What a Certified RNG Means — And How to Verify One

Ask a game provider for proof of a certified RNG and you will usually get a PDF. One page, a lab logo, a reference number, a date, and a paragraph of language dense enough that most buyers skim it, nod, and file it away. The certificate looks official. That is usually where the checking stops.

It should not. A certified RNG is one of the few things in iGaming you can independently verify, and the certificate tells you exactly what was tested, when, and against which standard. Read it properly and it answers real questions. Read it carelessly and it answers nothing — it just makes you feel safer.

So before the next provider sends you a logo and a reference number, here is what the term actually means, what the lab measured to earn it, and how to tell a meaningful certificate from a decorative one.

A certified RNG is not a certified game

This is the distinction almost everyone gets wrong, and providers rarely correct it because the looser version sounds better in a sales deck.

The random number generator is the engine that produces unpredictable outcomes. Certification tests that engine. It does not certify each individual game that draws from it, and it does not stamp the whole catalog as "fair forever."

So the correct phrasing is "GLI-19 certified RNG," not "GLI-19 certified games." If a provider tells you all 200 of their games are individually certified, either they are paying for hundreds of separate game submissions to a regulator — possible, expensive, and usually jurisdiction-driven — or they are stretching one RNG certificate to cover the whole shelf. The second is far more common.

Why does this matter to you as the buyer? Because the RNG certificate proves the math core is sound — and a sound core is the reason an RNG sits at the center of fair casino software in the first place. It says nothing about whether a specific game's pay table was configured honestly, or whether the integration on your server still draws from the certified generator. Those are separate questions, and a single PDF cannot answer all of them.

What the lab actually tests

A testing house does not eyeball a few spins and sign off. RNG certification is a statistical exercise run across enormous output samples — typically millions of generated values — to confirm four properties.

• Randomness — the output passes recognized statistical test suites (chi-square, runs tests, and similar) with no detectable pattern.
• Unpredictability — knowing past outputs gives no useful edge in predicting the next one.
• Uniform distribution — every possible value comes up at its expected frequency, with no value quietly favored.
• No bias — outcomes are not skewed toward or away from any result across the full sample.

That is the part most explanations stop at. The harder part is everything around the algorithm. A good lab also reviews how the RNG is implemented in code, how it is seeded, how it is scaled into actual game results (the conversion from a raw number into a reel position or a dealt card), and what stops someone from tampering with it. A mathematically perfect generator that is seeded predictably, or that can be influenced after deployment, fails the point of the exercise.

This is where the cheap certificates fall apart. Testing raw randomness is the easy 80%. Reviewing seeding, scaling, and tamper resistance is the 20% that takes real engineering review — and it is the 20% that actually protects your players and your license.

GLI-19, and the alphabet soup around it

GLI-19 is the standard most people mean when they say "certified." Published by Gaming Laboratories International, the current revision is GLI-19 v3.0, and it covers interactive gaming systems in three blocks: platform and system requirements, RNG requirements, and game requirements, plus appendices on operational audits.

The RNG section is the relevant one for this conversation, but notice the scope: GLI-19 is broader than just the generator. A provider can be certified against the RNG requirements of GLI-19 without the entire platform being audited against the rest of it. Both are legitimate — they just mean different things.

GLI-19 is not the only document in the room. There is GLI-11 for gaming devices, regional technical standards in regulated markets, and lab-specific test reports that map to all of them. Jurisdictions tend to use GLI-19 as a baseline and then layer their own requirements on top. For a sweepstakes or crypto operator outside a hard-licensed market, a GLI-19 certified RNG is often the strongest fairness signal available, because there is no local regulator forcing a deeper audit.

Two names worth knowing on the lab side: iTech Labs and BMM TestLabs. Both are long-established independent testing houses, and both issue RNG certifications recognized across multiple jurisdictions. GLI itself publishes the GLI-19 standard and tests against it. When a certificate names one of these, you can verify it directly with the lab — which is the whole point of independent testing.

What a real submission involves

Understanding what the provider went through to earn the certificate helps you judge whether it was a serious process or a box-tick. A genuine RNG submission is not a quick scan.

The provider sends the lab the actual RNG source code, not a description of it. The lab reviews the algorithm, how it is seeded, and how raw output is converted into game results. Then it runs the statistical batteries across very large samples — the millions of outputs mentioned earlier — and checks the results against the thresholds in the standard. If anything fails, the provider fixes it and resubmits. Only after the full pass does the certificate get issued, carrying the date and reference number.

Two details separate a thorough lab from a rubber stamp. First, source-level review: a serious certification looks at the code, not just the output, because predictable seeding can pass a randomness test while still being exploitable. Second, integration scope — whether the lab examined how the RNG sits inside the broader system, or only the isolated generator. Both pieces of information are worth asking about, and a provider who took the process seriously will be able to answer without hesitation.

None of this is fast. A real submission cycle runs weeks, sometimes longer if the first pass surfaces issues. When a provider claims certification happened overnight, that timeline alone tells you how deep the review went.

