Online poker uses a random number generator to shuffle the deck before every hand. Reputable rooms have their RNG audited by independent labs, and the patterns you notice at the table are almost always variance and sample size rather than rigging. Once you know what an audit checks, what it cannot promise and what your brain does with a thousand-hand sample, the noise around “is poker rigged” goes quiet.
The short answer, in one line
A reputable online room shuffles with a cryptographic RNG, gets that RNG audited by a third-party lab and runs every hand past an internal monitor that watches for collusion and bot activity. At a real-money site, an RNG audit tests that the shuffle is random, and a monitor is there to catch the cheating an audit cannot rule out.
What an audit actually looks at
| What gets checked | Who usually checks it | What a passing audit proves |
|---|---|---|
| RNG output stream | iTech Labs, GLI, eCOGRA, BMM Testlabs | Distribution is uniform across millions of pulls; no detectable bias |
| Shuffle algorithm | The same labs | Each of the 52 factorial deck orderings is reachable with equal probability |
| Hand history database | Internal security + regulator | Patterns flagged across millions of hands; collusion and chip-dumping are detectable |
| Geo and identity | The jurisdiction’s gambling regulator | Players are in a licensed market, KYC is real, account is one human |
| Payout integrity | External financial auditor | Money paid in equals money paid out, minus rake (no skim) |
The five rows are independent. A site can pass the RNG audit and still have a slow KYC process. The rigging question is almost always about row 1 and row 2, and those are the rows the math is strongest on.
How a poker RNG actually shuffles a deck
A 52-card deck has a number of possible orderings equal to 52 factorial. That is roughly 8 × 10⁶⁷, a 68-digit number. A fair shuffle has to make every one equally likely, which is harder than it sounds.
The standard algorithm is Fisher-Yates. You pick a random card from positions 1 through 52, swap it with position 52. Then a random card from 1 through 51, swap it with 51. And so on. If your random number generator is uniform, Fisher-Yates is uniform across all 8 × 10⁶⁷ orderings. The math is clean and the implementation is short, a few lines of code in any language.
The hard part is the random number generator. A pseudo-random generator with a 32-bit seed can only ever produce 4.3 billion distinct sequences, roughly 10⁵⁸ times smaller than the space of deck orderings. Most orderings are unreachable from any seed. Reputable rooms use a cryptographically secure pseudo-random generator with a 256-bit seed and reseed continuously from a hardware entropy source, usually thermal noise on a dedicated chip. With 256 bits of seed and continuous reseeding, every deck ordering is reachable, and the deck you see is statistically indistinguishable from a uniform draw across the standard deck.
At a real table your hole cards come out of the shuffle, and so do the flop, turn and river. The RNG set that order before the hand began, so nothing it deals can respond to your bet. Poker Skill’s Practice vs AI, which seats you among AI opponents, deals each game from a recorded seed, and that seed is how Run it back can replay a finished game on the same cards.
What an audit certifies, and what it does not
An RNG audit is statistical. The lab pulls a long sample from the generator, usually millions of values, and runs a battery of tests on it. Distribution uniformity. Chi-square fit. Runs tests for clumping. Autocorrelation across small offsets. A modern battery checks dozens of properties and flags any one that fails. Passing means the output is indistinguishable from a uniform random source on that sample.
Passing the audit proves the math and nothing past it. It leaves open whether everyone inside the company has stuck to the math, whether the binary on the production server is the one the lab tested, whether the RNG stays in place after the audit is filed and whether anyone at your table is colluding with another player. Those are operational questions rather than RNG questions, and they sit under different controls: internal security, regulator inspections and the site’s own database of hand histories.
An audit is a strong claim about the deck and a silent claim about everything else. Read it that way and it tells you what it can. Read it as proof of universal honesty and it lets you down, because that was never what it was scoped to prove.
”Is poker rigged”: what your brain is actually noticing
A big reason online poker feels rigged is volume: you see many more hands per hour online than live, and more again across several tables at once. That packs every odd event into a much smaller stretch of clock time. A two-outer on the river, say an overpair losing to an underpair that spikes a set, is about a 4 percent outcome, and at online speed you watch it happen far more often in a session than you would at a live table. The deck is the same in both places, and only the number of hands changes.
