OASA Logo

RNGs Explained: The Tech Ensuring Fair Online Games

You watch a slot wheel slow down. The last reel clicks past a cherry, then lands on a bar. It feels close. It feels like a near-miss. But the truth is less dramatic and more solid: a small engine of math picked that stop before the reel even looked slow.

That engine is an RNG, a random number generator. Good RNGs are not magic. They are built, tested, and checked by people and tools. Fairness in online games is not a promise; it is a process you can trace, test, and verify.

The stakes

“Fair” means three things in practice. First, you cannot predict the next outcome. Second, there is no bias that helps one outcome over time. Third, an outside lab can check the system and confirm both points. If any of these fail, the game is not fair.

Many readers ask how we “test randomness.” Labs use math tests to look for patterns in big sets of numbers. These tests look at runs, gaps, bits, and more. They can tell you if a stream looks random. A good place to learn about such tests is the NIST page on randomness tests.

RNG is not the same as RTP. RNG picks results. RTP (return to player) is the long-term payback set by the paytable and game math. A fair RNG can power a low or high RTP game. Fairness is about no hidden bias. RTP is about how the game pays over time.

Under the hood — where numbers come from

Most online games use a cryptographic DRBG (deterministic random bit generator). It is a type of PRNG that is secure if the seed is strong. Many stacks follow the NIST SP 800‑90 series, like AES‑CTR or Hash‑based DRBGs. You can read the base spec for DRBGs in NIST SP 800‑90A.

The seed is key. It must have real entropy (true surprise). Good systems pull entropy from the OS and hardware, and they run live health tests to catch a weak source. The rules for entropy sources and health tests are in NIST SP 800‑90B.

Many vendors mix hardware noise with a DRBG. Fresh entropy reseeds the DRBG from time to time. This keeps the state hard to guess even if part of it leaks. The way to combine sources and DRBGs is covered by NIST SP 800‑90C.

Labs also look at the bigger rules for random bit generation. For a broad view of methods and checks, see the standard ISO/IEC 18031. With that context in mind, here is a short table you can use to compare common RNG types in gaming.

Cryptographic DRBG (PRNG) Seeded from OS and hardware noise Very fast Yes, if seed/state logged under seal Core engine for most certified games NIST SP 800‑90A; NIST SP 800‑22 battery Poor seeding; modulo bias; bad scaling Lab can replay with seed and compare logs
TRNG (hardware) Physical noise (e.g., jitter, diodes) Slower than DRBG No, outcomes are not reproducible Used to seed/reseed DRBGs; rare as sole engine Entropy assessments; ISO/IEC 18031 methods Bias drift; hardware faults Needs live health tests and redundancy
Hybrid (TRNG + DRBG) TRNG seeds and tops up DRBG Fast, with strong entropy Partial (seed snapshots) Common in certified stacks NIST SP 800‑90B/C guidance Seed rotation gaps; logging gaps Best mix if well monitored

The chain of trust

Regulators set the base rules. For example, the UK sets remote technical standards that cover RNGs, scaling, and game logs. You can read the UK regulator’s rules here: UK remote technical standards.

Test labs check games and platforms. A common rule set for interactive gaming is GLI‑19. It guides how RNGs should be built and tested for online use. See the scope at GLI‑19.

Some vendors use eCOGRA for fairness checks and ongoing monitoring. Learn about their seal and audit scope at eCOGRA.

Others work with iTech Labs, which runs RNG and game math tests and lists many certificates. Details are at iTech Labs.

BMM Testlabs also audits RNGs and remote gaming systems in many regions. Explore their scope at BMM Testlabs.

Jurisdictions differ in process. For example, the Malta Gaming Authority approves test labs for the market it oversees. You can view the list of approved labs on the MGA site.

Inside a modern iGaming RNG pipeline

Here is the life of one spin. The system gathers entropy (from OS and hardware). It seeds a DRBG. The game asks for numbers. The DRBG gives raw values. The game scales those values to the size of the reel or deck. The result is logged with time and game state under a seal.

Scaling sounds simple. It is not. If you map a big number space to a small one with “x mod n,” you can add bias if the space does not divide cleanly. Good code uses rejection sampling to avoid that. For a short primer, see the OWASP note on random number generation.

Here is tiny pseudo-code to show unbiased scaling:

Where does RTP fit? The RNG picks events. The paytable, reels, and rules set the chance and size of wins. Over many rounds, the expected payback (RTP) shows up. A fair RNG does not raise or drop RTP in secret; it just draws results in line with the game design.

Red‑team notes — how RNGs actually fail

Most real failures are not movie plots. They are small cracks. Seeds based on time. A PRNG that is not made for crypto. A leak of state in a log. Scaling with modulo and no rejection. A bad entropy device that drifts. A library that someone built once and never patched.

Many of these flaws are known in app security. A good short tour of what can go wrong with crypto and randomness is in the OWASP note on cryptographic failures.

How do labs and rules reduce risk? They check the seed source and the DRBG choice. They review code for scaling and bias. They replay outcomes with sealed seeds. They run big test sets. They re‑test after game or engine updates. They also check logs and time sync, so the audit trail is whole.

How players can verify fairness today

You can do three checks in five minutes. First, look for the site license and the test lab seal in the footer. Click through. See if the license is current, and if the lab page lists game names and versions. When in doubt, many vendors use GLI, and its site is here: Gaming Laboratories International.

Some crypto games use “provably fair.” This is a public way to check each spin or hand. It may use a VRF (verifiable random function). You get a seed, a server seed, and a proof. You can verify the proof with code or a tool. For the idea and how VRFs work, see RFC 9381.

If you play in Sweden and track bonuses that must also meet local rules, you may find it useful to follow a hub that maps offers to license and test info. One example is casino kampanjer i Sverige. Disclosure: we may receive a commission from some partners; this does not change how we explain or apply our fairness checks.

Play with care. Set limits. If gambling is hurting you or someone close, seek help. For support and tools, visit BeGambleAware. Only play where legal in your area and within your budget.

Next horizon

More systems now mix hardware noise with strong DRBGs and add live health checks. Some even use public, fun sources as extra seed input. A nice example is the famous lava lamp wall used to help mix randomness at scale; read the story on Cloudflare’s blog.

On the research side, teams look at how post‑quantum crypto will fit into RNGs, seed exchange, and proofs. The NIST work on new crypto gives good context; see the NIST PQC project for updates.

Mini‑FAQ

Are online casino RNGs truly random?

They are as random as a strong DRBG with good seeds. They are not pure noise each time, but they are unpredictable and unbiased when built and tested well.

What is the difference between RTP and RNG?

RNG picks outcomes with no bias. RTP is the long‑term payback set by the game’s math. A fair RNG can run a low or high RTP game.

Who tests RNGs for fairness?

Independent labs like GLI, eCOGRA, iTech Labs, and BMM Testlabs test RNGs and game math under rules set by regulators.

Can casinos rig RNGs?

In licensed markets, the code is sealed and audited. Labs and regulators check version control, logs, and change rules. Rigging would show up in audits.

How can I check if a game’s RNG is certified?

Look for the lab seal in the site footer. Click through to a certificate. Check the game name, version, and date. If unsure, contact support and ask for the lab and cert number.

What does “provably fair” mean?

It means the site gives you data and a proof so you can verify each outcome with public code. Many use VRFs to do this.

Closing: fairness is a process

RNG fairness is not a one‑time badge. It is design, seed care, sound scaling, live health checks, and audits that repeat. When you know what to look for, you can spot good practice fast and skip the rest.

Keep play fun. Take breaks. Use limits. If you need help, reach out to local support services. Stay safe.