Randomness and RNG
RNG certification badges are everywhere in regulated gambling. We unpack what the published GLI-19 standard and the major labs actually test — and the hard limits of what a certificate can promise.
Regulated gambling sites wear their RNG certificates like armour: "independently tested", "certified random". Those certificates are real and meaningful — but they verify something narrower than most players assume. Here is what the labs actually check, straight from the published standards, and where the armour has gaps.
Three names dominate:
Reading the GLI-19 RNG chapter, the tested properties fall into five buckets:
1. Statistical randomness. The generator's output must pass recognised statistical tests — frequency, serial correlation and their relatives — confirming outcomes are uniform and independent. These are the same instruments we walk through in how to test an RNG yourself; labs run them at industrial scale over enormous samples.
2. Unpredictability and non-repeatability. The standard requires that future outputs cannot be feasibly predicted from past ones and that the generator cannot be made to replay a sequence. In practice this pushes implementations toward cryptographic designs, since ordinary PRNGs fail exactly here no matter how well they score statistically.
3. Seeding and background cycling. How the generator gets its initial state, how state is protected, and whether the RNG is cycled continuously between games — so that outcome timing depends on an unpredictable draw position rather than a resumable sequence.
4. Scaling without bias. The raw generator emits large integers; games need 1–45 or 1–52. GLI-19 requires the scaling step itself to preserve uniformity. This is precisely the modulo-bias trap, promoted from blog-post concern to certification requirement — a lab will fail an implementation whose range-mapping skews outcomes, which is why serious code uses rejection sampling.
5. Implementation review. The labs' published methodologies include reviewing source code and the surrounding system: that game logic actually uses the certified RNG, that shuffles are performed correctly, that the platform meets the standard's system requirements.
That is a substantial checklist, executed by people who do nothing else. When a lottery or casino operator displays a GLI or iTech Labs certificate, the reasonable conclusion is: the generator design and its output, as tested, were consistent with fair randomness.
Now the scope limits — not hypothetical, but structural.
It's a snapshot, not surveillance. A certificate attests to the system as submitted, at test time. Code deployed later, configuration drift, or a deliberate swap after certification are outside the certificate's vision unless re-testing or ongoing audit is contracted. Standards partially mitigate this with change-control and periodic re-certification requirements, but the gap between "tested then" and "running now" never fully closes.
It tests the mechanism, not the people. The most instructive counterexample in lottery history is the Eddie Tipton fraud: the information-security director of the US Multi-State Lottery Association installed code in RNG machines that constrained outcomes on specific dates — machines that sat inside a heavily audited industry. Certification of an RNG algorithm does nothing against an insider with write access to the machine that runs it. The lesson isn't that testing is worthless; it's that a certificate covers the artifact, while fraud usually enters through process — deployment, physical access, personnel.
Statistical passes aren't cryptographic proofs. As we show in the testing article, a generator can pass every statistical battery while being predictable from its outputs — V8's Math.random() is the canonical example. Good labs know this, which is why the standards demand unpredictability by design review, not just clean test statistics. But it means the marketing shorthand "tested random = unbreakable" is simply false.
Scope is per-component. A certificate for the RNG says nothing about payout percentages, bonus-term fairness, or whether the operator pays winners — those are separate audits. A badge on a homepage often covers far less of the product than the badge's placement implies; the certificate itself (usually linked or on the lab's registry) states exactly what was tested, and is worth actually reading.
Our own number generator is not a certified gambling device and doesn't claim to be — no money rides on it. Instead we apply the same engineering the standards demand — OS-level CSPRNG, bias-free scaling by rejection, unbiased Fisher–Yates draws — and go one step further than a certificate can: the complete design is published and the code runs in your browser where you can audit it. Certification is trust in a lab's snapshot; open construction is trust you can re-verify any afternoon.
The honest summary: an RNG certificate from GLI, iTech Labs or eCOGRA is genuine evidence of fair design and output at test time — meaningful, hard to obtain, and worth insisting on in any operator you use. What it is not, and cannot be, is a guarantee that the system running today, operated by the people running it, is unhackable. Randomness can be certified. Integrity has to be maintained.
Last verified: 2026-08-29