Online Keno: How RNG Keno Works and How to Verify It's Fair

The short answer

Licensed online keno isn't rigged, at least not the way players fear. The draw comes from a tested random number generator; the profit comes openly, through the paytable. Wizard of Odds casino surveys found live keno keeping 20 to 50 cents of every wagered dollar with perfectly random draws. You can even verify a draw yourself. This guide shows how.

Is online keno rigged?

At a licensed casino, no, and here's the uncomfortable reason: rigging the draw would be pointless. The paytable already guarantees the house its margin, legally and in plain sight. A casino doesn't need to know which numbers are coming. It only needs to pay each catch slightly less than the true odds justify.

The clearest evidence is how much keno can keep without anyone touching a ball. Wizard of Odds (Michael Shackleford, page updated 2024) surveyed real casino keno paytables and found these player returns:

Every game in those surveys used a random draw. The returns vary that wildly because the paytables vary, nothing else. If "return" and "house edge" are new terms, what is RTP covers them in ten minutes.

Online keno advertises much friendlier numbers. Stake, for example, publishes "a return to player rate of 99%" and "a low house edge of only 1%" for its in-house keno (2026). That's the operator's own claim, not an audited figure, but notice what it admits either way: the site keeps 1% of everything wagered, automatically, on honest draws. A game that profits from every fair round has nothing to gain by faking one, and a license to lose.

So the honest answer to "is online keno rigged" is: the draw almost certainly isn't, and the price definitely is. Where that price sits, format by format, is the subject of keno house edge. And if the game itself is new to you, start with the plain-English keno explained overview.

How RNG keno actually works

Online keno replaces the ball hopper with software: a random number generator (RNG) selects 20 of the 80 numbers the instant you click play. The algorithm produces values continuously and has no memory, so each draw is an independent shuffle. Your spots, catches, and paytable work exactly as they do in a lounge; the keno terms glossary defines each if you need it.

The obvious question is who checks the software. In licensed markets, independent test labs do, before the game ever goes live. Gaming Laboratories International publishes GLI-19, the standard most regulators reference for online casino systems; the current version 3.0 (2024) includes a dedicated RNG requirements chapter alongside platform and game rules.

What does certification actually involve? eCOGRA, one of the major labs, describes its RNG certification as testing the generator's source code, statistical output, seed generation, and algorithm vulnerabilities, with periodic re-audits after approval. Its certifications are accepted in 36+ jurisdictions, from Michigan and Pennsylvania to Ontario and Malta. iTech Labs and BMM Testlabs run comparable programs. This is the same testing regime behind video keno machines and lottery terminals, a comparison we draw out in video keno vs live vs online.

One certificate, though, covers a whole system. It can't tell you anything about one specific draw you just lost. That gap is exactly what the second trust model exists to close.

What is provably fair keno?

Provably fair keno lets you verify each individual draw yourself, using cryptography instead of a lab's word. Per Chainlink's technical guide (2026), the standard scheme has three ingredients. The operator generates a secret server seed and publishes its SHA-256 hash before you bet, a commitment it can't quietly change. You supply a client seed of your own. A nonce counts your bets, one by one.

Each result comes from combining all three through HMAC-SHA256, a keyed hashing function. Same inputs, same draw, every time. When you later rotate your seed pair, the operator reveals the raw server seed. You re-hash it, confirm it matches the fingerprint you were shown up front, and recompute any past draw from public inputs.

The difference from lab certification is who does the trusting. Chainlink's guide puts it plainly: traditional certified RNGs run on operator-controlled servers, and periodic audits "cannot prove the fairness of a specific individual hand or spin in real time." Certification answers "is this generator fair overall?" Provably fair answers "was my draw fixed?" They're complementary, not competing, and the mix-up between them is one of the most common trust mistakes in crypto gambling.

We walk through the full mechanics, sealed-envelope analogy and all, in provably fair explained. Below is just the keno-specific version.

How do you verify a past keno draw yourself?

Here's the loop for one online keno round, based on Stake's published implementation documentation (2026). We're using it because it's unusually complete, as an illustration of the pattern, not an endorsement of the operator. Other provably fair sites differ in small details but follow the same shape.

1. Copy the hashed server seed before betting. The fairness menu shows a SHA-256 hash of the operator's secret 64-character server seed. Save it somewhere the site can't edit, like a note on your phone.
2. Set your own client seed. If the field is editable, change it. Now the operator committed to its seed before knowing your input, so it couldn't pre-cook results against you.
3. Play a round and record it. Note the 10 or 20 numbers drawn and the nonce for that bet. The nonce increments by one with every wager, pinning each round to its place in line.
4. Rotate the seed pair. Requesting a new server seed retires the old one, which forces the site to reveal it in plain text.
5. Check the commitment. Run the revealed seed through any SHA-256 tool. The output must match the hash you saved in step 1. If it does, the seed was never swapped.
6. Recompute the draw. An open-source verifier feeds the server seed, client seed, and nonce into HMAC-SHA256 and converts the output bytes into board positions. In Stake's scheme, each hash yields 32 bytes and each number consumes 4, so a keno draw of 10 numbers takes two rounds of the function, tracked by a cursor.
7. Compare. The recomputed numbers must match the draw you recorded in step 3, exactly. If they do, that draw was locked in before you ever clicked bet.