How to actually read the certificate

When a provider hands you proof, five things on the document tell you whether it means anything.

1. Who issued it. A recognized independent lab, or a name you have never heard of? Self-certification is not certification.
2. What it covers. The RNG specifically? A particular platform build? Read the scope line, not the headline.
3. Which standard. GLI-19, and which version. "Certified" with no named standard is a logo, not a guarantee.
4. The date. Certification reflects what was tested on a given day. A 2014 certificate is a real milestone, but you also want to know the current RNG still maps to it.
5. The reference number. Real certificates carry an ID you can quote back to the lab to confirm authenticity.
6. Any renewal date. Some certificates note re-testing. If yours does not, that becomes a question to ask the provider directly.

If a provider gets uncomfortable when you ask to verify the reference number with the issuing lab, that discomfort is your answer. A genuine certificate is built to be checked. There is no reason to resist it.

What certification does not prove

Here is the honest part most providers leave out. A certified RNG proves the engine is sound. It does not prove:

• That the RTP advertised on a specific game matches how it is configured in production. RTP is set in the pay table and the math model, not the RNG. A fair generator can sit underneath a game tuned to any return the operator chooses.
• That the integration on your live server still calls the certified generator rather than a quick substitute someone dropped in to cut a corner.
• That the games are fun, retain players, or convert. Certification is a fairness floor, not a quality ceiling.
• That your regulator will accept it as-is. GLI-19 is a baseline, and licensed markets often require their own testing layered on top.

This is why the certificate is necessary but not sufficient. It clears the fairness question and leaves the commercial and configuration questions exactly where they were. Treat it as the entry ticket, not the whole show. If you want to go deeper on the configuration side, our published RTP and game mathematics list shows what those numbers look like once the RNG output is shaped into actual game returns.

Certification is a date, not a permanent state

A certificate captures a moment. The RNG that passed testing in, say, 2016 is certified as it existed in 2016. Reputable labs run periodic re-testing, and a material change to the generator or the systems around it can trigger re-certification. That is a feature, not bureaucracy — it stops "we were certified once" from becoming a permanent shield over code that has since been rewritten.

For you, the practical takeaway is simple: a certificate plus a provider who can explain when it was last reviewed beats an old certificate waved around with no follow-up. Ask the second question. The answer separates the providers who treat fairness as ongoing from the ones who treat it as a marketing asset.

What this looks like in practice

At CasinoWebScripts, the RNG behind our games has been certified under GLI-19 by both iTech Labs and BMM TestLabs — iTech Labs first, with BMM testing against GLI-19 standards afterward. The same certified generator sits under the full catalog of 252 HTML5 games, which is the correct way to describe it: one tested engine, many games drawing from it, not 252 separate certificates.

For operators who buy full source code, the math documentation and PAR sheets ship with the games, so the configuration questions a certificate cannot answer — the ones about pay tables and actual return — are documented rather than hidden. In 16 years of selling casino software, the operators who ask to verify the certificate directly with the lab are the ones who go on to run the tightest operations. The question is a good sign, not an insult.

Frequently asked questions

What does "certified RNG" actually mean?

It means an independent testing lab has verified that the random number generator produces statistically random, unpredictable, uniformly distributed, and unbiased outputs, and has reviewed how that generator is implemented and secured. It certifies the engine, not each individual game.

Is a certified RNG the same as certified games?

No. The RNG is the math core that games draw from. Certifying the RNG does not individually certify every game. The accurate phrase is "GLI-19 certified RNG," and any provider claiming all their games are individually certified should be able to show separate documentation for each.

What is GLI-19?

GLI-19 is the Gaming Laboratories International standard for interactive gaming systems. The current revision is v3.0, covering platform requirements, RNG requirements, and game requirements. Many jurisdictions use it as a baseline and add their own rules on top.

How do I verify an RNG certificate is real?

Check who issued it, what it covers, which standard and version, the date, and the reference number. Then contact the issuing lab and quote the reference number. A genuine certificate is designed to be confirmed this way.

Does a certified RNG guarantee a specific RTP?

No. RTP is set in a game's pay table and math model, not the RNG. A certified generator can underpin a game configured to any return the operator selects. Certification proves fairness of outcomes, not the commercial settings layered on top.

Does RNG certification expire?

Certification reflects what was tested on a given date. Labs run periodic re-testing, and significant changes to the generator or surrounding systems can require re-certification. Ask a provider when their certificate was last reviewed, not just whether they have one.

A certified RNG is the clearest fairness signal a game provider can give you, but only if you treat the certificate as something to read rather than something to display. Check the standard, check the lab, check the date, and verify the reference. If you are weighing providers and want help mapping what to ask for against your model — real money, sweepstakes, or crypto — our configuration wizard walks you through it in a few steps.

if (basename($_SERVER['SCRIPT_FILENAME']) === basename(__FILE__)) exit;