Online poker uses a random number generator to shuffle the deck before every hand. Reputable rooms have their RNG audited by independent labs, and the patterns you notice at the table are almost always variance and sample size, not rigging. That is the short answer. The longer one is what the rest of this article is about, because once you know what an audit actually checks, what it cannot promise, and what your brain does with a thousand-hand sample, the noise around “is poker rigged” goes quiet.
The short answer, in one line
A reputable online room shuffles with a cryptographic RNG, gets that RNG audited by a third-party lab, and runs every hand against an internal monitor that watches for collusion and bot activity. None of that proves no one ever cheats. It does prove the deck itself is fair.
What an audit actually looks at
| What gets checked | Who usually checks it | What a passing audit proves |
|---|---|---|
| RNG output stream | iTech Labs, GLI, eCOGRA, BMM Testlabs | Distribution is uniform across millions of pulls; no detectable bias |
| Shuffle algorithm | The same labs | Each of the 52 factorial deck orderings is reachable with equal probability |
| Hand history database | Internal security + regulator | Patterns flagged across millions of hands; collusion and chip-dumping are detectable |
| Geo and identity | The jurisdiction’s gambling regulator | Players are in a licensed market, KYC is real, account is one human |
| Payout integrity | External financial auditor | Money paid in equals money paid out, minus rake (no skim) |
The five rows are independent. A site can pass the RNG audit and still have a slow KYC process. The rigging question is almost always about row 1 and row 2, and those are the rows the math is strongest on.
How a poker RNG actually shuffles a deck
A 52-card deck has a number of possible orderings equal to 52 factorial. That is roughly 8 × 10⁶⁷, more orderings than there are atoms in the Milky Way. A fair shuffle has to make every one equally likely, which is harder than it sounds.
The standard algorithm is Fisher–Yates. You pick a random card from positions 1 through 52, swap it with position 52. Then a random card from 1 through 51, swap it with 51. And so on. If your random number generator is uniform, Fisher–Yates is uniform across all 8 × 10⁶⁷ orderings. The math is clean and the implementation is short, a few lines of code in any language.
The hard part is the random number generator. A pseudo-random generator with a 32-bit seed can only ever produce 4.3 billion distinct sequences, roughly 10⁵⁸ times smaller than the space of deck orderings. Most orderings are unreachable from any seed. Reputable rooms use a cryptographically secure pseudo-random generator with a 256-bit seed and reseed continuously from a hardware entropy source, usually thermal noise on a dedicated chip. With 256 bits of seed and continuous reseeding, every deck ordering is reachable, and the deck you see is statistically indistinguishable from a perfectly uniform draw across the standard deck.
Your hole cards come out of that shuffle. So does the flop, the turn, and the river. The cards land in your hand because the RNG put them there in advance, not because the software watched your bet and chose what to deal next.
What an audit certifies, and what it does not
An RNG audit is statistical. The lab pulls a long sample from the generator, usually millions of values, and runs a battery of tests on it. Distribution uniformity. Chi-square fit. Runs tests for clumping. Autocorrelation across small offsets. A modern battery checks dozens of properties and flags any one that fails. Passing means the output is indistinguishable from a uniform random source on that sample.
Passing the audit proves the math. It does not prove a person inside the company has never deviated from the math. It does not prove the binary running on the production server is the same binary the lab tested. It does not prove the RNG cannot be replaced after the audit is filed. It does not prove no one is colluding with another player at your table. None of those are RNG questions; they are operational questions, and they sit under different controls: internal security, regulator inspections, and the site’s own database of hand histories.
An audit is a strong claim about the deck and a silent claim about everything else. Read it that way and it tells you what it can. Read it as proof of universal honesty and it lets you down, because that was never what it was scoped to prove.
”Is poker rigged”: what your brain is actually noticing
The single biggest reason online poker feels rigged is that you see four times as many hands per hour as you would live, and three or four tables at once if you multi-table. That stretches every odd event over a much smaller wall-clock window. A two-outer hitting on the river — say, your set running into runner-runner quads — is a 4 percent outcome. Online, you might see it land twice in a session because you are seeing 800 hands instead of 200. Live, you might see it twice in a year. The deck did not change. Your sample did.
