How Online Casino RNG Works: The Complete Guide

Every spin, every card deal, every roulette drop in an online casino comes from the same source: a number. Specifically, a very large number produced at high speed by a piece of software that nobody at the casino can see, predict or control while it is running. That software is an RNG, a random number generator, and understanding it is the single most useful thing a player can know about how online casinos actually work.

Most articles about RNGs stop at "it produces random numbers so the game is fair." That is roughly as informative as "cars have engines so they go." This guide goes further. You will find out what kind of RNG casinos actually use, why true randomness is irrelevant to fairness, how the auditing system works and where it fails, what the difference is between an RNG slot and an RNG card game, and what "provably fair" means if you encounter it on a crypto casino.

This article is for players who want to understand what they are playing, not just be reassured. It is also for anyone who has wondered whether online casino results can be manipulated, because the answer depends entirely on which part of the system you are asking about.

Key takeaways

• Online casinos do not use true random number generators. They use pseudorandom number generators (PRNGs), which produce deterministic sequences from a starting value called a seed. The outputs are statistically indistinguishable from random for practical purposes.
• The seed changes continuously, typically drawing from system clock data at the microsecond level. Nobody at the casino can predict or choose which seed is in use when you click spin.
• RNG outputs are mapped onto game outcomes by a separate piece of software. The RNG itself does not know it is producing a blackjack hand or a slot result.
• Third-party labs such as eCOGRA, BMM Testlabs, iTech Labs and GLI test both the RNG and the mapping logic. Certification means the distribution of outcomes was correct over millions of simulated rounds.
• Certified games cannot be rigged on a spin-by-spin basis by casino staff. Rigging at the RNG level would require access the casino does not have.
• Live casino games use a different system: physical cards and wheels are used, and the randomness comes from a real dealer, not software.
• Provably fair systems, common in crypto casinos, let you verify the result of each round yourself using cryptographic hash functions, without trusting the casino at all.

What a random number generator actually is

A random number generator is any system that produces a sequence of numbers where future values cannot be predicted from previous ones by someone outside the system. That is the full definition. It says nothing about dice, cards, atmospheric noise or computer chips. It says: unpredictable to an outside observer.

For gambling purposes, the output is a large integer, usually in the range of 0 to 2^32 (about 4.3 billion) or 0 to 2^64. That number is then mapped onto a game outcome. A slot machine with 10,000 possible symbol combinations needs 10,000 different values. A six-deck blackjack shoe needs values that map to 312 cards. The RNG does not know which game it is feeding. It just produces numbers.

The key property is not true randomness in a philosophical sense. It is unpredictability. A sequence where every number from 0 to 9 appears exactly once in every ten draws is not random in a probabilistic sense, but if no observer can predict which of the ten comes next, it is random enough for any practical use including gambling.

True RNG vs pseudorandom: why the difference matters

There are two fundamentally different ways to produce unpredictable numbers.

True RNGs (TRNGs) sample physical phenomena that are genuinely unpredictable at the quantum level: radioactive decay, thermal noise in semiconductors, atmospheric radio frequency noise, photon behaviour. The Intel RDRAND instruction on modern processors uses thermal noise. Cloudflare famously uses lava lamps and double-pendulums as entropy sources. These systems are unpredictable because the physics is unpredictable.

Pseudorandom number generators (PRNGs) use mathematical algorithms. Given the same starting value (seed), a PRNG always produces exactly the same sequence. The sequence looks random but is entirely deterministic. A PRNG is essentially a very long, very complicated function that maps one number to the next.

Online casinos use PRNGs. They do not use TRNGs. This sounds like a reason to distrust them, but it is not, for one critical reason: the seed changes thousands of times per second, and the algorithm that maps seed to output sequence runs far too fast for anyone to observe which seed was in use at the moment you clicked. The determinism exists in theory. In practice, the sequence is unpredictable.

The algorithms used in serious casino PRNGs include:

The last two are CSPRNGs: cryptographically secure pseudorandom number generators. The word "cryptographically secure" means an observer who sees any amount of the output sequence cannot use it to predict future values, even with unlimited computing power. For gambling, this is more than sufficient.

How a casino PRNG produces a game result

The path from algorithm to slot spin looks like this:

1. The PRNG runs continuously in the background, generating numbers at thousands of cycles per second, whether or not anyone is playing.
2. At the exact millisecond you click spin, the current output of the PRNG is captured. This is the raw number.
3. The game engine applies a modulo operation (or equivalent mapping) to convert that number into a position in the game's symbol table, card deck or outcome space.
4. The game renders the result to your screen.

Example with a simplified slot: the PRNG produces 1,847,293,411. The slot has 10,000 possible outcomes. 1,847,293,411 mod 10,000 = 3,411. Position 3,411 in the outcome table maps to: reel 1 cherry, reel 2 bar, reel 3 seven. No match. Spin complete.

