How random number generators work

What a random number generator does

Which symbols stop on a reel, which card is dealt, where a virtual ball settles: every one of those results starts as a number produced by a random number generator, usually shortened to RNG.

The generator itself knows nothing about the game. It produces numbers, and the game maps those numbers onto outcomes. That mapping step is called scaling.

The Gambling Commission in Great Britain sets a technical standard for this, RTS 7, whose stated aim is "to ensure that games and other virtual events operate fairly"¹. It requires that "any scaling applied to the output of the random number generator maintains the qualities as detailed", so the scaled results stay as unpredictable and as evenly spread as the raw numbers were¹.

True random and pseudo-random

Two broad designs are in use.

A hardware generator, sometimes called a true RNG, "gets randomness from physical processes that are hard to predict, such as electronic noise or tiny timing variations in circuits"².

A pseudo-random number generator, or PRNG, instead "uses an algorithm and a secret seed to generate number sequences that are statistically random and unpredictable"². Online casino software normally relies on a PRNG, often reseeded from a hardware source.

The prefix matters. A PRNG is deterministic: the same algorithm with the same seed produces the same sequence every time. What makes it fit for purpose is that the seed is secret and the sequence cannot realistically be reconstructed from the outputs.

Seeding, and why it decides everything

The seed is the starting value the algorithm works from. If it can be guessed, the sequence can be predicted.

BGaming, which publishes a technical explainer on the subject, puts the risk plainly: "If the seed could be guessed or influenced, future results might become predictable"².

RTS 7 therefore requires that "any forms of seeding and re-seeding used do not introduce predictability"¹. It also requires that "random number generation does not reproduce the same output stream (cycle), and that two instances of a RNG do not produce the same stream as each other (synchronise)"¹.

That second point is easy to miss. Two copies of the same game running on two servers must not drift into the same sequence, or a result seen in one place would reveal a result elsewhere.

What the technical standard asks for

Who tests the generator

In Great Britain, operators "must ensure that all new products have been adequately tested by an approved test house prior to release", and evidence of that test report has to be supplied to the Commission⁵. The Commission also expects an annual games testing audit from businesses that develop or update RNG-driven products⁵.

Gaming Laboratories International, one of the long-established test houses, publishes the scope of its RNG work. It lists source code review, "Assessment for the RNG period", "Determination of the RNG range", "Investigation of the seeding/re-seeding" and "Inspection of the background cycling/activity", followed by the DIEHARD battery of tests and outcome distribution tests³.

Its published standard for interactive gaming systems, GLI-19, requires that an RNG be "cryptographically strong at the time of submission", that outcomes be "statistically independent" and "fairly distributed (within statistically expected bounds) over their range", and that scaling must not "compromise the cryptographic strength of the random number generator"⁴.

Several laboratories work in this market. BGaming names BMM Testlabs, iTech Labs, GLI, eCOGRA and TST among the testing labs providing RNG services².

A certificate covers a specific build of a specific product at a specific date. It is not a permanent quality mark for a website, which is a separate question covered in recognising clone and phishing gambling sites.

Why past results cannot affect future ones

This is the practical consequence of the standard, and the one most often misunderstood.

Each result is drawn from fresh numbers. As BGaming puts it, "Every spin or draw is an independent event, because it is based on fresh random numbers rather than previous results"².

The Wizard of Odds is equally direct on the folklore around machines running hot or cold: "There is no such thing as hot and cold cycles with slot machines. The ups and downs are just normal random variation"⁶. On respectable machines, "every play has the exact same probability of winning"⁶.

So a long run of losing spins does not build up anything. There is no counter, no debt, and no point at which a game becomes due. The non-repeatability rule in RTS 7 is about the generator not cycling; it is not a promise that outcomes take turns¹.

What "provably fair" adds, and what it does not

Some studios publish a cryptographic verification scheme, usually marketed as provably fair. BGaming describes it as "an algorithm which is used to analyze and verify fair play", based on a cryptographic method that ensures "the outcome of the round is unaffected by a players bet"⁷.

The mechanics are straightforward. The studio calculates the round result and generates "a random string called Secret for each round", hashes the two together with SHA-256, and shows the player that hash before any bet is placed⁷. The player can also submit a client seed, either "a number randomly chosen by the system" or one they pick themselves⁷. After the round, the player receives the result and the secret and can re-run the hash to confirm it matches what was published beforehand⁷.

What it proves

That the outcome was fixed before the bet was placed and was not altered afterwards.

What it does not prove

• That the game is good value. Verification says nothing about the paytable. The long-run return is set by the maths, which is what our RTP guide covers.
• That the published RTP is accurate. Confirming one round does not test the distribution across millions of rounds. That is what statistical testing by an approved test house is for⁵.
• That the operator will pay you. Withdrawal handling, licensing and complaints are separate matters entirely.
• That the rules are as described. Under RTS 3, information about the chances of winning "must be easily available before the customer commits to gamble", and that disclosure is what you check the maths against⁸.

Verification and certification answer different questions. One shows a single round was not tampered with; the other shows the generator behaves correctly across enormous volumes of play.

What none of it changes

A correctly implemented RNG makes results unpredictable. It does not make them favourable. The game still returns less than is staked over time, because that is how the paytable is built, and the size of that margin is explained in our house edge guide.

The same generator sits behind games from every studio listed in the KiraBet provider directory, and behind the shuffles and wheel results used in some live casino formats.

Gambling involves financial risk. If you are worried about your gambling, our responsible gambling page lists free support.