How the RNG Shuffle Actually Works in Online Blackjack
Ask most gambling pages how a virtual deck gets shuffled and you get one sentence: a random number generator decides. True, and useless. What follows is the mechanism.
The short answer
- The shoe is rebuilt, not shuffled once: in RNG blackjack the virtual shoe is regenerated for every round, so nothing carries forward from the hand before.
- The count is always zero: remove the memory and there is nothing for a card counter to hold. Penetration is moot for the same reason.
- The deck is never due: independence means the shoe holds no record of what happened to you.
- The rule that protects you most is not statistical: both states forbid a secondary decision after the outcome has been selected.
- The real question: not whether the RNG is rigged against you personally, but whether this operator holds a license, names its provider, publishes its rules and keeps records a regulator can pull.
A Card Game on a Server Has No Cards
It has an array, an algorithm and a number source, and its honesty rests on whether those three behave the way blackjack says a shoe behaves.
What follows is the mechanism, from the electrical noise that seeds the generator to the swap loop that orders 52 cards, the arithmetic error that used to skew those orders, and the rules that keep an outcome auditable a decade later. Every claim ties to rule text or a NIST publication you can open yourself, and this is the machinery under the games at the licensed online blackjack sites in the seven states that offer them.
A card game on a server has no cards. It has an array, an algorithm and a number source, and its honesty rests on whether those three behave the way the printed rules of blackjack say a shoe behaves. That is the question our wider look at whether online blackjack is rigged keeps returning to.
What a Random Number Generator Really Is
Two states define the term in rule text, and neither definition turns on metaphysical randomness. Both turn on unpredictability.
Why “Pseudorandom” Is Not a Warning Label
New Jersey defines the term at N.J.A.C. 13:69E-1.28G(a): a random number generator is “a physical device or a mathematical algorithm that generates outcomes that cannot be predicted.” The definition turns on unpredictability, not metaphysical randomness. Pennsylvania is blunter. Its slot design rule, 58 Pa. Code 461a.7(d), says outcome selection “shall be made applying a pseudo random number generator.” The regulator is not tolerating a pseudorandom generator. It is requiring one.
Such a generator is deterministic. Give it a starting value, the seed, and it produces a sequence; give it that seed tomorrow and the sequence repeats exactly. It suits cards because the output is statistically indistinguishable from random to anyone without the seed, and recovering the seed is computationally out of reach. Determinism is the feature: a laboratory can replay the generator with known seeds and measure hundreds of millions of outputs. Raw physical noise cannot be replayed, which makes it harder to certify. So gaming landed where cryptography landed, harvesting physical unpredictability to seed a studied algorithm.
Where the Entropy Comes From
Everything rests on the seed. New Jersey requires “a random seed that is determined by an uncontrolled event to assure that the RNG does not begin from the same value every time,” at 13:69E-1.28G(b)(5). An uncontrolled event is a physical process nobody can steer: thermal noise across a resistor, jitter in free-running ring oscillators, variation in interrupt timing. NIST governs this in Special Publication 800-90B, “Recommendation for the Entropy Sources Used for Random Bit Generation,” from January 2018. It covers estimating min-entropy, meaning what an attacker gets from a single best guess rather than an average, conditioning a noisy signal into usable bits, and health tests that catch a source going stuck. A seed with 30 real bits behind it is worthless no matter what consumes it.
What “Cryptographically Strong” Adds
Plenty of generators pass statistical tests and stay predictable. Statistical quality and unpredictability are separate properties.
The Mersenne Twister is the standard warning
Its output looks excellent under distribution testing, yet its internal state is 624 words wide, so collecting roughly that many consecutive outputs lets an observer reconstruct the state and compute every future value.