The click timing is doing real work here. Because the PRNG advances at the microsecond level, clicking 0.001 seconds later would capture a completely different number mapping to a completely different result. Nobody, including the software itself, knew which number would be captured until the moment you clicked.

This is why strategies based on timing your spins are not real strategies. The sequence between your clicks is not paused. It continues at the same speed regardless, so any click pattern you apply is just selecting a different point in a sequence you cannot observe.

The seeding problem: where unpredictability comes from

If a PRNG is deterministic, someone who knows the seed and the algorithm could predict every output. So the security of the system depends entirely on the seed being unknowable.

Casino PRNGs reseed frequently, typically many times per second, using combinations of:

• System clock in nanoseconds or microseconds at the moment of reseeding
• Server entropy pools (accumulated from hardware interrupts, network packet timing, disk read timing)
• Previous PRNG outputs, folded back in
• In some implementations, hardware-level entropy from the server CPU

The nanosecond system clock is doing most of the work. A nanosecond is one billionth of a second. Even if you knew the casino's server time to the millisecond, you would still have 1,000,000 possible seeds within that millisecond, each producing a completely different output sequence. In practice, external observers do not know the server time to the millisecond, let alone the nanosecond.

Some regulators require that the seeding source include hardware entropy that is physically inaccessible to software at the casino operator level. This is an important protection: it means that even a malicious employee with root access to the server cannot determine the current seed by reading system values.

How RNG certification works

A licensed online casino cannot simply claim its RNG is fair. It must have the RNG independently tested and certified before the games go live, and recertified whenever the RNG or game software changes.

The certification process has two components that are usually tested together:

Statistical testing of the RNG itself. The lab generates billions of outputs from the PRNG and runs them through a battery of statistical tests. The two most commonly referenced suites are NIST SP 800-22 (published by the US National Institute of Standards and Technology) and the Diehard tests originally developed by George Marsaglia. These tests check for patterns the human eye would never notice: long-range correlations, autocorrelation, compression ratios, sequential dependencies. A weak PRNG fails some of these. A strong one passes all of them.

Testing the game logic mapping. The RNG output is only the beginning. The mapping from number to game outcome must also be correct. If a slot claims to have a 96.5% RTP and certain symbol frequencies, the math must check out over millions of simulated rounds. The lab runs the game software through the full cycle and verifies that cherry does not appear twice as often as it should because of a bug in the modulo arithmetic.

Both components get tested. A certified game has a certified RNG feeding a certified mapping. The certificate covers both.

Certification is typically renewed annually or whenever the software version changes. Some jurisdictions, including Great Britain (UKGC), Malta (MGA) and Gibraltar require not just a certificate but ongoing technical audits, meaning the regulator can demand test results at any time.

The four main testing labs

Not every certificate is equal. These are the labs whose seals actually mean something in the regulated market:

eCOGRA (eCommerce Online Gaming Regulation and Assurance). Founded in 2003, based in the UK, the oldest online-gambling-specific testing organisation. The eCOGRA "Safe and Fair" seal is the most widely recognised in the industry and is required by some operators as a condition of their licence. eCOGRA also audits ongoing payout percentages and publishes them, which is the payout percentage figure you sometimes see quoted per jurisdiction.

BMM Testlabs. The largest independent testing lab in the land-based casino industry, with significant online operations. BMM is the lab of choice for North American regulated markets. Their RNG approval methodology is published and follows NIST standards explicitly.

iTech Labs. An Australian-headquartered lab with strong presence in European regulated markets and the Asia-Pacific region. iTech certification is accepted by the MGA, the UK Gambling Commission and most Nordic regulators.

GLI (Gaming Laboratories International). One of the largest certification bodies worldwide, covering land-based, online and lottery. GLI is particularly common in US state-regulated markets and in emerging regulated jurisdictions.

If a game page or a casino's terms reference one of these labs with a certificate number, you can usually verify the certificate on that lab's website. If the certificate name does not match a real lab, that is worth noting.

What certification does and does not guarantee

What it guarantees:

• The RNG output passed statistical tests across billions of samples.
• The mapping from RNG output to game result is mathematically correct.
• The stated RTP is the actual long-run theoretical return for that game version.
• Nobody running the casino software can influence an individual result in real time.

What it does not guarantee:

• That any individual session will return anything near the stated RTP. RTP is a long-run average across millions of rounds, not a session guarantee.
• That the casino will pay out winnings. Certification is about game fairness, not operator solvency or payment processing integrity.
• That the certified version of the game is the version you are playing, if the operator is running unlicensed software.
• Anything about games from providers that are not certified, which in grey-market and black-market casinos is common.

