I'm developing a poker app in java and using java.util.Random to shuffle the deck. Literature I've read suggests that this is flawed and that alternative methods be introduced to generate a random number which does not "fall on the planes". How could a player take advantage of their knowledge that this code was in use?


  • 3
    Isn't that kind of question more a "Java one" than a "Poker one" ??
    – user3202
    Commented Apr 2, 2015 at 11:43
  • How many shuffled decks are there and how many numbers are you generating with Random? Also, given enough random numbers you can predict what follows as they are really pseudorandom
    – WW.
    Commented Apr 2, 2015 at 13:19
  • Although at least 50 % out of scope, I think it's an interesting question :) Commented Apr 2, 2015 at 15:44
  • Would have to know specifics about the flaws. Are they security flaws or are they statistical flaws. Very generally speaking, PRNG's are of types met for encryption and for simulation. Unfortunately poker games need the best characters of both. I would do a lot more research before I settled on a library.
    – Jon
    Commented Apr 2, 2015 at 16:08
  • 2
    This is a simple problem. xkcd.com/221 Commented Apr 2, 2015 at 16:46

4 Answers 4


Shuffling a deck on a computer is not a trivial task. It is not the same task as encryption and it is not the same task as game simulation, both of which use PRNG's. http://www.datamation.com/entdev/article.php/616221/How-We-Learned-to-Cheat-at-Online-Poker-A-Study-in-Software-Security.htm

Is a description of a flaw in the way the deck was shuffled at PlanetPoker.com, the very first web site to offer online poker for cash. A really short description of the flaw is that they produced the seed for the shuffle from the CPU clock. It was a total failure. It was predictable and could be hacked quickly and easily and it was also statistically flawed. There is only one million possible shuffles that could be had from the CPU clock, and there are 80,658,175,170,943,878,571,660,636,856,403,766,975,289,505,440,883,277,824,000,000,000,000 ways to shuffle a 52 card deck, which makes one million just a very tiny tiny fraction of all possible shuffles.

Planet Poker had a shuffle routine that was neither secure, or random in the gaming sense.

This exploit was the most well known. A lot of people thought good they plugged the hole lets move on. But there have been exploits since that involve getting at peoples hole cards. Patches have been made, but is it fixed, not likely.

The challenges of securing a poker game online is daunting, much more complicated then most security problems.

The PP exploit only needed a little data to break a hand, the hole card and the flop, was enough to use a little brute force to figure out what the rest of the players had in hand and what the turn and the river was going to be. And that is one of the main challenges, you have to give up a little of the key in a poker hand, to every one involved.

Anything can be decrypted with enough time and computer power. When you have to give up some of the solution(IE a poker hand and flop is part of the solution) you are giving a hacker a lot of information that does not need to be figured out with brute force.

A shuffle in poker also has to be a statistically valid shuffle. This means that the shuffle has to play like a real poker game. If you go looking on the web for PRNG (Pseudo Random Number Generators), you will find a wide variety of them. Some are made for simulation, some are made for secure random numbers. You cannot guarantee a secure PRNG will produce statistically valid numbers for a poker game, nor can you guarantee a statistically valid PRNG will produce secure numbers that will keep the shuffle key unknown in a meaningful way.

What you really need to consider is a pretty comprehensive survey of the state of the art with security at a online poker room. You need highly specialized advice if your going to be playing for money with your software. It is a cat and mouse game between hacks and poker sites that is still going on.

  • Actually a good shuffle is trivial and Fisher Yates was developed in 1938. And it was proven to be a uniform shuffle. They just failed to do their home work. Still good answer.
    – paparazzo
    Commented Apr 12, 2017 at 22:59

"Anyone who considers arithmetic methods of producing random digits is, of course, in a state of sin." - John von Neumann, 1951

The short answer: If your player knows your seed, in theory he can predict the outcome of the randomizer. In practice, you want to reseed your randomizer with a random seed that is very difficult to guess. If the seed is static (a hardcoded value) or changes in a predictable manner (example: date/time as the seed) then in theory it's possible to guess it by taking enough random samples. How? A mathematician will have to answer it :)

The long answer: It is not easy to achieve a "true" randomization in computers, instead programmers use pseudo-randomization that comes close to true randomization for their particular purpose. (http://en.wikipedia.org/wiki/Random_number_generation). However, mathematically speaking it is not a true random generator.To put it another way, under 100% identical environments, the same code will produce the same number on two different machines. 100% identical environments is the key here.

Poker stars has a page on security and deck shuffle, you might wanna check it out (https://www.pokerstars.com/poker/room/features/security/)

  • The seed being static isn't a security flaw in the way you describe. It's not theoretically possible to guess the seed by 'taking enough random samples', because if you have a 128bit seed, then even if you see a billion hands there will be a quintillion seeds that could've produced the exact same outcome, so no data is revealed and the outcome of the next hand is still unknown. But, it is a security flaw in the sense that anyone who seeds the code can now predict every hand ever... Commented Jul 29, 2019 at 3:47

In Java, when you use Math.random() multiple times, Java only creates the Random object one time. When a large number of random numbers are drawn from this seed, it should in theory be possible to predict the next random number with some amount of precision.

However, you can easily circumvent this by generating a new seed every so many random numbers, or even for every random number. The only downside to this is that will be very bad for performance.

So instead of

double randNumber = Math.random();

you could do:

double randNumber = new Random().nextDouble();

Of course, there are many more factors that you should take into account when developing a production-grade poker application. This is a very interesting article about some of the things that can go wrong: http://www.datamation.com/entdev/article.php/616221/How-We-Learned-to-Cheat-at-Online-Poker-A-Study-in-Software-Security.htm


Exploits on shuffle due to random rare. A bad algorithm is the big weakness.

A site was exploited is due to off by one (they failed to shuffle the last or first card).

Another exploit is making ever card move. You need to allow for a card not moving.

Not uniform. A shuffles that swaps every position is not uniform. A variation of 7 is the common total on a roll of two dice.

Random seed is available by listening to atmospheric noise. You don't need to reseed very often as not may cards are actually seen.

The Fisher-Yates shuffle is proven to be uniform and it is efficient. It only requires 52 random numbers. You would need to know the existing deck and also the next 52 random numbers to know the next shuffle.

-- To shuffle an array a of n elements (indices 0..n-1):
for i from n−1 downto 1 do
     j ← random integer such that 0 ≤ j ≤ i
     exchange a[j] and a[i]

Even with a truly random you typically only get like 4.3 billion. Problem is that there are actually 52! possible deals which is a really big number. But if you look at the Fisher Yates closely it produces exactly 52! variations. So if you can generate a good random from 1-52 then you cannot be exploited.

In theory if the random was not perfect you could identify some shuffles that don't happen or happen less often or more often. But with poker the order does not matter so a board Ah Kc 4d 3s 8h is same as 4d Ah Kc 3s 8h so if one happens more than the other is no advantage. There are like 4.6 million boards so if you know some happen more than another might happen more might be an advantage but if you know QQ wins 80% versus 80.0000000000001% is not real advantage. But you do get to see the order of the cards so in theory you could limit the cards. But if the chance of having QQ goes from 0.5550% to 0.5551% there is not advantage to be gained. Even with a bad random you are going to generate a very large numbers of deals with a good distribution.

A less than perfect random itself is not much of a risk. If now the seed to a prefect or imperfect random is the only way to take advantage (IMHO).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.