iTech Labs - FAQ - Certification

Frequently Asked Questions...

This page may answer your questions.  For further information please contact us.

How do I get my RNG certified?

iTech Labs tests and certifies a large number of RNGs every year. We offer set prices for RNG testing. After receiving your enquiry, we send you a small questionnaire to gather basic information about your RNG implementation. This allows us to estimate the cost accurately and offer you a fully fixed price. After receiving your response, we send you details about the submission requirements, testing process, reporting, deliverables and our fixed price. If you are happy with the information provided, we start the process. If you have additional questions you can email us or we can have a telephone call for further discussions.

Our website lists recommended RNG algorithms. You may consider implementing one of these algorithms as it may reduce re-work and re-testing. RNG testing involves source code evaluation, compilation to generate the raw RNG output, and testing the raw numbers and scaled/shuffled output. RNG implementation may use Pseudo random number generators or hardware generators. For both, we test the raw numbers and scaled/shuffled output.

How do I get my gaming system/games certified?

iTech Labs regularly certifies gaming systems including casino games, multi-player poker rooms, bingo rooms and skill-based games.  We always provide a fixed price proposal which includes the process, what we test, the deliverables and the price.

You need a working site available for our testing. We normally require player accounts and backend access during the testing period. We provide weekly or bi-weekly progress reports. This will include progress percentage for each module, details for each bug found including screen shots and references to the relevant standard. We retest bugs as they are fixed. We invoice monthly based on the progress made. After conclusion of testing, we provide the detailed certification report and certificates.

When do I get certificates for my site?

We issue the certificates after the testing process is completed. This involves first pass testing followed by retesting of defects. As soon as all high and medium priority issues are resolved, we issue the certificates for your gaming site. The certificates themselves are hotlinked to the original at the iTech Labs website.

How do I get RTP/RNG audited for my casino site?

Regular RTP/RNG audits gives players added confidence that the gaming system is subject to external scrutiny, and remains fair. For an RTP audit you need to let us know the number of sites. For an RNG audit you need to let us know the types of games (Poker, Blackjack, Roulette etc.). RTP audits are done for all single player casino games. RNG audits are done for card games, dice games and ball games. After receiving the relevant information, we provide a fixed price proposal. The auditing process involves either supervised extraction of data or sending game logs to iTech Labs securely. We conduct sanity checks and run various tests. This data is used for calculating RTP and analyzing RNG output. On completion, an audit report is prepared showing the results. This is hosted on your gaming site. The audit report itself is hotlinked to the original on the iTech Labs website.

What is the cost of games testing?

The price depends on the complexity, number of game clients (e.g., flash, download) etc for the games. If the game is a clone of a previously certified game we charge for testing only the changes. The scope of testing also depends on the applicable gaming standard.

After receiving your enquiry, we send you a small questionnaire to gather basic information about your games – list of games, game types etc. We will need to see game rules and/or games on a website to do the estimate for non-standard games. For slot games we may need to see the game rules and maths for the estimate. This process allows us to estimate the cost accurately and offer you a fixed price.

What is Return To Player (RTP)? Do you calculate RTP for games?

The Return To Player (RTP) is the single most important statistic for any game.  This is a percentage of money won to money played. A high RTP attracts players, but creates a higher risk for the house.  Games with high RTPs should be carefully checked to ensure there are no loop-holes which would allow the player an extra percent - any extra may be enough to have the house make a loss on the game. It is important to ensure that even with the best player strategy the RTP is still below acceptable level for each game.

We conduct theoretical calculation of RTP for all games we test and certify. To verify the theoretical RTP for a game we need the full game rules.  It is good for us to be able to see an implementation of the game if this is available, as it is a quick way to answer any questions not made obvious by the rules.  All our mathematical evaluations are performed and/or checked by professional mathematicians.

We also recommend monthly audits to verify that the actual RTP of each game is close to the mathematically verified result.  This is to ensure no error in initialisation or coding has introduced variations in the actual RTP. Please see ‘How do I get RTP/RNG audited for my casino site?’ above.

I'm not planning to operate in any of your stated jurisdictions.  What standards would you use for testing my site?

Each jurisdiction sets the standards they are willing to accept, and we use those standards supplemented with risk-based tests (we test the things which create a high risk for the operator if they were to fail e.g., game implementation not matching game rules or RTP). Outside these jurisdictions, as part of our initial negotiation on scope and price we would define the standards we are using.

