CCF Labs · the Crypto Casino Foundation's testing lab

We test the game.
Then we show our work.

One question matters: is the game genuinely random, and does it pay what it claims? CCF Labs answers it against the NIST SP 800-22 battery and the published CCF-STD-001 standard — the same bar regulated markets require. Then, unlike a traditional lab, we publish the full report and let anyone re-run it.

Submit a Game Verify a Certificate
NIST
SP 800-22 test battery
CCF-STD-001
Published testing standard
10M+
Rounds per RTP simulation
48hr
Hotfix re-cert turnaround

What We Certify

Four ways to get certified

Every certification produces a signed digital certificate with a unique ID, a public verification page, and an embeddable badge.

RNG

RNG Certification

Full statistical analysis of your game's Random Number Generator. We run the CCF-STD-001 core battery — eight NIST SP 800-22 tests — over at least 1,000,000 bits of output to confirm no statistically detectable bias or patterning.

Includes: Frequency · Runs · Spectral · Serial · Entropy · Cumulative Sums — per CCF-STD-001

From $1,900 · ~10 business days
Learn more →
RTP

RTP Audit

Return to Player verification against stated odds. We simulate the game across 10M+ rounds and validate that actual payout rates fall within the declared RTP tolerance band.

Includes: Long-run simulation · Variance analysis · Payout confirmation · RTP certificate

From $1,200 / audit · Can bundle with RNG
Learn more →
LGC

Game Logic Certification

A perfectly random RNG can still be wrapped in unfair logic. We evaluate how a game turns random numbers into outcomes — reel strips, symbol weighting, feature and bonus triggers — and confirm they match the declared math, with no branch that quietly steers results.

Covers: RNG→reel mapping · Symbol weights · Feature & bonus frequency · Max win · Volatility vs declared

From $1,500 · Slots, crash, dice & more
Learn more →
HFX

Hotfix Validation

48-hour fast-track re-certification for previously certified games that have received a patch or update. Confirms the change did not alter RNG behavior, game logic, or RTP characteristics.

Requires existing CCF Labs certificate · Diff-based review · Updated certificate issued on pass

$490 · 48-hour turnaround
Learn more →
View Full Service Details →

When to certify

Six moments a certificate earns its keep

Certification isn't a one-time box-tick. These are the points in an operator's life where an independent, submittable report matters most.

01

New Market Quick Start

Entering a regulated market that requires independent RNG/RTP testing — leave with a report built for submission, not a rerun.

02

Audit Rescue & Fixes

A game failed a regulator or aggregator check. Targeted re-testing of the fixed build and a corrected certificate.

03

Hotfix Before Promo or Update

A patch or headline promo is about to go live. 48-hour hotfix validation keeps the certificate — and the badge — current.

04

Multimarket Expansion

One certification, reusable evidence. The same report and manifest travel across jurisdictions and aggregators.

05

Ongoing Compliance & Monitoring

Realized RTP is watched against the certified theoretical RTP; meaningful drift is flagged so problems surface early.

06

General Math & Payout Testing

Verify a game's math model and long-run payout against its declared paytable, independent of the RNG battery.

Process

From submission to live certificate

Our process is fully documented and transparent. You receive a written report at each stage.

1

Submit Game

Submit via our portal with game build, RTP declaration, and integration docs.

2

Statistical Analysis

The CCF-STD-001 battery runs over a certification-grade sample (≥ 1M bits). RTP simulation runs 10M+ rounds where applicable.

3

Written Report

Detailed technical report delivered. Includes pass/fail on each test, anomalies flagged.

4

Certificate Issued

Signed digital certificate with unique ID (WC-YYYY-XXXX) generated and activated.

5

Badge Goes Live

Embeddable badge activated. Links live to your public certificate page in real time.

Methodology

The CCF-STD-001 core battery

Eight tests from NIST SP 800-22, applied exactly as published in our testing standard. Every test produces a p-value evaluated at α = 0.01.

T-01 · NIST

Frequency (Monobit)

Checks that 0s and 1s appear with equal probability across the full output stream.

T-02 · NIST

Block Frequency

Divides the stream into blocks and checks each for localized bias.

T-03 · NIST

Runs

Validates that runs of identical bits oscillate at the expected rate for a truly random sequence.

T-04 · NIST

Longest Run of Ones

Detects abnormal clustering by comparing longest-run lengths against theoretical distribution.

T-05 · NIST

DFT (Spectral)

Detects periodic patterns in the sequence using discrete Fourier transform analysis.

