CCF Labs · the Crypto Casino Foundation's testing lab
We test the game.
Then we show our work.
One question matters: does the game's randomness hold up to testing, and does it pay what it claims? CCF Labs tests it against the published CCF-STD-001 standard, built on the same NIST SP 800-22 battery used across regulated markets. Then, unlike a traditional lab, we publish the full per-test report, and the test battery itself is open for anyone to run.
What We Certify
Four ways to get certified
Every certification produces a certificate with a unique ID, a public verification page, and an embeddable badge.
RNG Certification
Full statistical analysis of your game's Random Number Generator. We run the CCF-STD-001 core battery — eight NIST SP 800-22 tests — over at least 1,000,000 bits of output to confirm no statistically detectable bias or patterning.
Includes: Frequency · Block Frequency · Runs · Longest Run · Spectral (DFT) · Serial · Approximate Entropy · Cumulative Sums — per CCF-STD-001
RTP Audit
Return to Player verification against stated odds. We simulate the game across 10M+ rounds and validate that actual payout rates fall within the declared RTP tolerance band.
Includes: Long-run simulation · Variance analysis · Payout confirmation · RTP certificate
Game Logic Certification
A perfectly random RNG can still be wrapped in unfair logic. We evaluate how a game turns random numbers into outcomes — reel strips, symbol weighting, feature and bonus triggers — and confirm they match the declared math, with no branch that quietly steers results.
Covers: RNG→reel mapping · Symbol weights · Feature & bonus frequency · Max win · Volatility vs declared
Hotfix Validation
48-hour fast-track re-certification for previously certified games that have received a patch or update. Confirms the change did not alter RNG behavior, game logic, or RTP characteristics.
Requires existing CCF Labs certificate · Diff-based review · Updated certificate issued on pass
When to certify
Six moments a certificate earns its keep
Certification isn't a one-time box-tick. These are the points in an operator's life where an independent, published report matters most.
New Market Quick Start
Launching in a new market? Start with a published, per-test report that players and partners can check for themselves. Where a regulator requires testing by an approved lab, a CCF certificate does not replace it.
Audit Rescue & Fixes
A game failed an RNG or payout check. Targeted re-testing of the fixed build, and a certificate that covers the corrected version.
Hotfix Before Promo or Update
A patch or headline promo is about to go live. 48-hour hotfix validation keeps the certificate — and the badge — current.
Multimarket Expansion
One public report, reusable evidence. Share the same certificate page and report with every market and partner you work with. Each one decides for itself whether to rely on it.
Annual Renewal
Certificates carry a 12-month validity. Re-certify before the expiry date so the certificate stays Active on its public page.
General Math & Payout Testing
Verify a game's math model and long-run payout against its declared paytable, independent of the RNG battery.
Process
From submission to live certificate
Our process follows the published standard, and you receive a written report with the results.
Submit Game
Send the online submission form with your game details, version and declared RTP. We follow up with build delivery instructions.
Statistical Analysis
The CCF-STD-001 battery runs over a certification-grade sample (≥ 1M bits). RTP simulation runs 10M+ rounds where applicable.
Written Report
Detailed technical report delivered, with pass/fail and the exact p-value for each test, and anomalies flagged.
Certificate Issued
Certificate with a unique ID (WC-YYYY-XXXX) issued, and its public verification page goes live.
Badge Goes Live
Embed the badge on your site. It links to your public record, where players see the current certificate status.
Methodology
The CCF-STD-001 core battery
Eight tests from NIST SP 800-22, applied exactly as published in our testing standard. Every test produces a p-value evaluated at α = 0.01.
Frequency (Monobit)
Checks that 0s and 1s appear with equal probability across the full output stream.
Block Frequency
Divides the stream into blocks and checks each for localized bias.
Runs
Validates that runs of identical bits oscillate at the expected rate for a truly random sequence.
Longest Run of Ones
Detects abnormal clustering by comparing longest-run lengths against theoretical distribution.
DFT (Spectral)
Detects periodic patterns in the sequence using discrete Fourier transform analysis.
Serial
Tests uniformity of m-bit overlapping patterns across the full output.
Approximate Entropy
Measures regularity — predictable pattern structure lowers entropy and fails the test.
Cumulative Sums
Detects drift — an excess of 0s or 1s concentrated early or late in the stream.
Don't take our word for it — run the tests yourself
Our RNG Test Tool runs the NIST SP 800-22 battery live in your browser. Paste any RNG output and get real p-values from the same eight tests our certification uses. Nothing is sent to a server.
Open the RNG Test Tool →Integrity
How a certificate holds up
A certificate only means something if the code we tested is the code that's running. Here is exactly how that is held together — and where the honest limits are.
Hash manifest
At certification we record a SHA-256 hash of every critical component — RNG, game logic, paytable, settlement — as a manifest kept with the certificate.
Change management
Touching any critical component invalidates the certificate. The operator declares "deployed = certified" and must re-submit the changed build.
Hash comparison
A regulator — or CCF, on request — can hash the live production files and match them against the manifest to confirm nothing was swapped.
Re-verification
After a substantiated complaint, CCF can ask for the certified build to be re-verified. Refusing to cooperate is grounds for revocation under CCF-STD-001 § 9.
The honest limit
No lab sits on your production server at runtime. Certification is a point-in-time snapshot, and server-side code stays under the operator's control. Online gaming has no hardware root of trust the way a land-based machine does (signed firmware, secure boot, GAT/Kobetron). So the real deterrent is contractual and legal, not cryptographic: running a build other than the certified one while displaying the badge is grounds for revocation (CCF-STD-001 § 7), and for a licensed operator it also puts the license at risk.
The one trustless exception
One model removes trust entirely: provably fair. The server commits to a seed hash before the bet and reveals it after, so a player verifies each round themselves — no lab, no regulator required. It is a separate track from lab certification, which is why we recommend it to players and give them the tools to check.
CCF's process follows the general model used by established iGaming test labs such as iTech Labs, GLI and eCOGRA — a documented public standard, a point-in-time build lock, and a published per-test report. Those labs are named for comparison only; no endorsement is implied. A CCF certificate is not regulatory approval in any jurisdiction (CCF-STD-001 § 10) and does not replace testing a regulator may require.
Certificate Format
Every cert has a unique, verifiable ID
Certificate IDs follow the format WC-YYYY-XXXX. Each ID maps to a public page showing the per-test results, test date, sample hash and current status, plus RTP and game-logic results where those were audited.
A certificate's status (Active, Expired or Revoked) is shown on its public page, and badges link to the public record, so anyone who clicks one sees the current status rather than a static image.
Verify a Certificate →
Pricing
Clear, published pricing
Per-game prices. No hidden fees. Volume discounts available for studios submitting 5+ games.
RNG Certification
Per game. Full CCF-STD-001 battery.
- Full statistical report
- Unique cert ID
- Public cert page
- Embeddable badge
- 12-month validity
- ~10 business days
RNG + RTP Bundle
Per game. Full RNG cert plus RTP audit.
- Everything in RNG
- 10M+ round RTP sim
- RTP certificate
- RTP result on the public cert page
- 12-month validity
- ~10 business days
Hotfix Validation
Re-cert after a patch. Existing cert required.
- Diff-based review
- Updated certificate
- Certificate stays valid for the certified build during review
- 48-hour turnaround
Quick Verify
Verify a game certificate
Enter a certificate ID (format WC-YYYY-XXXX), a game name, or a casino's CCF ID or domain to check its status.
Or go to the full verification page →