Online poker RNG explained: how card shuffling really works

What is an RNG in online poker?

In a live card room, fairness comes from a physical deck and a dealer who riffles, boxes and cuts the cards in front of you. Online, there are no physical cards and no hands touching them. Instead, a piece of software called a random number generator, or RNG, decides the order of all 52 cards before each hand is dealt. Every flop, turn, river and hole card you have ever seen online was produced by this system.

The job of the RNG is simple to state and hard to fake: make every possible ordering of the deck equally likely, and make it impossible for anyone to predict or influence which ordering comes up. When it works correctly, the software is effectively a perfect, tireless dealer that never makes a mistake, never gets tired and never plays favourites. Understanding how it achieves that is the best antidote to the “this site is rigged” feeling that hits every player during a bad run.

How a random number generator actually works

Computers are deterministic machines, so “true” randomness is surprisingly hard for them. Most online poker rooms use a pseudo-random number generator (PRNG): an algorithm that starts from a hidden starting value, called a seed, and produces a long stream of numbers that are statistically indistinguishable from random. Feed the same seed in and you get the same stream out, which is exactly why the seed is protected so carefully.

The quality that matters for poker is not just that the numbers look random, but that they are unpredictable. That is why serious operators use a cryptographically secure PRNG (CSPRNG). A CSPRNG is designed so that even if you have seen thousands of previous outputs, you still cannot compute the next one or work backwards to the seed. To keep the seed itself unpredictable, the software gathers entropy — genuine physical randomness — from sources such as hardware timing, mouse and network jitter, or dedicated hardware entropy chips on the server.

In other words, a good online poker RNG combines a hard-to-guess seed built from real-world entropy with an algorithm that is mathematically hostile to prediction. The result is a number stream no player and no employee can anticipate.

From random numbers to a shuffled deck

A stream of random numbers is not yet a deck of cards. To turn one into the other, poker software uses a shuffling algorithm. The industry standard is the Fisher–Yates shuffle, a well-understood method that produces a genuinely uniform shuffle when it is fed by a good RNG. It works by stepping through the deck from the last card to the first and, at each position, swapping the current card with a randomly chosen card from the remaining unshuffled portion.

The reason Fisher–Yates is trusted is that, done correctly, every one of the 52-factorial possible deck orders is equally likely. That number — 52 factorial — is astronomically large, far bigger than the number of seconds the universe has existed, which is why it is safe to say that most well-shuffled online decks have never occurred before in the history of the game. A naive shuffle that reuses the same random value or loops incorrectly can introduce bias, which is one of the specific things testing labs check for.

Once the deck is ordered, the deal is deterministic: hole cards go to each seat in turn, the burn and community cards follow, and nothing about the ordering can change mid-hand. The shuffle happens up front, so the cards that will fall on the turn and river are, in effect, already decided the moment the hand begins — they are simply hidden from everyone, including the server operator.

How RNGs are tested and certified

You do not have to take an operator’s word for any of this. Licensed poker sites submit their RNG and game logic to independent testing laboratories that specialise in gaming software. These labs run millions of simulated hands and apply a battery of statistical tests — checking distribution, frequency, independence between outcomes and the absence of predictable patterns — before issuing a certificate.

Certification is not a one-off. Regulators such as the Malta Gaming Authority, the UK Gambling Commission and the Isle of Man Gambling Supervision Commission require ongoing testing and reserve the right to audit an operator’s live systems. When we assess a room’s trustworthiness in our poker site comparison, a valid licence and published RNG certification are non-negotiable baseline requirements, not bonus points.

Provably fair and blockchain-based shuffling

A newer approach, popular on crypto poker sites, is the provably fair model. Here the site commits to its randomness in advance: before a hand, it publishes a hashed version of a secret “server seed”. Your client contributes its own seed, the two are combined to shuffle the deck, and after the hand the server reveals the original seed. Because you can hash the revealed seed and confirm it matches the earlier commitment, you can prove the site did not change the deck after seeing how the action played out.