Hence 58 Pa. Code 810a.5(a), which requires the RNG to “be cryptographically strong at the time of submission for approval” and requires its outcomes to be shown, by data analysis and a source code read, to be statistically independent, fairly distributed, able to pass recognized tests, and cryptographically strong. The qualifying constructions are the deterministic random bit generators in NIST Special Publication 800-90A, Revision 1 from June 2015, built on hash functions, HMAC or block ciphers. Pennsylvania closes a subtler door at 810a.5(f)(3): background cycling must run between games, and inside a game where one outcome uses several values, so no hand is built from consecutive outputs.
From Random Numbers to a Shuffled Deck
Numbers are not cards, and the mapping between them is where real games have broken. Two things have to be exactly right.
Fisher-Yates, the Algorithm That Gets It Right
Start with an array holding 0 through 51, each an index for a card. The correct procedure walks backward.
Stand at position i
Begin at the last position in the array and work back toward the front.
Draw a uniform integer j
Pick j between 0 and i inclusive, uniformly, from the certified generator.
Swap the values at i and j
The swap range is at or before i, never the whole deck. That distinction is what makes the result exact.
Step back and repeat
Six decks changes only the array length, to 312. Engines that draw one card at a time from what remains do the same thing lazily, provided each draw is uniform over the surviving pool.
That is the Fisher-Yates shuffle, named for Ronald Fisher and Frank Yates, who published a pencil-and-paper version in their 1938 statistical tables, and refined into the in-place form above by Richard Durstenfeld in 1964. Donald Knuth’s treatment in “The Art of Computer Programming” is why programmers call it the Knuth shuffle.
Its virtue is exact rather than approximate. The shrinking ranges multiply out to 52 factorial, roughly 8 times 10 to the 67th power, a 68-digit number. Distinct execution paths equal distinct orderings, so every ordering arises from exactly one path and, given a uniform source, is equally likely.
Modulo Bias, the Error That Regulators Named
The generator hands you a 32-bit value between 0 and 4,294,967,295. You need 0 through 51. The obvious move is the remainder after dividing by 52, and it is wrong.
| Quantity | Value |
|---|---|
| Possible 32-bit inputs | 4,294,967,296, running 0 through 4,294,967,295 |
| Complete cycles of 52 inside that range | 82,595,524 |
| Values left over | 48, and the extras land on remainders 0 through 47 |
| Inputs producing each of those 48 card slots | 82,595,525 |
| Inputs producing each of the other four | 82,595,524 |
| Size of the resulting skew | One part in 82 million |
That skew is invisible in play, but the arithmetic is unforgiving: whenever the target range does not divide the source range evenly, some outcomes are favored, and the closer the ranges are in size the worse it gets.
The fix is rejection sampling, and both states legislate it
Discard any draw at or above the largest multiple of 52 that fits, and draw again. New Jersey, at 13:69E-1.28G(b)(6), requires rescaling “using a method that ensures the occurrences of numbers within the shorter range are equally probable.” Pennsylvania works a six-sided die example into 810a.5(d), explains that unequal theoretical frequencies mean the method has a bias, and concludes that “a compliant scaling method must have bias equal to zero.” Regulators write sentences like that because somebody once shipped the other version.
Follow the shuffle further
Where the deck comes from is one question. What happens to it after the hand, and who signed off on the code, are the next two.
The Blackjack Point: Every Hand Starts With a Fresh Shoe
Here is the fact that matters most, and it is the one that answers half the rigging theories on its own.
The shoe is rebuilt every hand, not shuffled once and dealt down
In RNG blackjack the virtual shoe is regenerated for every round. Cards are removed as they are dealt, so composition changes within a hand, but once the hand settles the shoe is rebuilt and no information survives it. Nothing carries forward, and the deck is never due, because between hands it holds no record of what happened to you.
Pennsylvania states the requirement behind that at 58 Pa. Code 810a.9(a)(3): each permutation producing a winning or losing outcome “must be available for random selection at the initiation of each play.” Subsection (a)(7) requires events of chance to be independent of the previous game except where a submission has been approved for persistent-state outcome determination. Blackjack is not such a game.
