I want to make an ios app, for fun to improve my dev skills, to do what no other app/poker site has done and be completely transparent.

I just want to match casinos shuffling as imperfect as that may be, no quantum, no true shuffle, no blockchain shuffle, no user input mouse movements being integrated, all that equates to horrible experiences over several sites, juiced boards for action and rake to keep the gambling addicts getting their 'thrills' and coming back for more, but this isn't a whine thread it's an advice thread.

There are source codes on github but that's not good enough, coin pokers code is on github, go play some freerolls on coinpoker see how legit they feel, same bs. It's Tony G, and virtue poker is phil ivey, he tried to cheat a casino, these are not people with great trustability, fancy blockchain decentralized mumbo jumbo copy or not.

so tldr, can I display the rng code in real time as the hand shuffles or something, to be verified later, something infallably provable that no other site would ever dare?

  • The last bullet-proof method would be some quantum-mechanics based stuff, which would make it physically impossible to break, but also incredibly expensive. I'd say your best shot is "outsourcing" to a site like random.org
    – David
    Jun 15, 2021 at 12:24
  • I think both of those are good ideas, I tried the 'provably fair' (but we don't explain how) sites and they're horrible, as slow as a casino but the boards and beats are much different than a casino and almost nobody plays on them, they'll shut down eventually, I don't trust anyone in the business so if I do go through with this app I'll have to do it myself.
    – Toddd
    Jun 16, 2021 at 15:42
  • Your second paragraph is making a strong accusation against poker sites. Can you back your claims somehow?
    – David
    Jul 14, 2022 at 12:43
  • yeah, years of live play experience to compare, a wasted year of integrity testing across all sites, hand histories to prove it, about 10k all ins and way out of range ev results considering I was large favorite in most, a saved email catching the former major site of telling me my ev will even out at point infinity (mathematically incorrect and unheard of) statement. You can enjoy the rig and rta if you want to white knight them, or if you're shilling congrats on your gig. Anyone with eyes can tell what's up hence why live poker thrives to this day, everyone would be online decades ago.
    – Toddd
    Jul 15, 2022 at 18:00
  • If you actually believe what you're saying, you should sue.
    – David
    Jul 17, 2022 at 9:23

4 Answers 4


Doing this and protecting the integrity of your game at the same time is not an easy problem to solve. If you surface everything you do to the players on the site and use your own sources of randomness that is also surfaced, players may be able to predict what your source of randomness will generate and therefore predict the shuffle of the deck.

I would recommend that you use a free, accredited source of randomness that is proven to be as close as possible to purely random. Use the hash or whatever this rng produces and make your own algorithm to predictably generate a shuffle of the deck. You can surface the hash and your algorithm to the players and they can plug it in themselves and see it spit out the shuffle that they had in the hand. If they have questions about how random the rng is, they can be referred to the source that you use.

As a side note, big poker sites have very little incentive to not use a good source of randomness and randomly generate their shuffles each time. They have a large amount of users and make a lot of money operating with good random shuffles. If a big poker site like this (especially a regulated one) were to be caught using anything but a random shuffle, they would lose any licenses they have to operate if they are regulated and users would move away from the site.

  • Thanks for your response, saved your reply, the gimmick of my app would be like a real time debugging of the code, for players to see code live, if I show everything they could know all the cards etc but I think if I encrypt it then later they can decrypt it themselves, not in time for the hand, so they can't brute force it, about the big sites and their risk I'm a skeptic but that's a seperate topic, but I believe this post it has been my experience, I don't think it's a trolljob flopturnriver.com/pokerforum/online-poker-rooms/…
    – Toddd
    May 14, 2021 at 6:24
  • Publishing the hash of each hand and allowing players to verify it would also allow them to see every other player's hand, which might not be what you want. Mar 17, 2022 at 0:41
  • @SteveBennett after the hand is over of course
    – Clarko
    Mar 17, 2022 at 1:35
  • Yes, but even still, that would reveal the hands of players who didn't otherwise reveal their cards. Mar 17, 2022 at 3:21

One possibility:

Take the shuffled deck, add a timestamp, create a cryptographic hash of it. Record both on your site. Display the hash during the hand. Honestly, since you can create the deck after all players are in the hand, the deck file can include player names/positions as well and therefore have hole/burn/board cards marked.

After the hand, you can download the deck file from the site and run it through the same crypto algorithm to validate that the hash displayed at the time matches.

By doing a hash, there's nothing to "decrypt", so you don't have to worry about someone deciphering the deck from the hash.

That said, if I suspected a site of doing funny business, it wouldn't really be the deck that I worried about. It would be if insiders had access to things like the deck and other player hole cards. That can't just be validated with a code.

