Poker RNG.

A software shuffle is two things bolted together. The first is a generator that produces numbers. The second is an algorithm that turns those numbers into an order for fifty two cards, which is a much duller piece of work than it sounds: the standard method walks the deck from the back, swapping each card with one chosen from the part not yet visited. It is textbook material, published decades ago, and there is nothing secret about it.

The interesting failures live in the join. A good generator feeding a careless conversion produces an uneven deck, and an even conversion fed by a poor generator produces a predictable one. That is why the audit described below looks at the raw numbers and at the shuffled decks separately, rather than checking one and assuming the other. Neither half being fine is evidence that the pair is.

Not the operator, and not you. The regulator keeps a list of approved test houses, the operator picks one from that list, and the two agree the scope. The work has four parts: reading the documentation to establish what was built, researching the chosen algorithm for weaknesses that are already publicly known, reading the source code to confirm the implementation matches the documentation, and running statistical analysis on the output. That last part covers the raw stream and the shuffled deck data, which is the sentence worth remembering from the whole page.

The timing matters as much as the content. New games and new generators are not allowed out until the testing is done, minor changes are picked up by an annual audit, and a change to the generator underneath several games means a representative sample of them is tested again. In the Netherlands the shape is the same with different names: the gaming system is approved against a published assessment scheme by a testing body the minister has designated, and the regulator publishes the list of those bodies. Both regimes put the same two things in the way of trusting an operator's own word, an outside laboratory and a public standard.

Almost nothing, and it is worth being blunt about why. Put A ♥ A ♦ all in against K ♣ Q ♦ and you win 87.12 percent of the time when all five cards are dealt. Roughly one time in eight the best hand before the flop loses the pot, and over an evening of such spots the losses arrive in clumps, because that is what clumps look like when you only notice them afterwards.

A few thousand hands cannot separate an unfair deal from a normal bad run, and your memory of those hands is a much worse instrument than the hands themselves, since the ones that hurt are the ones that stay. That is not a reassurance that everything is always fine. It is the reason this job is done with the raw output in a laboratory rather than with impressions at a table, and it is the same argument that runs through the page on cheating: the view that settles these questions is not the one you have.

What is left to you is worth doing anyway. Check that the site holds a licence from a regulator you can name, and read what that regulator requires rather than what the site says about itself. If you think something is wrong, report it to the operator and to the regulator, with dates and hand identifiers, exactly as you would for players working together.

Two things are missing on purpose. There is no description of how a weak generator would be attacked, and there is no list of signs that a shuffle has been tampered with. The first is a method, and this section does not publish methods. The second is the omission readers notice, and it is the one we are most sure about: a list of what gives something away is also a list of what the next person will make sure to avoid, and in the meantime it hands a player false certainty built on far too few hands.

There is also no verdict on any particular operator's generator here. We have not read anybody's audit report, we are not a test house, and a confident judgement we cannot back would be exactly the sort of thing this section exists to avoid. What we can do is say where the standard is written down and who is allowed to check against it, which is what the sources below are for.

Our own position, for completeness. The practice table on this site shuffles in your browser with the same textbook algorithm, using the randomness function the browser provides. It has no buy in, no prize pool and no payout, so there is nothing to certify and nobody has certified it. It is a training table, and where our own boundaries sit is written out on the page about our bots.