How RNG audits work

On this page

1. The promise vs. the proof
2. What labs really test (plain English)
3. The certificate: quick checks that catch 80% of issues
4. Major RNG test labs, at a glance
5. Why your jurisdiction matters
6. DIY: from badge to evidence in 8 steps
7. RTP, RNG, volatility: clear lines
8. Live dealer and edge cases
9. Crypto corner: “provably fair” you can actually check
10. Red flags and quick wins
11. Mini case: a 10‑minute check that paid off
12. Responsible play note
13. FAQ: fast answers
14. The takeaway (with a one‑page checklist)
15. Method and source hygiene
16. Author and update
17. Link index (for reference)

You spot a badge that says “independently tested RNG.” It looks good. But you still wonder: is this real? Can I check it myself? You can. And it does not take a math degree. This guide shows the simple checks that catch most fake or weak claims. It also explains what labs do, what a good certificate looks like, and how rules in your area raise the bar.

Two ground rules before we start. Fairness does not mean you will win today. It means the game follows set math with true random picks. Also, a lab check is not a shield against all risk. It is one strong sign among many. Now, let’s turn badges into proof.

The promise vs. the proof

Casinos talk about “fair RNG,” “certified games,” and “tested math.” These lines are fine, if true. Here is the key split: a fair RNG means each spin or card comes from a random draw. It does not remove house edge. It does not smooth luck. A slot can be fair and still have long dry runs. That is variance, not a flaw.

What can you check? Look for three things: an actual lab certificate you can trace, a regulator who sets rules, and game info that matches the claim on the site. Many markets demand this. See the UKGC Remote Technical Standards for a clear view of how remote games must work and report.

What labs really test (plain English)

Labs do not “bless the casino.” They test parts. The RNG is the heart. Labs check how random numbers are made, how seeds are set, and if draws pass strong stats tests. One well known set is the NIST SP 800-22 randomness tests. These tests look for patterns that should not be there.

Labs also review the game math. If a slot says 96% RTP, they test that over huge runs in a safe setup. They look at code versions, build dates, and how the game runs on the server. Good labs check change control too: who changed what, when, and why. They verify that test builds match live builds. If a casino swaps a version, a retest may be due.

Great labs keep logs and share a readme for results. Sometimes you will see a scope note: what they tested, what they did not, and limits. Read that note. It tells you if the badge on the site is narrow or wide.

The certificate: quick checks that catch 80% of issues

Good certificates tend to share the same core items. You want to see: a certificate ID, date of issue, name of the lab, a note on the standard used, the product name (game, RNG, or platform), a version or build, and a scope (what was covered). Bonus points if you see the lab’s accreditation number and a direct verify link.

Red flags: a low-res badge with no link, a PDF with no certificate ID, a “sample” stamp, or a cert that lists a game title but no version. Also watch for old dates. RNGs and games change. Certs should not sit for years with no update.

You can look up many certs on lab sites. Try eCOGRA Seal Holders and the iTech Labs certificates pages. If the casino shows a badge, you should be able to click through to a live record, or you should find that cert by search on the lab’s portal.

Major RNG test labs, at a glance

Below is a compact view of common labs, what they check, where to verify, and tips for players. Keep this handy when you review a new site or game.

eCOGRA	RNG batteries, game math/RTP checks, system controls	Search “Seal Holders” list	Cert ID, product name, version/build, date, scope	Type approval + change control; periodic reviews	Seen on UKGC, MGA, and more	Match the version on the cert with the game info page
iTech Labs	RNG tests, game return math, environment checks	Public certificate index by vendor/product	Cert ID, RNG library, game list, dates	Initial + retests when code changes	Wide global use; often for slots and RNGs	Check dates; old certs may not cover new builds
GLI	RNG, platform, game math; deep jurisdictional testing	Client-facing portals and issued reports	Report number, standard, version, sign-off	By jurisdiction rules; strong change management	Key in US states and many local markets	Ask support for the GLI report number to verify
BMM Testlabs	RNG suites, game return, security and system	Issued reports and regulator submissions	Report ID, scope, product list, date	Type approval + scheduled reviews	Active across EU, US, APAC	If no public link, request the report cover page

Want a lab directory? Start here: GLI certification directory. If you cannot find a cert, ask the casino for a link or report ID. A good support team should share it.

Why your jurisdiction matters

Some regulators set strict rules on fairness, reporting, and re-tests. They also keep public lists. If you play under Malta, check the MGA licence register to confirm who holds the license. In New Jersey, the New Jersey DGE technical services pages show how they approve games and standards they apply.

Under strong rules, casinos must show RTP info, use approved test labs, and log changes. A mismatch can lead to fines or loss of approval. As a player, this means you can cross-check claims without guesswork.

DIY: from badge to evidence in 8 steps

Use this short path when you see “audited RNG.” It works on both desktop and phone.

1. Open the badge link. If it does not click, search the lab site by casino name, game name, or vendor.
2. Find the certificate or report. Note the certificate ID, date, scope, and product version/build.
3. Check the lab’s accreditation. Look for ISO/IEC 17025 laboratory accreditation. You can also confirm the body on the ILAC MRA signatories list.
4. Match the version/build on the cert with the version on the game’s info page or help screen. Versions must line up.
5. Check dates. If the cert is very old, ask support about re-tests or changes since then.
6. Confirm the vendor (game studio) and the host (casino platform). The certificate should name one or both.
7. Look for regulator support. If your market is regulated, search the public register for the casino or platform license.
8. Save a copy. Take a screenshot of the cert and bookmark the link. It helps if you need to raise a ticket later.