The reshuffle point lives in the game rules, and disclosure is mandatory. Section 810a.3(17) requires a multi-deck game to indicate the number of cards and decks in play, forbids returning a dealt card to the deck except as the depicted rules provide, and forbids reshuffling except as those rules provide. Your rules screen is the binding statement of when the shoe resets, and in commercial RNG blackjack the answer is almost always after every round.
Why Counting Cannot Work Against an RNG Game
Counting is neither magic nor cheating. It exploits one property of a physical shoe: memory. Dealt cards are gone, the remaining composition drifts, and a count tracks the drift so the player can raise the bet when undealt cards favor them. Remove the memory and there is nothing to hold. Against an RNG shoe the count at the start of every round is zero, permanently. The legal question is separate, since counting is a mental skill rather than a device and the real exposure is being barred rather than charged, covered in whether card counting is legal. Penetration is equally moot, as our page on shuffling and shoe penetration explains.
What the Deck Count Still Changes
Deck count is not cosmetic. Six decks against one alters the probability of drawing to a given total, and so the frequency of naturals, the value of splitting pairs and the payoff of doubling. That is priced into the house edge before the first card appears. What it does not create is exploitable memory, because it shifts the distribution identically every round. New Jersey requires the number to be published, obliging server-based table games to carry help screens covering approved variations “such as the number of decks used, special odds, and supplemental wagers,” at N.J.A.C. 13:69O-1.5(m)(5). Rules swamp deck count anyway: 6 to 5 on a natural costs roughly a full percentage point, which is why the 3 to 2 versus 6 to 5 question comes first and why our breakdown of house edge and return to player ranks rules by cost.
What the fresh shoe rules out, and what it does not
A rebuilt shoe kills counting and kills the idea of a due deck. It does not touch the paytable, which is where the money actually goes.
What “Provably Fair” Proves, and What It Does Not
Crypto casinos advertise a scheme regulated operators do not offer. The mechanism is real. The guarantee it produces is narrow.
The server commits
Before you play, the server generates a secret string called the server seed and publishes only its SHA-256 hash.
The commitment locks the seed in
Hashing is one-way, so the published value reveals nothing, but any other seed hashes differently.
You supply a client seed
You supply or accept a client seed, and each round carries an incrementing counter called a nonce.
The hand is derived
The outcome comes from an HMAC over the client seed and nonce, keyed by the server seed, with the digest mapped to card positions by a published rule.
You verify after rotation
When you rotate seeds the site reveals the old server seed. You hash it, confirm it matches the commitment published before you bet, then re-derive every hand.
What it establishes
- Outcomes were fixed before your wagers were placed.
- Nobody altered a card after seeing what you did.
- Setting your own client seed closes the door on a server that could predict it and grind candidate server seeds before committing.
What it says nothing about
- Whether the operator can afford to pay you.
- Whether anyone licensed the business.
- Whether a withdrawal gets honored.
- Whether the rules are reasonable. A provably fair game paying 6 to 5 with no surrender is verifiably bad for you.
- Any hand you did not check. Verification covers only the seed pairs you actually check, and almost nobody checks.
No US regulator treats the scheme as a substitute for laboratory certification, part of the wider gap described in offshore versus licensed play and in what an offshore license actually buys.
How the RNG Gets Tested
A test suite measures a long output stream from several angles. What it cannot do is the reason labs read source code too.
The recognized statistical reference is NIST Special Publication 800-22, Revision 1a, “A Statistical Test Suite for Random and Pseudorandom Number Generators for Cryptographic Applications,” published April 2010, with NIST having announced in 2022 that it intends to revise it. The suite attacks a long output stream from several angles: frequency of ones and zeros, behavior within blocks, run lengths, matrix rank, spectral structure, template matching, entropy estimates, cumulative sums and random-excursion behavior. Each test returns a p-value, and a failure means the stream departed from what randomness predicts by more than chance comfortably explains.
NIST is candid about the ceiling
The publication cautions that the tests “may be useful as a first step” and that “statistical testing cannot serve as a substitute for cryptanalysis.” Passing shows an absence of detected structure, not the presence of unpredictability.
