How Casino RNGs Actually Work
Every online casino outcome — the card off the top of the shoe, the pocket the ball lands in, the dice roll — comes from a random number generator. Understanding how that generator works, who checks it, and what those checks can and cannot prove is the single most useful piece of knowledge a crypto gambler can have. Here is the whole picture, jargon-free.
Play verifiable games →There is no dice inside the server: PRNGs and seeds
Computers are deterministic machines, so casino software does not produce true randomness. It runs a pseudo-random number generator (PRNG): an algorithm that takes a starting value called a seed and expands it into a long stream of numbers that look statistically random. Given the same seed, a PRNG produces the exact same sequence every time — that is not a flaw, it is the definition. The randomness you experience at an online table is really the unpredictability of the seed, not of the algorithm. Modern casinos typically seed their generators from cryptographic entropy sources and then run algorithms like Mersenne Twister or cryptographic hash chains to map the output onto cards, wheel pockets and dice faces. The critical implication: whoever controls the seed controls the outcome. If the operator picks the seed after seeing your bet, the game can be rigged while the RNG itself remains mathematically flawless.
What a certified RNG actually means
Regulated casinos advertise certified RNGs, which sounds like a guarantee but is narrower than most players assume. Independent testing laboratories — firms such as GLI and eCOGRA are the best known — take a copy of the operator's RNG code, run millions of outputs through statistical batteries (frequency tests, runs tests, serial correlation, chi-squared distribution checks) and certify that the outputs are statistically indistinguishable from random and unbiased across the game's outcome space. That is genuinely valuable: it rules out crude bias, like a wheel that favors certain pockets. What it does not do is verify each individual outcome you receive. Certification is a snapshot of code in a lab; it cannot prove the code running in production tonight is the code that was tested, cannot detect selective seeding against specific players, and is only re-checked at audit intervals. You are still trusting the operator to run the certified code honestly, every hand, forever.
The trust problem: you cannot audit a server you cannot see
Strip away the branding and every traditional online casino asks you to accept the same claim: the number we generated on our private server, using a seed we chose, at a moment we controlled, was fair. There is no way for you to check this. The server logs belong to the operator, the seed is secret, and the sequence of events — did they generate the outcome before or after seeing your bet? — is invisible from the outside. Regulation and licensing add legal consequences for cheating, and reputable operators have strong incentives not to, but incentive is not proof. This is exactly the class of problem blockchains were built for: replacing 'trust me' with 'verify it.' Any casino whose randomness lives entirely on a server you cannot inspect is, by construction, unverifiable — regardless of how many certificates hang on the wall.
How provably fair commit-reveal is different
Provably-fair casinos restructure the game so honesty is enforced by cryptography rather than promised by policy. The scheme is called commit-reveal. Before you bet, the casino generates a secret server seed and publishes its SHA-256 hash — the commitment. A hash is a one-way fingerprint: it uniquely identifies the seed but reveals nothing about it, and no operator can find a second seed matching the same hash. Your outcome is then derived deterministically from the server seed combined with a client seed you can set yourself. Because the commitment was published before your bet, the house locked in its randomness while still blind to your action; because your client seed enters the mix, the house could not precompute a stacked deck. After the round, the server seed is revealed. You hash it, confirm it matches the earlier commitment, then re-run the published shuffle algorithm and reproduce the exact deck or roll. Llamabet anchors this commitment on the Sui blockchain itself, so even the timestamp of the commitment is publicly immutable.
What an on-chain commitment does and does not guarantee
Be precise about the claim. An on-chain commitment guarantees the outcome-generating seed existed, unchanged, before your bet — the operator mathematically cannot swap the deck after seeing your cards or your wager. Combined with a client seed and an open shuffle algorithm, it guarantees the outcome you received is the outcome the committed seed dictates. That is a strong, checkable property no certified-RNG casino offers. What it does not guarantee: that the game rules are favorable (a provably-fair game can still carry any house edge the operator sets — read the paytable), that the operator is solvent, or that the interface displays odds honestly. Provable fairness eliminates outcome manipulation, the most important attack; it does not replace the rest of your due diligence. The house edge on a fair game is disclosed math, not a trick — on Llamabet, dice runs a flat 1% edge and single-zero roulette 2.70% — and provable fairness is what lets you confirm the math is actually what you are getting.
Questions to ask any casino about its randomness
Whether a site runs a lab-certified PRNG or claims provable fairness, these questions separate substance from marketing. One: is the randomness committed before my bet, and where can I see the commitment? If the answer is a private server log, it is not a commitment. Two: can I set or influence the client seed? Without client input, a commit-reveal scheme can still be precomputed against you. Three: is the shuffle or number-derivation algorithm published, and can I re-run it independently? Four: after the round, is the raw seed revealed — not just a summary screen? Five: where is the commitment stored — an editable database, or an immutable chain? Llamabet's answers: the server-seed hash is committed on Sui before play, you control a client seed, the deterministic shuffle is published, seeds are revealed after each round, and a self-serve verifier lets you recompute outcomes in the browser. A casino that cannot answer these questions is asking for trust it has not earned.
Frequently asked questions
Can online casinos rig their RNG?
Technically, yes — a server-side PRNG is controlled entirely by the operator, and certification only tests a snapshot of the code in a lab, not the outcomes you personally receive. Regulation deters cheating but cannot prove its absence. Provably-fair casinos remove the possibility: the seed is cryptographically committed on-chain before your bet, so changing the outcome afterward is mathematically infeasible.
What is the difference between a certified RNG and provably fair?
A certified RNG has been statistically tested by an independent lab such as GLI or eCOGRA, which verifies the algorithm's outputs are unbiased — but you still trust the operator to run that code honestly. Provably fair replaces trust with verification: a hash of the seed is published before the bet, the seed is revealed after, and anyone can recompute the result themselves.
How do I verify a provably-fair game result?
Take the revealed server seed, hash it, and confirm it matches the commitment published before your bet. Then combine the server seed with your client seed and run the casino's published shuffle or roll algorithm — the output must reproduce your exact deck or number. On Llamabet the commitment lives on the Sui blockchain and the verification can be done in-browser.