Tip: if you do not want to jump across portals, use a trusted review source that links to live certs and notes version changes. Many players rely on neutral notes and trackers from seasoned reviewers. That saves time and reduces guesswork.

RTP, RNG, volatility: clear lines

These three terms mix in ads, and that causes noise. Here is the clean split:

• RNG: the system that picks numbers at random for each event.
• RTP: the long-run share of bets that returns to players (set by game math).
• Volatility: how bumpy the ride is (small steady hits vs. rare big hits).

A fair RNG does not change RTP. It just makes sure each draw is not biased. In some markets, casinos must share RTP or a range. See the UKGC guidance on RTP disclosure to learn what good RTP info looks like.

Live dealer and edge cases

Live tables use real cards and wheels, not a digital RNG. Still, there is random work in the system. Card shufflers and dealing processes must meet clear rules. Labs use standards like GLI-19 Interactive Gaming Standard to test platforms and control flows. They also check camera angles, dealing rules, and how results move from the studio to your screen.

For hybrid games (RNG bonus rounds inside live shows), both parts can be in scope: the live process and the digital draw. Read the scope on the report to see what was tested.

Crypto corner: “provably fair” you can actually check

Some sites offer “provably fair” games. The idea is simple: you get data to verify each result with math. A server picks a secret seed. You have a client seed. The game shows a hash of the server seed before the round. After the round, the server reveals the seed so you can check the hash and re-run the draw logic.

This is not magic, but it is testable. A strong RNG can be built from secure functions that follow open rules, like those in NIST SP 800-90A on deterministic RNGs. You will also see hash checks. If you want a plain intro to what a hash is and why it matters, see what is a cryptographic hash.

How to check: copy the seeds and the nonce shown in the game, then use a public tool to re-run the steps. If your output matches the game’s step-by-step, the round is consistent. If not, raise a ticket with your logs.

Red flags and quick wins

• Badge with no link or a dead link.
• Cert covers “platform RNG” but your issue is with a single game build—ask for the game’s own report.
• Dates do not match the game version on the help page.
• “Internal audit” only, no external lab.
• Support will not share a report number on request.

Quick wins: find the real cert, save it, and check that version aligns with the game you play. If support answers fast and sends clean links, that is a green sign.

Mini case: a 10‑minute check that paid off

We once checked a slot that showed a nice badge. The site’s footer said the game was “tested by a leading lab.” The help page showed RTP and a build date. Good so far. But the lab portal had a different build date for the same title. The vendor had shipped a new version last month. The casino had not updated the info page. We pinged support with both links. They fixed the page in a day and sent the new cert link. Nothing shady, but a small gap that could mislead players.

Most players do not check this step, according to BetSites.ng. Do the 10‑minute check. It keeps your expectations in line with the real build and math.

Responsible play note

Fairness is about process, not outcomes. Even a perfect RNG will not change house edge. Set a budget and time cap. If play stops being fun, pause. Need help? Visit BeGambleAware or the National Council on Problem Gambling (US).

FAQ: fast answers

Can casinos rig RNG if audited?

It is very hard and very risky. Labs test code, seeds, and outputs. Regulators watch changes. A mismatch can pull a license. Still, trust but verify. Check the certificate and version.

How often are games retested?

On first approval and when code or math changes. Some markets also require periodic reviews. If you see a big version jump, ask for the new report.

Where do I find a game’s RTP?

In the game help screen or info page. Many sites also list RTP on the game’s web page. Some markets require clear display or a link.

What does ISO/IEC 17025 mean for me?

It means the lab is accredited to test with set quality rules. It signals that methods and staff meet a high bar and are checked by an external body.

Are crypto “provably fair” games safer?

They are more transparent per round if you do the checks. But you still need a good license, strong security, and clear cashout rules.

The takeaway (with a one‑page checklist)

If a casino says “audited RNG,” you can verify it. Find the real cert, match the version, confirm the lab’s accreditation, and check local rules. Save links. If anything looks off, ask support for more data or pick another site. Your time and money deserve clear proof.

• Click the badge → find the live cert or report.
• Note cert ID, scope, date, and version/build.
• Confirm ISO/IEC 17025 and ILAC sign-off.
• Match game version to your help screen.
• Check regulator registers if in a licensed market.
• Save screenshots and report numbers.
• Walk away if support dodges basic questions.

Method and source hygiene

How we verify sources: we prefer primary documents from labs, regulators, and standards bodies. In this guide we linked to UKGC rules, NIST test suites, lab portals, ISO and ILAC accreditation pages, GLI standards, and responsible play orgs. We avoid hearsay and ads.

Author and update

Author: A games QA lead who has tested slot math and RNG tools for over 8 years, with hands-on reviews of lab reports and regulator filings. Last updated: June 19, 2026.

Link index (for reference)

• UKGC Remote Technical Standards
• NIST SP 800-22 randomness tests
• eCOGRA Seal Holders
• iTech Labs certificates
• GLI certification directory
• MGA licence register
• New Jersey DGE technical services
• ISO/IEC 17025 laboratory accreditation
• ILAC MRA signatories
• UKGC guidance on RTP disclosure
• GLI-19 Interactive Gaming Standard
• NIST SP 800-90A on deterministic RNGs
• What is a cryptographic hash
• BeGambleAware
• National Council on Problem Gambling (US)