Two more things do real psychological work. Bad beats are sticky and expected outcomes are not. Your brain filed the AA-cracked-by-72o hand under “memorable” and filed the eight times AA held under “boring,” so the running tally in your head leans toward the bad beats. And losing players narrate their results; winning players cash out. The forum threads about a rigged site are written in a different mood than the forum threads about a fair one.
Some players also swear online flops come more drawy than home-game flops. No study backs that up: a fully shuffled deck deals every kind of flop and runout at its true rate, and nobody has measured what two riffles at a kitchen table do to board texture. What online changes is how many flops you see, and with them how many spots where card removal matters.
Live versus online randomness
A casino dealer’s shuffle protocol is more random than a home game and less random than a CSPRNG. The standard sequence (wash, riffle, riffle, box, riffle, cut) gets the deck a long way toward uniform but does not guarantee it. The mathematicians David Bayer and Persi Diaconis published the canonical result in 1992: a riffled deck stays almost as far from random as it started through four riffles, then closes the gap fast, and it takes about seven riffles to get reasonably near uniform. Two riffles leave the deck heavily tied to its starting order. Seven is where a careful gambler can stop worrying.
Online produces a uniform draw in one cycle, every hand, with no human variance in the riffle and no chance of a flashed card on the deal of community cards. That is the counterintuitive result. Many people believe live poker is “more honest” because they can see the cards, yet the math says online is closer to uniform; you just cannot watch it happen.
A live-play sanity check
When a session starts to feel rigged, run this check on yourself before the brain noise takes over. Three questions, in order.
How many hands are in your sample? The smaller it is, the more of what you saw is variance, and a few sessions’ worth of hands proves nothing about the deck.
What is the equity of the spot you are complaining about? A two-outer on the river comes in about 4 percent of the time, roughly once in 23 tries. If you played two dozen such hands today and saw it once, the deck did exactly what it was supposed to.
Are you tracking results or tracking decisions? Decisions are what you control; results are what the RNG hands you. A losing session in which every decision was correct tells you about short-term variance and nothing about your game or the site. A losing session with several wrong decisions is your work to do, regardless of how the cards fell.
If all three questions land on “this is variance,” it is variance. The site is not the problem.
Where this fits in your decision
The point of understanding the RNG is that you can stop spending mental energy on it. The number that matters at the table is your equity against the price: the spread between your hand’s chance of winning and the break-even equity the pot is asking for. With the deck and the audit settled, that spread is where your attention belongs.
Frequently asked questions
What does “RNG-certified” actually mean for an online poker site? It means an independent lab pulled a long sample from the site’s random number generator and confirmed the output is statistically indistinguishable from a uniform random source. The certificate is dated; reputable sites re-audit on a fixed cadence and publish the result.
Are online poker sites legally required to be audited? In a licensed market, yes. Regulators in jurisdictions like New Jersey, Pennsylvania, the United Kingdom, Malta, the Isle of Man and Gibraltar require an RNG audit before a site can operate. Outside licensed markets, the requirement varies and the trust signal weakens.
Why do online flops feel more drawy than home-game flops? Mostly volume. You see many more flops per hour online, so drawy boards come around more often in a session and stick in memory. A fully shuffled deck deals each texture at its true rate, and no good evidence shows that a two-or-three-riffle home-game shuffle deals fewer draws, only that it is less random.
Can a poker site cheat after passing an audit? In principle, yes. An audit checks the output stream at a moment in time, not the binary running in production every minute thereafter. In practice, the cost of being caught is the entire business, and modern regulators run continuous integrity testing on top of the annual audit.
Is live poker more random than online? No. A careful casino shuffle is close to uniform but not all the way there; a CSPRNG-driven shuffle is uniform on every hand. Online is statistically more random than even the best live game. The reverse intuition comes from being able to see the deck. Visibility and randomness are different things.