What a Lab Actually Examines
Pennsylvania is unusually specific. Section 810a.5(c) authorizes the gaming laboratory to apply recognized tests against a 95 percent confidence level and enumerates 15 by name, among them chi-square, equi-distribution, gap, overlaps, poker, coupon collector’s, permutation, Kolmogorov-Smirnov, order statistic, runs, serial correlation and Poisson distribution tests. New Jersey names a smaller set at 13:69E-1.28G(b)(3): chi-square, mono-bit and runs.
Four things a test suite alone would miss get examined directly.
| What the lab checks | Rule | What it requires |
|---|---|---|
| Period length | 58 Pa. Code 810a.5(f)(1) | A period long enough that all independent outcome combinations remain possible |
| Seeding and reseeding | 810a.5(f)(2) | Seed handling examined directly rather than inferred from the output stream |
| Predictability from prior output | 810a.5(f)(3) | Background cycling between games and inside a game, so no hand is built from consecutive outputs |
| Scaling to the card range | 810a.5(d) and 13:69E-1.28G(b)(6) | A scaling method with bias equal to zero |
| Hardware generator health | 810a.5(e) | Real-time output monitoring, with play disabled the instant a failure is detected |
| Scope of the certificate | 810a.5(a) | Each instance of a generator, and each differing implementation, certified separately |
The laboratories doing this against standards such as GLI-19 Interactive Gaming Systems version 3.0 are covered in independent testing laboratories, and the certificate trail in how RNG certification works. New Jersey is the outlier that runs its own state laboratory, the Division of Gaming Enforcement’s Technical Services Bureau, one reason its licensing process for online blackjack sites takes as long as it does.
Who does the checking
A certificate is only as good as the body behind it, and the bodies differ enormously between a licensed state and an offshore jurisdiction.
The Regulatory Backstop: Every Hand Is on Record for 10 Years
Statistics prove things about a generator. Regulation proves things about the hand you played on a specific Tuesday.
It must be the same game
Under N.J.A.C. 13:69O-1.5(m), a server-based table game shall accurately represent the layout and equipment of its corresponding authorized non-electronic table game, including the cards, and shall “function in accordance with approved rules for its corresponding authorized non-electronic table game.” An online blackjack game in Atlantic City may not be its own game with its own private mathematics.
The running code is hashed daily
Section 13:69O-1.5(c) requires the system to authenticate all control programs on demand and at least every 24 hours, and 1.5(d) requires the operator to stop the software and notify the Division the moment authentication fails.
A substituted binary gets caught
The process is defined at 13:69O-1.1 as producing a digest of at least 128-bit complexity compared against a secure embedded value.
Your session is reconstructable for a decade
N.J.A.C. 13:69O-1.8(d) requires a gaming system to maintain “all information necessary to recreate patron game play and account activity during each patron session, including any identity or location verifications, for a period of no less than 10 years.”
An RNG outcome in a licensed New Jersey game is therefore reconstructable hand by hand for a decade, so a dispute over a hand played in 2026 is answerable with records in 2035. Pennsylvania builds the player-facing half, requiring a replay-last-game feature at 810a.11(a) showing date and time, final outcome, balances, total bet, total won and the results of any player choices. Those records turn a complaint into a factual inquiry, as our walkthrough on filing a complaint against an operator sets out, alongside our index of state blackjack laws and the detail on our New Jersey and Pennsylvania pages.
Turning a record into an outcome
A ten year retention rule is only useful if you know who to hand the hand history to, and in which state.
Seven Beliefs About RNG Blackjack That Are Wrong
Each of these is a reasonable inference from how the game feels. Each is still wrong.
The provision that protects you most is not a statistic
Both states forbid a secondary decision after the outcome has been selected, at 58 Pa. Code 810a.9(a)(6) and N.J.A.C. 13:69E-1.28G(c)(2). The card is chosen once, by the certified generator, and the software has no lawful second bite at it. A game that could pick again after the fact is precisely the shape a cheating build would take, which is why the rule sits in the text rather than in a fairness policy.
