How does a computer shuffle a deck of cards so that nobody, including the people who wrote the software, can predict the next card? A dealer at a live table relies on the physical disorder of riffled cards. Software has to produce the same disorder from a machine designed to follow instructions exactly, and then show outside testers that it did. Both kinds of shuffle have the same goal, which is to make every possible order of the deck equally likely on every deal.
Two Kinds of Random Number Generators
A pseudorandom number generator is an algorithm. It starts from a value called a seed and applies a fixed formula to produce a long sequence of numbers that look random. The same seed always produces the same sequence, and every such generator eventually repeats itself after a number of steps called its period.
One of the oldest designs, the linear congruential generator, multiplies the previous number by a constant, adds another constant, and keeps the remainder after dividing by a fixed value. It is fast and simple, and its output falls into patterns that statistical tests can detect. It has no place in any system where money or security depends on the result.
The Mersenne Twister, published in 1998 by Makoto Matsumoto and Takuji Nishimura, is one of the most widely used examples. Its period is 2^19937 – 1, a number so large that the sequence never repeats in practice. It was built for simulations and has a weakness for security work, since an observer who records 624 consecutive outputs can reconstruct its internal state and predict every number that follows.
Cryptographically secure generators are designed to close that gap. Their output cannot be predicted from earlier output in any practical amount of time, provided the seed is secret and drawn from a source with enough unpredictability, which engineers call entropy.
True random number generators measure a physical process, such as tiny electrical fluctuations in a circuit, radioactive decay, or the behavior of individual photons, and turn the measurements into numbers. They are slower than software generators, so they are usually used to supply seeds.
Server-Side Design
The shuffle happens on the operator’s server, out of reach of any player’s device. The deck order stays on the server, and only the cards a player is entitled to see are sent to that player’s screen, which also stops software on a player’s computer from reading cards early. A sound design for online poker collects entropy from a hardware source, feeds it into a cryptographic generator, and reseeds that generator often enough that no single seed controls a long run of hands.
Some systems fix the order of the whole deck at the start of each hand, and others draw each card at the moment it is needed. With a secure generator the two methods give every possible sequence of cards the same probability, so the choice between them comes down to engineering convenience.
From Numbers to a Shuffled Deck
A generator produces numbers, and a separate algorithm turns them into a deck order. The standard method is the Fisher-Yates shuffle, first described by Ronald Fisher and Frank Yates in 1938 and adapted for computers by Richard Durstenfeld in 1964. It works through the deck from the last position to the first, swaps each card with a randomly chosen card from the positions not yet fixed, and finishes in one pass, with one swap per card.
Small changes to this procedure introduce bias. If the swap partner is chosen from the whole deck at every step, including positions already fixed, some deck orders come up more often than others. The error is easy to make and hard to notice in a single hand, which is why reviewers read shuffling code line by line.
The Size of the Deck
A 52-card deck has 52 factorial possible orders, about 8 × 10^67, and every card shuffle done properly almost certainly produces an order that has never appeared before. For physical cards, statistician Persi Diaconis concluded in 1990 that seven ordinary riffle shuffles are enough to mix a deck thoroughly.
A software shuffle has to be able to reach that space of orders, and an early internet card room showed what happens when it cannot. In 1999, engineers at Reliable Software Technologies studied shuffling code that a card room had published to demonstrate its fairness. The code used a 32-bit seed, which allowed only about 4.3 billion possible decks. The seed came from the system clock in milliseconds since midnight, which cut the realistic number of decks to 86.4 million.
By synchronizing with the server’s clock and matching the cards already visible, the engineers could calculate every remaining card in the deck during play. The software vendor changed its algorithm after they reported the flaw.
Physical Entropy Sources
Cloudflare, an internet security company, films a wall of 100 lava lamps in the lobby of its San Francisco headquarters and converts the footage into random data for its encryption systems, as a backup to its other sources. The moving wax responds to small changes in temperature and vibration, which an attacker cannot easily reproduce. Silicon Graphics patented a similar lava lamp system in 1996.
A quantum random number generator measures events that physics treats as unpredictable at the most basic level. In one design, light passes through a beam splitter and two detectors count the photons that leave each side, with the difference between the counts serving as the random output. A device described in 2020 by a team led by David Drahi of the University of Oxford produced random numbers at 8.05 gigabits per second using off-the-shelf parts, and it checked the quality of its own randomness in real time.
Testing and Certification
Randomness can be tested, though it cannot be proven. Statistical test suites look for patterns that a fair generator should not produce, such as too many repeated values or runs that are too long. The suite published by the United States National Institute of Standards and Technology contains 15 tests, and the Diehard battery developed by George Marsaglia is another long-standing set.
For card games, testers also examine the dealt hands. Hold’em has 1,326 possible two-card starting combinations, and over millions of deals each one should appear at the same rate. Independent laboratories review the generator and the shuffling code and run their tests on large samples of dealt hands, and many gambling regulators require that certification before a card room can operate.
A passing result shows that no detectable pattern appeared in the sample tested. That is the limit of what statistics can establish, and it is why certification is repeated whenever the software changes.
The Condition Behind Every Deal
Stripped of the engineering, an online poker random number generator is a way of choosing one deck out of roughly 8 × 10^67 so that no person and no program can know which deck was chosen until the cards appear. Everything from the hardware seed to the certification tests exists to protect that single condition, and a system that meets it gives each of those decks the same chance on every hand.