Provably fair systems do not replace licensing or independent testing — they add a layer of player-verifiable transparency on top. Our top-rated crypto room, reviewed in full in our CoinPoker review, is a good example of a room that leans on tested randomness alongside crypto-era transparency. Larger networks such as those covered in our GGPoker review rely on conventional certified RNGs backed by heavyweight licensing instead.

“Is online poker rigged?” The honest answer

This is the single most common question players ask, usually after losing with aces for the third time in a session. The honest answer is that reputable, licensed rooms are not rigged, and there are strong practical reasons why. A licensed operator makes its money from the rake it collects on a huge volume of hands. Rigging the deal would risk its licence, its testing accreditation and its entire business for no upside, since the house already profits regardless of who wins a given pot.

What actually drives the “rigged” feeling is a mix of psychology and mathematics. Online, you see three to ten times as many hands per hour as you do live, and multi-tabling multiplies that again, so you simply witness far more improbable-looking events in a given week. Bad beats are memorable while the thousands of unremarkable hands are forgotten. And because all-in situations often get the money in with one player only a modest favourite, the underdog winning is not a glitch — it is the exact frequency the odds predict. Certified randomness and human memory are simply telling two different stories.

Why certification matters: lessons from poker history

Scepticism about online poker is not baseless — it is rooted in real events from the game’s early days. The most infamous are the Absolute Poker and UltimateBet “superuser” scandals of 2007 and 2008. In both cases, insiders were able to see opponents’ hole cards and win millions before players and independent investigators exposed the cheating. Crucially, those scandals were not cases of a rigged RNG: the shuffle itself was random, but a security hole let privileged accounts view information they should never have had access to.

That distinction is exactly why modern oversight covers more than the shuffle. The fallout from those cases pushed the industry toward stricter licensing, mandatory independent testing and ongoing security audits, so that both the randomness of the deal and the integrity of the platform around it are verified. When you see a room advertise a current licence alongside a recent RNG certificate today, you are looking at the direct legacy of those hard lessons — a layered system designed so that no single point of trust, human or software, can be quietly abused.

It is also worth remembering that the rooms involved in those scandals were poorly regulated at the time. The established, well-licensed operators we rank have paid players reliably for many years precisely because they submit to that scrutiny. A long, clean track record is itself a meaningful data point about how seriously an operator takes fairness.

How to check a poker site’s RNG for yourself

You do not need to be a cryptographer to vet a room. A short, practical checklist covers the vast majority of what matters:

• Confirm the site holds a valid licence from a recognised regulator and that the licence number resolves on the regulator’s website.
• Look for a published RNG certificate from an accredited lab such as iTech Labs, GLI, BMM Testlabs or eCOGRA.
• Read the fair-play or shuffle section of the terms to see how the deal and RNG are described.
• On crypto rooms, check whether a provably fair or hashed-seed verification tool is offered.
• Weigh the operator’s track record: how long it has paid players reliably and how it handles disputes.

Every room in our rankings clears these checks before it earns a rating, which is why our reviews spend as much time on licensing and security as they do on bonuses and traffic. If a site cannot show you a licence and a certificate, that absence is far more telling than any run of bad beats.

Why the RNG should change how you think, not how you play

Once you accept that the deal is genuinely random, a lot of tilt-inducing superstition falls away. There is no “due” card, no pattern to exploit in the shuffle, and no benefit to changing seats or waiting for the software to “pay you back”. Because the deck order is fixed the instant the hand begins, slow-rolling or changing your timing cannot influence the turn or river.

What remains is the game itself: pot odds, position, hand reading, bet sizing and disciplined bankroll management. A certified RNG is the guarantee that skill, not software, decides your results over the long run. That is genuinely good news — it means the edge you build through study and volume is real and repeatable, which is exactly what you want from a game you intend to beat.