RNG certification,
and what a lab will ask your platform for.

Every online poker hand starts with a shuffle, and the shuffle is only as fair as the random numbers behind it. RNG certification is an independent laboratory's statement that a specific version of a random number generator, and the way a game turns its output into cards, meets a published technical standard.

The most widely used standard for online gaming systems is GLI-19, Standards for Interactive Gaming Systems, from Gaming Laboratories International. Version 3.0, dated 17 July 2020, has a chapter of its own on random number generators and sections on card games, peer-to-peer gaming, change management and the operator's controls. GLI publishes it alongside GLI-11 for gaming devices and its other standards, and regulators often adapt these into their own rules.

A certificate is specific. It typically names the software, its version and the jurisdictions it covers. Change the RNG, the shuffle or a critical file and the certificate may no longer apply until the lab has looked again — which is why change control is part of what is certified.^[1][2]

A handful of laboratories do this work. Regulators decide which they accept. Great Britain's Gambling Commission publishes a list of approved test houses and requires full accreditation to ISO/IEC 17025, together with selected requirements of ISO/IEC 17065 and ISO/IEC 27002. Its list of 2 March 2026 includes Gaming Laboratories International and several GLI entities, BMM Testlabs, eCOGRA, Gaming Associates Europe, Global Lab, Eclipse Compliance Testing, Quinel and RiskCherry.

Other markets keep their own lists, and a supplier's choice of lab is often made by where its operators want to launch.

GLI-19 sets out the work in some detail. The lab reviews the source code of every algorithm that plays a critical role in the outcome — the randomness itself, the scaling of raw numbers into ranges, and the shuffle — looking for bias, implementation errors, malicious code and undisclosed switches. It compares the algorithms with published references.

Then it tests the output statistically, after scaling and shuffling, choosing tests to suit the RNG: chi-square, overlaps, coupon collector's, runs, interplay and serial correlation, and duplicates, evaluated together at a 99% confidence level. Each outcome must be equally likely, one draw must give no information about the next, and the RNG's period must be large enough for every outcome to be available on every draw.

For online play the RNG must be cryptographically strong: given past values, predicting future ones must be computationally infeasible; the state after seeding must not be guessable — never seeded from a time value alone; and the state must be refreshed with outside entropy. Scaling may discard values to remove bias. For card games, each hand starts from a randomly shuffled deck, and cards are not returned or reshuffled except as the rules of the game provide.

Great Britain's Gambling Commission sets the rules in its remote gambling and software technical standards. RTS 7 asks for random outcomes that are acceptably random — shown to a high degree of confidence by statistical analysis — and unpredictable: it must be computationally infeasible to predict the next number. Seeding and reseeding must not introduce predictability, and any scaling must keep those qualities.

Its testing strategy says what is tested and when. RNG testing includes a review of the RNG's documentation, research into known weaknesses of its algorithm, a source code review against that documentation, and statistical testing of the raw RNG output and of the scaled or shuffled decks. New games and RNGs can be released only once testing is complete and the report has gone to the Commission.

The Malta Gaming Authority asks for a valid RNG certificate when a licensee adds a game whose RNG it has not already approved, through a technical application of its own. This is general information, not legal advice; the operator's counsel confirms what each licence requires.^[3][4][7]

Certification tells players and regulators that the RNG was fair when the lab looked at it. A committed shuffle lets a player check a particular hand. Before the first card is dealt, the server publishes a cryptographic commitment — a hash — to the shuffled deck. After the hand, it reveals enough for the player to recompute the commitment and confirm that the cards they saw were the cards committed to, in the order they were dealt.

That proves something specific and useful: the deck was fixed before anyone acted, and nobody changed a card mid-hand. It is the same idea behind the provably fair games of some crypto casinos.

It does not prove everything. It cannot show that the seed behind the shuffle was random — a server could commit to a deck it chose with care — so it complements certification rather than replacing it. It says nothing about collusion or bots. And a naive design that reveals the whole deck after the hand would show every player the cards that folded and the cards that never came, which a poker room cannot allow.

For every hand, and only for it, PokerEnginePro takes 48 bytes from the operating system's cryptographic random number generator: a 32-byte seed and a 16-byte nonce. The seed keys an HMAC-SHA256 stream; rejection sampling turns its values into unbiased choices, discarding the few that would bias the result; and a Fisher–Yates shuffle turns those choices into the deck. Nothing else random enters the deal, and the seed is never written anywhere while the hand is dealt.

Before the first card, the engine publishes a commitment to the deck as an event every seat receives. Each card is hidden under its own salt, so after the hand a player can be shown exactly the cards they saw — their own hole cards, the board, every hand shown — and check them against the commitment, while folded hands and undealt cards stay hidden. In draw games, each reshuffle gets its own commitment, published before any card of it.

Every table deals from this shuffle, play money included; it costs about 25 to 35 microseconds of processor time a hand. Real-money tables — any table whose currency is not play chips, cash and tournament alike — also record every shuffle for the laboratory when the RNG log is switched on.

After any hand, play money included, a player opens its history and presses Verify. The check runs in their own browser with Web Crypto, so they need not trust the server to have run it: each commitment is recomputed from its parts, each card they saw is matched to its place in the committed deck, and each card must sit at the position its turn in the deal gave it — a card dealt from further down the deck fails, even if it was genuinely in the deck.

In the back office, staff with the hole-card permission can verify the whole deal from the seed, and every look is audited. Compliance staff and auditors, who may not see hole cards, can have the server check the whole deal and see only pass or fail for each step — never a card.

A lab tests output, so PokerEnginePro records it. When switched on for a certification run, the RNG log records every real-money shuffle: the raw seed and nonce, every value the stream produced — including those rejection sampling discarded — the scaled choices with their ranges, and the resulting deck. It is written in the background after each hand ends, never while a card is being dealt, kept 180 days by default or longer where a market requires, and exported as JSON Lines. A sample tool draws any number of shuffles from the same generator, in the same format, for the lab's statistical battery.

The rest of the kit is ready for the laboratory: a traceability matrix from GLI-19's areas to where the platform meets them and the tests that show it; game rules for 14 variants, their facts generated from the engine; the build manifest and critical-files list; a change-control procedure that classifies every regulated change as major or minor, with its evidence; and a test plan for the lab.

PokerEnginePro is built for GLI-19, and its certification kit is ready. The certificate itself comes from the lab's own evaluation, which the licensor or the licensee engages — and the licence stays with the operator.

Whichever platform an operator chooses, the same questions separate a platform that is ready for a lab from one that will need months of work first.