The last point is the one that matters most in practice. A Maltese-licensed casino using certified NetEnt slots is playing a different game from an unlicensed site using games from an unknown provider. The seal means something in context. Without a real licence, it means nothing.

RNG in slots vs RNG in table games

The same PRNG powers both categories, but the mapping logic is different enough that they behave differently in ways players notice.

Slots. Each reel position is determined by a separate number from the PRNG. In a five-reel slot, the game captures five numbers (or derives five values from one large number) and maps each to a symbol on that reel. The pay table assigns a win value to each combination. Because the RNG runs continuously between spins and each spin is a fresh independent draw, previous results have zero influence on the next one. There is no memory, no hot/cold streaks in any meaningful sense, no cycle length that returns you to a good part of the sequence.

One detail that confuses players: weighted reels. Not every symbol is equally likely on every reel. The virtual reel mapping assigns more positions to low-value symbols than to high-value ones. A jackpot symbol might map to 1 position out of 256 possible on each reel. The physical appearance of three reels does not tell you the actual probability. That is in the math model, which the certification lab tests.

RNG table games. A virtual blackjack shoe starts with the RNG generating a shuffled six-deck sequence. The shuffle algorithm typically uses a Fisher-Yates shuffle seeded by the PRNG. When you draw a card, you get the next card from that shuffled sequence. When the shoe is "exhausted" (or at a random reshuffle point), the process repeats. The key difference from slots is that cards drawn from a shoe are not independent: drawing the ace of spades reduces the probability of drawing it again. The RNG handles this correctly, because it produces a permutation of 312 cards rather than independent draws.

RNG roulette works differently again. Each spin is an independent draw from the full range of pocket outcomes (0 to 36, plus 00 in American). There is no memory between spins, exactly as with physical roulette.

Live casino: no RNG involved

Live casino games do not use a PRNG for outcomes. A human dealer shuffles physical cards, spins a physical wheel, rolls physical dice. The randomness is physical and the result is captured by camera and transmitted to your screen.

The technology here is OCR (optical character recognition) and sensor arrays. Card values are read by scanners built into the shoe. Roulette wheels have angle sensors and camera tracking. The result is detected automatically and fed to the game client.

The PRNG is still involved in one place: the pre-game shuffle sequence for card games, where a shuffling machine is used. But once the cards are in the shoe, the physical shoe determines what comes out. Nobody is generating numbers.

This distinction matters for one specific reason. Some players prefer live casino because it removes any residual concern about software manipulation. That concern is not particularly well-founded in certified RNG games, but it is psychologically real, and live games address it by removing the RNG from the outcome entirely.

The tradeoff: live games are slower, have table limits and minimum bets, and close when the studio is not staffed.

Provably fair: crypto casino RNG you can check yourself

Provably fair is a verification system developed in the crypto gambling space that lets a player check the fairness of any individual result after it has occurred, without trusting the casino at all.

The mechanism uses cryptographic hash functions. Here is the simplified version of how it works:

1. Before the round begins, the casino generates a server seed and sends you its SHA-256 hash (a one-way fingerprint). You cannot reverse-engineer the seed from the hash.
2. You provide a client seed (or a randomly generated one is provided on your behalf).
3. The round outcome is determined by combining the server seed, client seed and a nonce (round counter) using HMAC-SHA256.
4. After the round, the casino reveals the server seed. You can now hash it yourself and confirm it matches what you were given before the round. Then you can re-run the HMAC-SHA256 calculation yourself and verify the outcome was correct.

What this proves: the casino committed to the server seed before the round started and could not have changed it after seeing your bet. The outcome follows necessarily from the combination of seeds. A provably fair casino that reveals a seed that does not match its pre-round hash has visibly cheated. Most players never verify, but the ability to verify is what makes the system credible.

Provably fair is common in crypto casinos including crash games, dice, and plinko, where the math is simple enough that the verification calculation is easy to follow. It is less common in complex slot games where the mapping from hash to 5-reel result requires understanding the provider's algorithm.

Can an online casino cheat through the RNG?

Answering this requires being specific about what "the casino" means, because different parts of the system have different access.

Can casino staff manipulate a single spin in real time? No, at any properly certified operator. The PRNG runs on the game provider's servers, not the casino's. The casino operator buys access to games through an API. They do not have access to the RNG process. A BetSoft slot running at Casino X is running on BetSoft's servers. Casino X's employees have the same view of the RNG as you do: none.

Can the game provider manipulate results? In principle, a dishonest provider could modify the game software between certification and deployment. This is the attack the ongoing audit requirement is designed to catch. Regulators can demand that a certified hash of the live software matches the certified version. Whether this happens consistently in every jurisdiction is a different question.

