How much data do I need for NIST SP 800-22?

About 1,000,000 bits per sequence lets every test run. Some tests work with as few as 100 bits, but the Overlapping Template, Linear Complexity and Random Excursions tests need around a million.

Does passing SP 800-22 prove my generator is secure?

No. Passing shows no statistical weakness was detected. It does not prove unpredictability, and it is not a certification. Entropy sources for FIPS 140-3 are assessed with SP 800-90B instead.

Guides › How to run SP 800-22

How to run the NIST SP 800-22 randomness tests

NIST Special Publication 800-22 Revision 1a defines 15 statistical tests for random and pseudorandom bit generators. This guide walks through running them on your own generator, from collecting data to reading the results.

Updated October 20, 2026

What the suite tells you, and what it does not

Each test looks for one kind of pattern a good random sequence should not have: too many ones, long runs, periodic structure, a short linear feedback register, compressibility and so on. Every test returns a p-value. The sequence passes a test when that p-value is at least the significance level α = 0.01.

Passing means no weakness was detected. It is not proof of unpredictability, and it is not a certification. If you are validating an entropy source for FIPS 140-3, the relevant document is NIST SP 800-90B, which estimates min-entropy instead of running pass/fail tests (comparison of test suites).

Step 1: collect enough raw output

Capture the generator's output as raw bytes in a binary file. Aim for at least 1,000,000 bits (125,000 bytes) per sequence: that is the length at which every test in the suite can run. Shorter files still work, but the longer tests report N/A (minimum length per test).

Test the output you actually use. If your design has a raw noise source and a conditioning step, test both separately so you know where any problem comes from.
Use a fresh capture, not the same seed or the same buffer repeated.
Write bytes, not text such as 0x3f, 0xa1. The input file guide has snippets for Python, C, Linux and microcontrollers.

Step 2: choose a tool

Option A: the NIST reference code (STS 2.1.2)

NIST publishes the Statistical Test Suite as C source code. It runs locally, so data never leaves your machine, and it can evaluate many sequences at once.

# after downloading and unpacking sts-2.1.2 from the NIST website
cd sts-2.1.2
make
./assess 1000000          # bit length of each sequence
# menu: [0] Input File → path to your file
#       select tests → 1 (all)
#       parameter adjustments → 0 (keep defaults)
#       number of bitstreams → e.g. 10
#       input format → [0] ASCII 0/1 or [1] Binary
# results: experiments/AlgorithmTesting/finalAnalysisReport.txt

Expect some friction: the code predates current compilers, and the interactive prompts are easy to get wrong. The STS troubleshooting guide covers the common build and runtime errors.

Option B: an online implementation

NISTTEST.COM runs all 15 tests on one uploaded sequence and shows every p-value on screen, with no account. Upload a .bin file (up to 500 KB free) or a .txt file of 0/1 characters. A professional PDF report is available if you need to hand results in.

Step 3: run all 15 tests

#	Test	Looks for
1	Frequency (Monobit)	Overall bias towards 0 or 1
2	Frequency within a Block	Local bias inside fixed-size blocks
3	Runs	Too many or too few switches between 0 and 1
4	Longest Run of Ones in a Block	Runs of ones that are too long or too short
5	Binary Matrix Rank	Linear dependence between fixed-length substrings
6	Discrete Fourier Transform (Spectral)	Periodic features
7	Non-overlapping Template Matching	Too many occurrences of a given aperiodic pattern
8	Overlapping Template Matching	Too many runs of ones of a given length
9	Maurer's Universal Statistical	Whether the sequence can be compressed
10	Linear Complexity	Output that a short LFSR could produce
11	Serial	Uneven frequency of overlapping m-bit patterns
12	Approximate Entropy	Regularity between adjacent pattern lengths
13	Cumulative Sums (Cusum)	Random walk drifting too far from zero
14	Random Excursions	Unusual visit counts to states of the random walk
15	Random Excursions Variant	Unusual total visits to states of the random walk

Step 4: read the results

A test passes when p ≥ 0.01. For truly random data, about 1 in 100 tests fails by chance, so one failure on one sequence is not evidence of a broken generator. What matters is a test that fails repeatedly across fresh sequences, or p-values that are not spread evenly between 0 and 1. The p-value guide explains the proportion and uniformity checks NIST uses for this.

An N/A result means the sequence was too short for that test. It is not a failure; capture more data.

Try it on your own data. Upload a file and see all 15 p-values in about a minute. No account needed.

Run the free test

NISTTEST.COM is an independent implementation of NIST SP 800-22 Rev. 1a and is not affiliated with or endorsed by the National Institute of Standards and Technology.