“The RNG knows my bet size.”
It cannot. Pennsylvania’s 810a.9(a)(2) says the determination of events of chance producing a monetary award “may not be influenced, affected or controlled by anything other than numerical values derived in an approved manner from the certified random number generator.” Your wager feeds the payout arithmetic, never the card selection.
“It adjusts after I win.”
There is nowhere for the adjustment to live. Pennsylvania forbids a machine from automatically altering any function based on internal computation of the hold percentage, at 461a.7(e), and both states forbid a secondary decision after the outcome is selected, at 810a.9(a)(6) and 13:69E-1.28G(c)(2).
“A losing streak means a win is due.”
The gambler’s fallacy, and the reason deserves naming: independence means the shoe holds no record of what happened to you. Long runs are not anomalies in random data, they occur at a calculable rate, which is why runs tests sit in the certification suite. A generator that never produced a nine-hand losing streak would fail testing, not pass it.
“This table is hot.”
Heat needs persistent state and there is none. Pennsylvania repeatedly carves out submissions “approved for a persistent-state outcome determination,” which tells you persistent state is a regulated category a game only has if approved for it.
“Hitting changed which card came next.”
The order was fixed when the shoe was built. Your decision determines whether you receive the next card, not which card it is. The same holds at a felt table, which is why basic strategy is computable at all.
“Free play deals differently.”
The certified build is identified by version, and 810a.11(b) requires the game identifier and version to be recorded for every game played. Swapping in a different build would be a certification violation visible in the logs.
“Nobody can check any of this.”
A laboratory read the source, tested the output and examined the seeding, and the running binary is hash-authenticated at least daily. That is more scrutiny than a shuffle at a felt table receives.
RNG or Live Dealer: Two Ways to Trust a Game
The preference for watching a human deal is interesting rather than irrational, because the formats offer different assurances.
RNG play offers verifiable evidence
- The code was read by a laboratory.
- The distribution was measured against named statistical tests.
- The seeding was examined directly.
- The binary is authenticated at least every 24 hours.
- The hand is kept reconstructable for 10 years.
Live play offers visible evidence you cannot audit
- You see physical cards, a real shoe, a dealer’s hands and several camera angles, and you trust your eyes.
- You cannot inspect the shoe before it is loaded.
- You cannot examine the shuffling machine.
- You cannot confirm the stream is live rather than delayed.
- You cannot check that the optical recognition matched what the software recorded.
The studio is often not even in your state: West Virginia’s licensed live dealer product streams from Evolution’s Pennsylvania studio, announced in June 2022.
The trade is transparency for auditability, and on a strict evidentiary standard the RNG game is better substantiated. That rarely changes anyone’s preference, which is fine unless the preference gets mistaken for a fairness judgment. We compare the verification chains on live dealer fairness and the practical differences in our guide to live dealer blackjack.
One asymmetry does favor the live table
Expected loss is house edge multiplied by total amount wagered, and RNG blackjack deals far more hands per hour, so the same edge costs more.
What Genuinely Goes Wrong
Gaming software has failed, and the documented failures teach more than the successes because they show which part broke.
The Broken Shuffle at PlanetPoker
The classic case is a study of the PlanetPoker cardroom by researchers at Reliable Software Technologies, published in the late 1990s as “How we Learned to Cheat in Online Poker: A Study in Software Security.” The shuffling code had been published by its vendor, ASF Software, specifically to demonstrate integrity. Publishing it was the right instinct; the code was the problem. Three defects stacked.
An off-by-one error
The 52nd card could never finish in the 52nd position.
The wrong swap range
The swap paired each card with any position in the whole deck rather than one at or after it, producing an uneven distribution. With three cards the researchers showed it yields 231, 213 and 132 more often than 312, 321 and 123, and the distortion widens with deck size.
The seeding, which was worst
The generator was reseeded before each shuffle from milliseconds elapsed since midnight, capping reachable orderings at 86,400,000. Synchronizing to the server clock narrowed that to roughly 200,000 candidates, searchable on a desktop in real time.