What is independent testing and certification?

iTech Labs is a wholly Australian owned testing company based in Melbourne, Australia with wholly owned subsidiaries in Europe.  We are not owned by and do not have any interest in any gaming company.  Our accreditation by the gaming Jurisdictions is subject to maintaining professional competence, integrity and independence in our work. Each client's work is treated with complete confidentiality. Police checks and credit checks have been conducted for all consultants working for iTech Labs.

Are you an accredited test lab?

Absolutely. iTech Labs is ISO/IEC 17025 and ISO/IEC 17020 accredited by the National Association of Testing Authorities (NATA). NATA is a member of the international mutual recognition arrangement of the International Laboratory Accreditation Co-operation (ILAC). Our full scope of accreditation can be see on the NATA website here: under the accreditation number 15690.

What is collusion testing?

Multi-player games have a potential weakness - if several players around a table are able to see each other's cards (in a card game say), they may have enough information to unfairly compete against the other players in the same table.  Casinos and poker rooms employ a variety of collusion prevention and detection mechanisms.  A typical collusion prevention mechanism is to prevent players from the same network sitting at the same table. We check what you have implemented and what is required by the gaming jurisdiction.

Which certifications do you offer?

If your RNG (and scaling) have passed our tests, we provide RNG certification. This includes a logo for RNG certification, linked certificate and hotlinked original certificate.
If your RNG and games have passed our tests, we provide RNG & Game certification. This includes a logo for RNG and games certification, linked certificate and hotlinked original certificate.
If we audit the actual RTP/RNG of your games (from server logs), we provide a RTP/RNG audit certification. This includes a logo for RTP/RNG audit, linked audit report and hotlinked original audit report.
If your platform has passed our tests, we provide platform certification. If your games have passed integration tests, we provide integration certification.

I am a player. Can I check whether cards dealt are random?

Yes you can. If you analyse all the cards dealt to you (without omitting any card), you can see whether the cards are uniformly distributed over the range 1 to 52. The distribution becomes more even as the number of cards is increased. So please make sure that you have captured sufficient number of cards and not omitted any card in between. 2,000 cards is a good number to start with. The same approach is possible for dice and ball games. Please see our RNG audit reports to see results of such analysis.

All games tested by iTech Labs have game history/logs for real money games. It is possible to collect information about cards/dice/balls from the game history/logs.

Are PRNGs safe and secure enough to be used in gaming systems?

iTech Labs certifies hardware Random Number Generators (RNGs) and Pseudo Random Number Generators (PRNGs). The former uses hardware devices while PRNGs are based on software algorithms. Please see below some information on the suitability of PRNGs for gaming applications.

Period and reseeding

iTech Labs certifies only Pseudo Random Number Generators (PRNGs) that have long periods. For example Mersenne Twister (MT) has a period of  2^19937 – 1. This means that MT sequence will be repeated only after this many numbers are drawn and in a typical gaming system this may take years. The initial seeding is from a random source; if there is any reseeding it happens randomly and infrequently – these ensure that the probability of the same sequence repeating is practically zero.


The PRNG used in gaming applications may not be having a cryptographically secure algorithm. In cryptographic applications, the focus is more on the criteria that an attacker should never be able to crack the key (or predict the next value in the sequence) even if the attacker has huge computing power and enough time to perform a brute force crack. The statistical qualities of the generator are never an issue in cryptographic applications (though cryptographically secure generators generally do provide good statistical properties as well).

In gaming applications, the statistical quality of the generator is the most important criteria. Predictability does matter, but unlike in a crypto application any crack by an attacker will have to be accomplished in a much shorter time or else it would be of no use. In a crypto application, if an encrypted document or an encrypted key decrypted even after a year's effort, it would be important - but it would be irrelevant in a gaming application.

In addition in gaming applications, the observable values by players are only a partial value of the usually 32 bit numbers from the algorithm (e.g., a set of scaled numbers for the reel positions in a slot game, a roulette number or cards from a shuffled deck). Even these numbers are unlikely to be presented to a single player in a sequence because of multiple games played in an online system at any time.  Based on partial values available to players, the complexity of trying to crack it increases exponentially - trying to brute-force it may take quite of lot of computing effort and may hence be infeasible practically.

Any security issue in a certified PNG is insignificant or non- existent.

I haven't been a customer of yours before.  How do I get started?

We have a very simple method of starting a business relationship with you.  We agree on a scope of work, and a fixed price, usually in a proposal document, then we ask for a deposit payment.  This establishes the fact that we are working together on the project with an agreed scope and a fixed price.  Further invoices are monthly, based on progress made. Our status reports are weekly or bi-weekly as required, our prices are fair, and we love to increase our client list.  Please use the contact us page to see how we can help your business.


We use cookies to ensure that we give you the best experience on our website. Do you consent?