ETA: One other thing might be possible. Since you can still manipulate which deck is generated for each hand, maybe you could instead create "blocks" of decks. Shuffle (for example) 10 or 100 decks at a time. Then the same code shown would be shown during play of all of those decks. After the block is used, you could have a link on the site that showed the N (consecutive) games that were played with that block. That would potentially give greater confidence that the decks aren't being chosen to aid a particular table.

  • thanks for the ideas, very smart stuff, in this particular case there would only be one insider, me, and I have no interest in helping anyone cheat or win or lose, but I have to communicate that, it's a one man dev app.
    – Toddd
    May 15, 2021 at 2:43
  • Yep. My comments aren't meant to suggest otherwise, just that I can't think of any way to assist that communication. You can give info about the deck, but you can't give info about how the code uses that deck.
    – BowlOfRed
    May 15, 2021 at 3:48
  • I understand, bit of a tricky thing, not just applicable for poker for any game/software that uses rng, kind of weird how 20 years of online poker and players are still relying on blind trust but proving fairness is not easy either so the sites are not interested, there's major studies going on about real time quantum rng for big business and ai and all this if you google, I just want to simulate a sleepy dealer and a shuffling machine lol.
    – Toddd
    May 15, 2021 at 4:48
  • The idea of burn cards in a digital deck strikes me as silly, but I guess some people are sticklers for ritual. May 23, 2021 at 4:18
  • Even better than just showing the hash, send each player a signed text with the RNG seed and algorithm used to produce the deck, so that he can reproduce it with the same algorithm. Jun 15, 2021 at 19:01

A fair shuffle is a true random shuffle. Period. Whatever "bad experiences" you attribute to mathematically perfect shuffles are either users not knowing what they are talking about or the site not being as truly random as it claims. Simulating a physical casino shuffle is nonsense.

There is a method for transparently generating a random shuffle among several players. It's basically this: before the hand, publish to every player (and the world) exactly what algorithm you will use to generate a random sequence, how that sequence will be used to choose cards, and a random seed. Then each player generates a random seed of their own and sends it to you in secret. You then combine your first seed, another random seed that you choose, and each of the players seeds together, and use that to seed the RNG that chooses cards. After the hand, you publish all the seeds and players can verify that their seed was used and that the sequence was generated properly.

  • My attack against that as a bad host would be to create multiple seeds/decks and select the one that gives the results I want. After the hand I only show you the one I picked.
    – BowlOfRed
    Oct 13, 2021 at 23:56
  • That can only work if the seed is too small. If it's (say) 128 bits or more, you'll have to pre-generate more decks than there are atoms in the universe. Oct 14, 2021 at 0:25
  • No pre-generation at all. Just generate multiple at the time (say 10 or 100 decks) If I can pick which deck out of 100 to play with, the fact that each one is perfectly shuffled doesn't prevent me from having an advantage. I could make sure one seat has awful cards (or has great cards until the river).
    – BowlOfRed
    Oct 14, 2021 at 1:30
  • I did leave out a detail: the method by which you choose your second seed must also be known ahead of time to all players. It's there to prevent the players from colluding with a replay attack, but you're not free to choose it. It should just be something like the sequence number of the hand. Oct 14, 2021 at 3:33
  • If it's forced, then it seems to be no longer a seed, but a consequence of the (meta) algorithm. Can the players predict what it will be ahead of the next deal? If the players collude to produce particular keys, why wouldn't the deck be known ahead of time?
    – BowlOfRed
    Oct 14, 2021 at 5:57

Your on the right track. I am a little knowledgeable but no great expert just to be clear. Awhile back I did some research to gain some understanding of the whole subject. (I had written a keno game that was repeating broads every so often, easy stuff to screw up).

If your code depends on secrecy then it is inherently insecure. This just means that everything you know about your keys anybody can know and your program is still secure. So you should be able to be totally transparent with your program and it should be secure. You should be able to give details about how you came up with your key/seed, the size of your key and all the details about the RNG your using. (Online poker rooms like you said are not very transparent with their shuffle routines, it is one of the minor reasons that I do not play online for the past 15 years. Major one BTW is because they have no shot at stopping collusion.)

I found out a couple of general things about seeds/keys and (P)RNG's. First is that there are different types of RNG's, generally two types, one type is designed with security in mind, the other type with true random number generation in mind. Basically some are better at generating keys securely for transactions, and others are better for simulation. So coming up with the best RNG for a poker game is rather the challenge because one needs transactional security as well as true randomness for the shuffle. "Do all" things are rarely really good at doing anything (think Swiss Army knife). Around 2004 UB was the victim of a hack that was out there for awhile that was able to break their security. The hacker was selling it for something like 32K a copy, pretty good money for a 16 year old kid.

Wish I could give you more. If I was betting on what your thinking it would be "tell me something I don't know." It was over a decade ago that I surveyed the subject. So I don't have any suggestions as far as specific RNG's go for poker.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.