Can an unlicensed casino cheat? Yes, easily. An unlicensed site using uncertified software has no constraints. The "RNG" could be a server-side lookup table. Nothing stops this except market pressure and the difficulty of building a player base when you cannot advertise. This is the practical argument for only playing at licensed operators with named certified game providers.

Can the RTP be set differently from what is stated? At a licensed operator using certified games, no, because the RTP is part of what was certified. Some jurisdictions allow operators to select a jurisdiction-specific RTP variant within a permitted range (e.g., 94% vs 96% for the same game title). This is documented and disclosed, not hidden.

Do casinos have a "cooling off" mode or "bad beat" algorithm that kicks in after wins? This is one of the most persistent myths. It would require the casino to interfere with the PRNG in real time, which it cannot do at the operator level for the reason described above. The perceived pattern of "always loses after a big win" is a confirmation bias combined with the fact that high-variance sessions involve large swings in both directions.

Frequently asked questions

What does RNG stand for in a casino?

RNG stands for random number generator. In an online casino context it refers specifically to the software that produces the sequence of numbers that determines each game result: which symbols land on a slot reel, which card comes from the virtual shoe, which pocket the virtual roulette ball falls into.

Are online casino games truly random?

They are pseudorandom, which is different in mechanism but equivalent in effect. A certified casino PRNG produces output sequences that pass every statistical test for randomness, reseed from unpredictable sources thousands of times per second, and cannot be predicted by any party including the casino. For practical gambling purposes, this is functionally identical to true randomness.

How can I tell if a casino uses a certified RNG?

Look for the name of a recognised testing lab on the casino's website, usually in the footer or on a dedicated "Fairness" or "Licenses" page. The main labs are eCOGRA, BMM, iTech Labs and GLI. Cross-reference the certificate number on the lab's website to confirm it is real. If a casino cannot name its testing lab or point you to a specific certificate, that is a significant red flag.

Does the RNG know what bet I placed?

No. The PRNG is a number-generating process running in isolation. It does not know your bet size, your player account, your session history or the game you are playing. The game logic receives an RNG output and maps it to a result independently of your stake. A 1 coin bet and a 100 coin bet on the same spin capture the same number from the same sequence.

Can I beat an RNG casino with a betting system?

No. Betting systems change the size and timing of bets, not the probability of outcomes. Because each spin/deal/drop is drawn independently from the same distribution, no sequence of bet sizes can change the expected value. The house edge is a property of the game math, not of the betting pattern. Martingale, Fibonacci, D'Alembert and similar systems redistribute variance: bigger wins and bigger losses, same expected value per unit wagered.

What is the difference between an RNG slot and a live slot?

A conventional online slot uses a PRNG to determine symbol combinations. A live dealer game, including live game show formats, uses physical apparatus (cards, balls, wheels) dealt or spun by a human and captured by camera. The randomness source is different. The RTP and house edge are functionally similar. The speed, minimum stakes and social experience differ significantly.

Is provably fair better than certified RNG?

They solve different versions of the same problem. Provably fair lets you verify an individual result yourself without trusting the casino. Certified RNG provides institutional verification that the overall distribution of results is correct over millions of rounds. Provably fair is technically superior for player autonomy but requires the player to understand and perform the verification. In practice, most players do neither, and both systems are adequate at licensed and reputable operators.

Can the casino see my screen or know when I am about to click?

No. The PRNG runs server-side and advances continuously regardless of your actions. The casino cannot observe your mouse movement or time a seed change to your cursor position. The only information the server receives is the click event itself, at which point the current PRNG output is already captured. There is no mechanism available to the operator to influence that capture.

Sources and further reading

• National Institute of Standards and Technology (NIST). A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications, SP 800-22 Rev 1a, 2010. https://csrc.nist.gov/publications/detail/sp/800-22/rev-1a/final
• Matsumoto M, Nishimura T. Mersenne twister: a 623-dimensionally equidistributed uniform pseudo-random number generator. ACM Transactions on Modeling and Computer Simulation, 1998, 8(1):3–30.
• eCOGRA. RNG and Game Assessment Methodology. https://ecogra.org
• BMM Testlabs. Technical Standards for RNG Approval. https://bmm.com
• UK Gambling Commission. Remote gambling and software technical standards (RTS), 2017 edition. https://www.gamblingcommission.gov.uk
• Malta Gaming Authority. Gaming Definitions Regulations. https://mga.org.mt
• Provably fair cryptographic verification: HMAC-SHA256 specification, RFC 2104, Krawczyk H, Bellare M, Canetti R, 1997. https://tools.ietf.org/html/rfc2104

This article is for informational purposes. Casino Stats Lab does not operate gambling services. Always gamble within your means at licensed operators.