we know?
What an RNG Certification Tests
An RNG certification is conducted by independent testing laboratories. The major certifiers are eCOGRA, GLI (Gaming Laboratories International), BMM Testlabs, and a handful of others. Each conducts similar tests, though the scope and depth can vary. A typical certification involves the following:
First, source-code review. The lab examines the actual software code that generates random numbers. They look for hardcoded biases, patterns, or back-doors that would allow manipulation. A competent RNG should have no obvious vulnerabilities. The code should use a cryptographic algorithm. The lab checks whether the algorithm is industry-standard, like the Mersenne Twister or a NIST-approved cipher.
Second, seeding procedure review. An RNG is only as good as its seed, the initial value that starts the sequence. If the seed is predictable, the entire sequence is predictable. The lab verifies that seeds come from a high-entropy source. This usually means tapping into either system entropy (gathered from operating-system randomness) or a hardware random number generator that pulls from physical processes like atmospheric noise.
Third, statistical testing. The lab generates millions of random numbers and subjects them to statistical tests. The NIST test suite includes tests like the monobit test (checking that 0s and 1s occur with equal frequency), the runs test (checking that the sequence does not have long runs of the same bit), and the entropy test (verifying that the output has appropriate randomness characteristics). These tests are not subjective. They are mathematical; they either pass or they fail.
Fourth, output-frequency analysis for games. For card games and dice games, the lab analyzes whether each outcome (each card, each number) appears at the expected frequency over millions of deals. If hearts appear significantly more often than diamonds, the RNG has a bias. If the number 17 appears significantly more often than 13 in a dice game, something is wrong.
What Gets Certified and What Doesn't
RNG certification applies to the software engine, not to the casino operator. Evolution Gaming's RNG is certified. Pragmatic Play's RNG is certified. The certification says: "We tested this piece of software and it generated random numbers properly." It does not say: "This casino operator is honest." That is a different audit.
The operator is responsible for ensuring that the certified RNG is the actual RNG being used in production. They cannot pull a RNG from a test environment and say it has been certified, then run a different one live. Regulators audit operators to prevent this. But the certification itself is on the software.
Additionally, certification is often snapshot-based. A company certifies RNG version 4.2. If they update to version 4.3, that version should be tested again. In practice, if the change is minor (a bug fix, not a logic change), some regulators allow it without full retesting. Major updates require new certification. This is where operators sometimes cut corners. A regulator might discover that a casino deployed an uncertified version and face fines.
The Limits of Certification
RNG certification does not guarantee that a specific game is fair in perpetuity. It certifies the RNG at a moment in time, on a specific version, in a specific configuration. If the operator manipulates the game logic after certification (changing payout tables, adjusting the algorithm, adding a back-door), the certification becomes meaningless.
This is why operator audits matter. Regulators like the MGA, UKGC, and Curaçao eGaming conduct unannounced audits. They pull live game sessions and check that the certified RNG is actually in use. They verify that the payout percentages match the certified specs. They check for signs of manipulation.
Also, RNG certification tests for randomness, not for game-design fairness. A roulette RNG can be perfectly random while a roulette game is mathematically unfair. For instance, if an RNG selects a number between 0 and 37 (twenty-six percent spread between spaces), the distribution is uniform, but the game structure (zero and double-zero) ensures the house edge. The RNG is random. The game is fairly structured to favor the house.
Players sometimes confuse RNG certification with guarantee of profitability. It is not. The RNG can be perfectly random, and the player can still have a negative expected value.
How to Verify Certification
Most casinos publish their certifications on their website, usually in the footer or under "Safety" or "Licensing." Look for names of testing labs you recognize. eCOGRA and GLI are legitimate. There are fake certs out there (scam casinos claiming certifications they do not have), so verify the name. Search for "eCOGRA certificate [casino name]" and see if it appears on eCOGRA's public register.
Check the date. If a cert is from 2019 and the software has been updated three times since, that cert is outdated. Ask the casino whether they have newer certifications. Ask which version of their software is certified.
Final point: certified RNG does not compensate for operator malfeasance. A certified, fair RNG running at a rogue casino is still worthless if the casino can refuse withdrawals or manipulate your account balance. Certification is necessary but not sufficient. You also need a licensed operator, regulatory oversight, and your own skepticism.