T-06 · NIST

Serial

Tests uniformity of m-bit overlapping patterns across the full output.

T-07 · NIST

Approximate Entropy

Measures regularity — predictable pattern structure lowers entropy and fails the test.

T-08 · NIST

Cumulative Sums

Detects drift — an excess of 0s or 1s concentrated early or late in the stream.

Don't take our word for it — run the tests yourself

Our RNG Test Tool runs the NIST SP 800-22 battery live in your browser. Paste any RNG output and see the same real p-values our certification is based on. Nothing is sent to a server.

Open the RNG Test Tool →

Integrity

How a certificate holds up

A certificate only means something if the code we tested is the code that's running. Here is exactly how that is held together — and where the honest limits are.

GAME BUILD critical components RNG Game logic Paytable Settlement engine SHA-256 CCF CERTIFICATE hash manifest embedded rng9f3a1c8e… game.logic2b7c04af… paytablea4e0d1b2… settlement71d9fe33… CERTIFICATE ID WC-YYYY-XXXX submit HELD TO THE MANIFEST Change management re-cert on any change Audit hash-compare production vs manifest RTP monitoring drift from certified RTP Point-in-time snapshot — enforced by change-management duty, audit & monitoring, not by runtime access.
Build lock

Hash manifest

At certification we record a SHA-256 hash of every critical component — RNG, game logic, paytable, settlement — and embed the manifest in the certificate and report.

On change

Change management

Touching any critical component invalidates the certificate. The operator declares "deployed = certified" and must re-submit the changed build.

On audit

Hash comparison

A regulator — or CCF, on request — can hash the live production files and match them against the manifest to confirm nothing was swapped.

Continuous

Statistical monitoring

Realized RTP is watched against the certified theoretical RTP. A meaningful deviation is flagged — the net that catches a code swap after the fact.

The honest limit

No lab sits on your production server at runtime. Certification is a point-in-time snapshot, and server-side code stays under the operator's control. Online gaming has no hardware root of trust the way a land-based machine does (signed firmware, secure boot, GAT/Kobetron). So the real deterrent is legal, not cryptographic: for a licensed operator, running uncertified code puts the licence at risk — and the licence is the business.

The one trustless exception

One model removes trust entirely: provably fair. The server commits to a seed hash before the bet and reveals it after, so a player verifies each round themselves — no lab, no regulator required. It is a separate track from lab certification, which is why we recommend it to players and give them the tools to check.

CCF follows the certification model used by established iGaming test labs — a documented public standard, a point-in-time build lock, and a report built for regulatory submission. Reference: iTech Labs, GLI, eCOGRA.

Certificate Format

Every cert has a unique, verifiable ID

Certificate IDs follow the format WC-YYYY-XXXX. Each ID maps to a public page showing full test results, test date, RTP range, and current status.

Badges are hot-linked — if a certificate expires or is revoked, the badge automatically updates to reflect the new status. No code changes needed on your side.

Verify a Certificate →
CCF Labs
CCF Labs · Specimen Certificate
Certificate ID
WC-YYYY-XXXX
GameSample Game Title
StudioStudio / Operator
TypeRNG + RTP Audited
Declared RTP96.0%
IssuedOn issuance
Status SPECIMEN
✓
RNG Certified
CCF Labs
✓
RTP Audited
96.2% verified

Pricing

Clear, flat-rate pricing

No hidden fees. Volume discounts available for studios submitting 5+ games.

RNG Certification

$1,900 one-time

Per game. Full CCF-STD-001 battery.

  • Full statistical report
  • Unique cert ID
  • Public cert page
  • Embeddable badge
  • ~10 business days
Apply →
Best Value

RNG + RTP Bundle

$2,500 one-time

Per game. Full RNG cert plus RTP audit.

  • Everything in RNG
  • 10M+ round RTP sim
  • RTP certificate
  • Both badges
  • ~10 business days
Apply →

Hotfix Validation

$490 one-time

Re-cert after a patch. Existing cert required.

  • Diff-based review
  • Updated certificate
  • Badge stays live
  • 48-hour turnaround
Apply →

Get Certified

Certify your games

RNG certification is the credential players verify. Certify your games and your casino is listed in the public Certified Casinos directory, with its status shown right alongside.

Get Certified →
CCF
CCF · Specimen
CCF-YYYY-XXXX
Certified casino · sample format
SPECIMEN

Quick Verify

Verify a game certificate

Enter a certificate ID (format WC-YYYY-XXXX) or a game name to check its status.

Or go to the full verification page →