What Gets Certified
Poker software uses an RNG to shuffle a deck. The shuffled deck is used to deal cards. The RNG must be truly random, not biased toward certain cards or patterns.
A third party (GLI, eCOGRA, TST) tests the RNG. They run millions of hands through the poker software and analyze the distribution. They check: does each card appear with equal frequency? Are there patterns (e.g., does the Ace of Spades appear more often after a Queen)? Does the shuffling have weaknesses that a mathematical analysis could exploit?
If the RNG passes testing, it's certified. The operator can advertise "certified RNG" and players can have some assurance that the game is not rigged.
The Testing Process
A typical test involves 10 million hands of poker. The software deals each hand, and the result (which card appears in which position) is logged. Statisticians analyze the log for deviations from randomness.
They use the chi-squared test: calculate the expected frequency for each card (10 million hands with 52 cards = 192,307 times each card should appear), then measure the actual frequency against expected. If the deviation is statistically significant, the RNG fails.
They also use entropy analysis: measure how much information is contained in the sequence of cards. A truly random sequence has maximum entropy. A biased or patterned sequence has lower entropy.
They also test the shuffle algorithm itself. A weak shuffle (like a poorly-implemented Fisher-Yates shuffle) can be predicted if you know the seed value. A strong shuffle resists prediction even if you know some of the output.
What Gets Missed
Third-party testing certifies the RNG in isolation. It does not test the poker room's integration of the RNG. A certified RNG can be misused by the software:
- The software could seed the RNG predictably (using the server time, which an attacker can guess).
- The software could re-seed frequently, reducing entropy.
- The software could selectively apply the RNG (use it for regular hands, but use a biased sequence for certain player types).
A famous example: Full Tilt Poker's RNG was certified, but the software implemented it in a way that allowed certain players (insiders) to predict the next card with higher accuracy than chance. The RNG itself was not biased. The implementation was.
The Current Standard
DraftKings, PokerStars, and other regulated poker rooms use certified RNGs from reputable providers. The certifications are publicly stated. PokerStars publishes their third-party audit certificate on their site.
Unregulated poker rooms sometimes claim to use certified RNGs without actually having them tested. This is a red flag.
What Players Can Do
You cannot verify an RNG yourself. You can only check:
- Does the operator publish a third-party audit certificate?
- Is the certificate from a reputable firm (GLI, eCOGRA, TST)?
- Can you verify the certificate's authenticity (some firms allow checking on their websites)?
- Is the operator regulated by a gaming authority that requires RNG testing?
If the answer to most is "no," the operator is untrustworthy.
