Gambling Online 101
intermediate
6 min readRNG & Fairness
How games are randomized and what "provably fair" means.
BonusBell Team
When you spin a slot machine or play virtual blackjack, how do you know the results are truly random? Understanding Random Number Generators (RNG) and fairness certification helps you trust—or distrust—the games you play.
What Is an RNG?
A Random Number Generator is software that produces unpredictable numbers at a rate of thousands per second. Each number corresponds to a game outcome:
- Which symbols appear on slot reels
- Which cards are dealt in video poker
- Where the virtual roulette ball lands
Good to Know
Modern RNGs use complex algorithms that pass rigorous statistical testing. The numbers are "pseudo-random"—generated mathematically but practically unpredictable.
How RNG Prevents Manipulation
Reputable platforms implement several safeguards:
Continuous Generation
The RNG runs constantly, not just when you press spin. The exact millisecond you play determines your result.
No Pattern Recognition
Past results don't influence future outcomes. Each spin/hand/roll is independent.
Third-Party Testing
Independent labs test RNG algorithms to verify randomness and advertised RTP.
Third-Party Testing Labs
Look for certifications from these respected testing agencies:
- eCOGRA – Independent testing and player protection
- iTech Labs – RNG testing and game certification
- GLI (Gaming Laboratories International) – Industry standard testing
- BMM Testlabs – Global gaming testing lab
Strategy Insight
Check the footer of any online casino for testing certifications. Clicking on them should link to verification or the testing agency's site.
What Is "Provably Fair"?
Provably fair is a technology used mainly by crypto casinos that lets you verify each game result was fair:
- Before you play, the server generates a secret "seed" and shows you a cryptographic hash
- You can optionally add your own random seed
- After the game, the server reveals its seed
- You can mathematically verify the hash matches and results weren't changed
Pro Tip
Provably fair systems provide transparency that traditional casinos can't match. However, they do not prove a fair RTP by themselves—just that the game was not altered after the fact. Use our free Provably Fair Verifier to independently check your crypto casino game results — supports dice, crash, plinko, mines, and more.
Verify It: Provably Fair Walkthrough
Four-step audit trail
1. Server commits first
2. You contribute entropy
player-seed-101
3. Message for the game round
Waiting for seeds…
4. HMAC result drives the roll
Revealed server seed
4f75e7d693599311c4a8e180d8b7618a0f4b74d16dce7675ea6d1b846ebda3d4
Verification result
Commitment mismatch
If the seed hash changed after the bet, this check would fail immediately.
Sample dice-style output
0.00
The exact mapping differs by game, but the audit pattern is the same: commit, reveal, verify.
Server Seed, Client Seed, and Nonce
These three inputs are the practical heart of most provably fair systems. The server seedis chosen by the casino and committed to in advance with a hash. The client seed is your contribution, which prevents the operator from tailoring the outcome to a known input. The nonce increments every round so the same pair of seeds can safely generate a long sequence of unique outcomes. When all three are combined through a cryptographic function, you get a result that is deterministic after the fact but unpredictable beforehand.
Can Online Games Be Rigged?
At licensed, regulated casinos: extremely unlikely.
Regulators require:
- Regular RNG audits
- Actual payout percentages matching advertised RTP
- Hefty fines and license revocation for violations
Warning
Unlicensed casinos have no oversight. They could adjust RNG to their favor. Always stick to regulated platforms.
Live Dealer: Physical RNG
Live dealer games use actual cards, wheels, and dice—not software RNG:
- Real shuffle machines or hand-shuffled cards
- Physical roulette wheels spun by dealers
- Multiple camera angles prevent dealer cheating
This provides additional trust for players skeptical of software randomness.
Worked Example: Verifying a Provably Fair Dice Roll
Before your bet, a crypto casino publishes a SHA-256 hash of its server seed, say 8f4b2c71... You type in your own client seed (anything you like, such as "banana42"), and the casino increments a nonce starting at zero for each roll. When the game resolves, the casino reveals the server seed. You can then recompute SHA-256 on it and check that the hash matches the one published before play. The dice value itself is computed by hashing server seed, client seed, and nonce with HMAC-SHA-256, taking a fixed slice of bytes, and mapping to 0.00 to 99.99. Because you chose part of the input, the casino could not have tailored the seed to any specific outcome without breaking SHA-256.
Good to Know
This is why “provably fair” and “regulated RNG” are related but not identical ideas. Provably fair proves the operator honored its commitment for a specific round. Regulation and lab testing prove the broader game math and payout model are behaving as advertised over time.
What Certification Actually Proves
A GLI-11 certification does not mean a slot will pay you back tonight. It means that over millions of simulated spins, the RNG passes statistical tests for uniformity and independence, and the game math matches the submitted pay table within tight tolerances. Reputable state regulators (New Jersey DGE, Michigan MGCB, Pennsylvania PGCB) publish monthly revenue and hold reports that you can cross-check against advertised RTPs. If a licensed operator is consistently holding far above the theoretical house edge, regulators will notice before players do.
Strategy Insight
When you see a casino using the phrase "certified random" without naming the lab or the certificate number, treat it as marketing rather than proof. Real certifications are traceable to a specific document on the testing lab or regulator website.
Sources & References
- National Institute of Standards and Technology (NIST). Special Publication 800-90A: Recommendation for Random Number Generation Using Deterministic Random Bit Generators. Defines CSPRNG standards used in regulated gaming software. Publicly available at csrc.nist.gov.
- Provably fair verification — cryptographic hash commitment scheme: server commits to a seed hash (SHA-256) before the bet, reveals the seed after, and the player verifies hash(seed) matches the commitment. Standard cryptographic protocol, independently verifiable.
- RNG testing and certification standards — GLI-11 (Gaming Laboratories International) and BMM-001 define statistical tests (chi-squared, serial correlation, runs test) that RNG implementations must pass. Standards referenced by US state gaming commissions and international regulators.
- Third-party testing lab certifications (eCOGRA, iTech Labs, GLI, BMM Testlabs) — independent auditing organizations recognized by major gaming jurisdictions. Certification requirements publicly documented on respective websites.
Mathematical claims are independently verifiable. BonusBell platform analysis reflects our tracked platform directory and dated evidence checks as of March 2026.
Key Takeaways
- 1RNGs produce thousands of random numbers per second for game outcomes
- 2Reputable casinos use third-party tested and certified RNG systems
- 3Provably fair lets you mathematically verify game results weren't manipulated
- 4Licensed casinos face severe penalties for rigging—it's not worth the risk
- 5Live dealer games use physical randomness instead of software