Use an independent verifier tool rather than only the site's built-in one when you can. It keeps the casino out of the checking process entirely. And if a site won't reveal retired seeds, or a hash fails to match, stop playing there. A failed check is the loudest red flag this system can produce.

What do regulators require online keno to disclose?

In regulated markets, the price of the game must be published before you bet, and the outcome must come from the RNG, by rule. The UK Gambling Commission's RTS 3 requires licensed operators to make key facts easily available before a customer commits to gamble. Those facts include how the game works, the house edge or margin, and the RTP percentage or the probability of winning events. The standard's stated aim is to "enable customers to make informed decisions about whether to gamble based on their chances of winning."

New Jersey writes the randomness requirement directly into law. Under N.J.A.C. 13:69O-1.5, the state's internet gaming rules, outcomes on server-based games are RNG-determined; even if your connection drops mid-round, "the game shall produce the final outcome as determined by the RNG." Several US state lotteries sell keno-style RNG games online under similar oversight.

Read those two rules together and the regulatory picture is clear. The system assumes the draw is random, verifies it through labs, and forces the operator to disclose the edge up front. For a licensed operator, tuning draws wouldn't be a clever business model. It would be a license-ending violation of the one asset the whole business stands on.

What does real keno rigging look like?

Every documented case is an insider job, not a licensed operator quietly tuning draws. The most famous one is keno-specific. Ronald Dale Harris, a programmer at the Nevada Gaming Control Board, used confidential source code to predict a keno PRNG's output; his accomplice hit a $100,000 keno win at Bally's Park Place in Atlantic City and was arrested in January 1995. Per the Las Vegas Sun (1998), Harris drew a seven-year sentence and a place in Nevada's Black Book.

Online poker supplies the other canonical case. Per PokerNews' retrospective (2022), insiders at Absolute Poker and UltimateBet used unauthorized "superuser" code to see opponents' hole cards between 2006 and 2007. The Kahnawake Gaming Commission fined Absolute Poker $500,000 in 2008 and UltimateBet $1.5 million in 2009, and ordered about $22 million reimbursed to players.

Notice the pattern. Both cases involved people with privileged access, at points where oversight was weak, and both ended in exposure and punishment. Neither looks anything like "the casino makes your numbers miss." That threat model, insider access to a predictable PRNG, is precisely what modern certification standards and seed-commitment schemes were built to close.

The real risk in 2026 sits somewhere else entirely: unlicensed sites. No lab has tested their RNG, no regulator can fine them, and no seed commitment binds them. Such a site can run a crooked draw, or simply refuse to pay a winner, with no consequence you can reach. Every fairness mechanism in this article assumes you're playing somewhere those mechanisms actually apply.

What provably fair keno doesn't fix

A verified draw is not a good deal; it's just an honest one. A provably fair keno game with a 1% house edge still has a 1% house edge, and every verification will cheerfully confirm it. Fairness answers "were the numbers random?" The paytable answers "what does playing cost?", and no hash improves that answer.

The underlying math doesn't soften either. In a fair 80-ball game, each number you pick has a 1 in 4 chance of being drawn, and sweeping a 10-spot ticket is a 1 in 8,911,711 event. Wild Academy computed those exactly (2026) from the hypergeometric formula, P(k) = C(20,k) x C(60,n-k) / C(80,n). Verification proves those odds were applied. It can't move them.

Two caveats on the friendly-looking online numbers. First, Stake's 99% figure describes its own compact variant, a 40-number board drawing 10, so it doesn't map onto classic 80-ball paytables; treat it as a published claim about a different game shape. Second, a verification system only protects players who use it. If you never run the check, provably fair is just a marketing badge. You don't need to verify every round; spot-checking occasionally, especially after a painful loss, is enough to keep a commitment scheme honest.

Provably fair also has a coverage boundary. It applies to a casino's in-house games, while third-party slots and live tables run on certified RNG instead. And it says nothing about withdrawals, licensing, or support. Treat it as one strong trust signal among several. Our provably fair and casino trust course walks through the full checklist.

Sources

• Wizard of Odds — Keno — retrieved July 2026
• Gaming Laboratories International — GLI Standards, GLI-19 v3.0 — retrieved July 2026
• eCOGRA — RNG Certification — retrieved July 2026
• Chainlink — Provably Fair Randomness: A Technical Guide — retrieved July 2026
• UK Gambling Commission — RTS 3: Rules, game descriptions and the likelihood of winning — retrieved July 2026
• Cornell LII — N.J.A.C. § 13:69O-1.5, Server-based gaming system — retrieved July 2026
• Las Vegas Sun — Slot cheater receives seven-year prison term — retrieved July 2026
• PokerNews — UltimateBet and Absolute Poker superusing scandal retrospective — retrieved July 2026