Five known cards, two hole cards plus the flop, identified the exact shuffle, and after locking on once the team could resynchronize and identify later shuffles in under a second. ASF changed the algorithm after being contacted. Every defect there is answered by rule text quoted above: the swap range by Fisher-Yates, the distribution by zero-bias scaling, the seeding by the uncontrolled-event requirement.
The Insider Case: Ronald Dale Harris
The other documented failure was not mathematical. Ronald Dale Harris worked as a computer technician for the Nevada Gaming Control Board, evaluating gaming software, and used the source code access the job gave him. He altered slot programs to pay out on a specific coin sequence, then turned to keno, writing a program that predicted which numbers a machine’s generator would select. Two regulators document the ending.
| Record | Date | What it shows |
|---|---|---|
| New Jersey Division of Gaming Enforcement charge | Jan. 15, 1995 | Harris and Reid E. McNeal charged with attempted theft by deception, conspiracy and computer theft, after allegedly using proprietary computer software information to obtain a $100,000 keno jackpot at Bally’s Park Place Casino Hotel |
| DGE exclusion record for McNeal, preliminary order | June 21, 1995 | Docket 95-0240-EL |
| DGE exclusion record for McNeal, final order | Nov. 5, 1997 | Docket 95-0240-EL |
| Nevada list of excluded persons | Feb. 20, 1997 | Harris excluded under Nevada Gaming Commission number 96-36, a lifetime bar from licensed casinos in the state |
Press accounts add a guilty plea and a prison term; those two records are what can be checked directly, and the regulator is covered on our page about the Nevada Gaming Control Board.
The lesson is precise
The mathematics did not fail, privileged insider access did, which is why testing rules require a source code read, why Pennsylvania mandates separation of production from development environments at 810a.6, and why New Jersey demands daily authentication of running code.
How to Check a Blackjack Game Yourself
Five checks, none requiring you to trust a review, all doable before you fund an account.
| Check | Where to look | What a failure looks like |
|---|---|---|
| Provider attribution | Game help screen or lobby tile | No studio named anywhere in the client |
| License and certification | The regulator’s own operator roster, not the casino footer | Absent from the state list, or a seal that is a flat image |
| Rules screen | Deck count, dealer action on soft 17, double and split rules, reshuffle point | Rules unavailable before you deposit or stake funds |
| Payout on a natural | The paytable, stated as 3 to 2 or 6 to 5 | Undisclosed, or 6 to 5 presented as standard |
| Hand history and replay | Account history, plus a replay of the previous round | No record of completed hands available to you |
Two of those are legal requirements in regulated states rather than courtesies, which is what makes them useful tests. Pennsylvania requires game rules and paytable information to be available on the player interface “without the need for funds to be deposited or funds to be staked,” at 810a.3(2), so a game hiding its rules behind a deposit has already broken a rule. New Jersey requires a server-based system to let a patron view the outcome and balance change for the previous game, including one completed after a network disconnection, at 13:69O-1.5(i). A client with no accessible hand history belongs beside the other warning signs of a rogue blackjack site.
What the mechanism actually buys you
Understanding the shuffle will not make you a winning player. Blackjack keeps a house edge whether the cards come from a shoe or an array. What the mechanism gives you is the ability to tell a real question from a false one. Whether the RNG is rigged against you personally is the false one, and it has a documented answer. Whether this operator holds a license, names its provider, publishes its rules and keeps records a regulator can pull is the real one.
Check the operator, not the algorithm
The shuffle is the part that has been tested hardest. These are the parts that have not.
Verified against NIST Special Publications 800-22, 800-90A and 800-90B, the Pennsylvania Code, the New Jersey Administrative Code and the New Jersey and Nevada exclusion records on Aug. 25, 2026. Rules are amended regularly, so read the current text before relying on a section number. Written as consumer information about how gaming software works, not as legal or technical certification advice.