Two more things do real psychological work. Bad beats are sticky and expected outcomes are not. Your brain filed the AA-cracked-by-72o hand under “memorable” and filed the eight times AA held under “boring,” so the running tally in your head leans toward the bad beats. And losing players narrate their results; winning players cash out. The forum threads about a rigged site are written in a different mood than the forum threads about a fair one.
There is also a real difference in flop texture between online and a casual home game, and it is worth being honest about. Online software produces a deck closer to true uniform than two riffles at your friend’s kitchen table. That means more drawing-heavy flops, more straight-and-flush combinations on the same board, and more spots where card removal actually matters. A fully randomized deck deals more drawy runout patterns than your home game does, because your home game’s deck is not all the way randomized. Online is not adding action cards. It is just better at shuffling.
Live versus online randomness
A casino dealer’s shuffle protocol is more random than a home game and less random than a CSPRNG. The standard sequence (wash, riffle, riffle, box, riffle, cut) gets the deck a long way toward uniform but does not guarantee it. The mathematician David Bayer and the magician Persi Diaconis published the canonical result in 1992: you need about seven thorough riffle shuffles before the distance between the deck’s distribution and uniform drops near zero. Two riffles leaves the deck noticeably correlated with its starting order. Three or four does most of the work. Seven is where a careful gambler can stop worrying.
Online does not have to do seven anything. It produces a uniform draw in one cycle, every hand, with no human variance in the riffle and no chance of a flashed card on the deal of community cards. That is the counterintuitive result. Many people believe live poker is “more honest” because they can see the cards. The math says online is closer to uniform. You just cannot watch it happen.
A live-play sanity check
When a session starts to feel rigged, run this check on yourself before the brain noise takes over. Three questions, in order.
How many hands are in your sample? If it is under a few thousand, you are looking at variance, full stop. Ten thousand hands is the threshold below which “I am running bad” tells you almost nothing.
What is the equity of the spot you are complaining about? A two-outer hitting on the river is a 4 percent outcome — about once every 25 confrontations. If you played 25 such hands today and saw it once, the deck did exactly what it was supposed to.
Are you tracking results or tracking decisions? Decisions are what you control; results are what the RNG hands you. A losing session in which every decision was correct is information about the short-term distribution, not about your game and not about the site. A losing session with several wrong decisions is your work to do, regardless of how the cards fell.
If all three questions land on “this is variance,” it is variance. The site is not the problem.
Where this fits in your decision
The point of understanding the RNG is that you can stop spending mental energy on it. The deck is not the variable. Your equity-versus-price math is the variable, and that is the only number that matters at the table: the spread between your hand’s chance of winning and the break-even equity the pot is asking for. Trust the deck. Trust the audit. Spend the saved attention on the call.
Frequently asked questions
What does “RNG-certified” actually mean for an online poker site? It means an independent lab pulled a long sample from the site’s random number generator and confirmed the output is statistically indistinguishable from a uniform random source. The certificate is dated; reputable sites re-audit on a fixed cadence and publish the result.
Are online poker sites legally required to be audited? In a licensed market, yes. Regulators in jurisdictions like New Jersey, Pennsylvania, the United Kingdom, Malta, the Isle of Man, and Gibraltar require an RNG audit before a site can operate. Outside licensed markets, the requirement varies and the trust signal weakens.
Why do online flops feel more drawy than home-game flops? Because online produces a deck that is closer to uniform than the two-or-three-riffle shuffles in a casual home game. A fully uniform deck deals more straight-and-flush boards than a partially randomized one. The site is not adding action cards; your home game was just under-shuffling.
Can a poker site cheat after passing an audit? In principle, yes. An audit checks the output stream at a moment in time, not the binary running in production every minute thereafter. In practice, the cost of being caught is the entire business, and modern regulators run continuous integrity testing on top of the annual audit.
Is live poker more random than online? No. A careful casino shuffle is close to uniform but not all the way there; a CSPRNG-driven shuffle is uniform on every hand. Online is statistically more random than even the best live game. The reverse intuition comes from being able to see the deck. Visibility and randomness are different things.