Off-line random bits from a shuffled card deck

by Stephen Hewitt | Published 30 August 2026

This article shows one way you can generate unbiased random bits from a single shuffle of a deck of playing cards and write them down in hex, entirely by hand.

This method generates a variable number of bits that depends on the shuffle. The only consequence of not getting as many bits as you want would be needing to add more with a second shuffle. As an example, the probability of not getting enough bits for a 128-bit cryptographic key from a single shuffle is less than one in a billion.

Table 1 shows the probability of a shuffle producing fewer than k bits, for various values of k. This table was calculated using a method and programme explained in the Appendix.

The principle

Each card dealt from a shuffled deck is treated as a random integer in the range 0 to (n-1) inclusive, where n is the number of cards left in the deck just before dealing the card. The principle is to transform this random number into a random number in a range that is a power of two, so that it can then be written as bits.

To achieve this, the range 0 to n is partitioned into intervals that are each a power of two. (Because the lengths of these intervals sum to n, the presence or absence of each one mirrors a bit in representing n in binary.) The principle is that in every case, whichever power-of-two interval the card falls into, it is equally likely to be at every position within that interval, so the binary representation of its position within the interval consists of uniform random bits.

For example, consider the initial 52 cards in the shuffled deck. The first card drawn represents a random integer in the range 0 to 51 inclusive. This range is conceptually partitioned into power-of-two sized intervals of 32, 16 and 4.

If the random integer falls into the first 32 integers (0 to 31), then it is in an interval of length 32 and generates 5 bits. If it falls instead into the next 16 integers (32 to 47) then it is in an interval of length 16 and generates 4 bits. If it falls instead into the next 4 integers (48 - 51) then it is in an interval of length 4 and generates two bits.

For the next card, with 51 cards left in the deck, we partition into power-of-two-length intervals of 32, 16, 2 and 1. The process is as for the first card but with some intervals different. If the random number defined by the card dealt falls into the interval of length 2, we get 1 bit. If it falls into the interval of length 1, then we get no bits.

Practical method

This method will produce some bits written immediately in hex and some written in binary, which you can translate to hex later. This means you continuously extend a hand-written line of hex digits and a hand-written line of bits as you proceed. If you write the bits in groups of four, then it will be easier to convert them to hex.

It requires two decks of cards. The first deck is laid out on the table face up. The positions of these cards on the table has a conceptual order and the cards are arranged on the table in ordered rows of 4, as described below. This deck does not have to be shuffled and the relative position of any particular card in the arrangement on the table does not matter, because they are laid out before the second deck is shuffled.

The second deck is shuffled. Then you repeatedly deal a card from the shuffled deck and match it with one on the table. The position on the table of the matching card decides how many and what value hex digit/bits you write down. You take the matched card off the table, then write down the random values (before you forget where it was) and then and move into its place the card from the last position on the table.

This means that on the table you always have n cards, with n initially 52 but declining each time you take a card from the deck. Because matching cards are discarded, the set of cards face-up on the table at every step is the same as the set of cards remaining in the second deck.

While there are enough cards on the table, the first ones are arranged in groups of 16 in 4x4 squares.

When a card from the deck matches a card in a such a 4x4 square, you convert it to a hex digit with the help of the following map and write it into the list of hex digits. Unless you have a photographic memory, it helps to have a copy of this map visible while you work.

0123
4567
89ab
cdef

In addition, while they both remain, the first two 4x4 squares together represent the interval of length 32, or 5 bits. If the card dealt falls into one of these first two squares, then in addition to the hex digit, you write a single bit in the list of bits. If the card is in the first 4x4 square then this bit is “0”. If the card is in the second 4x4 square then this bit is “1”. If the card is in the third 4x4 square, or if there are less than two 4x4 squares remaining, then you write only a hex digit.

On the table following the 4x4 squares there will always be less than 16 cards (otherwise you would form another square). These are divided first into a group of 8 (if there are 8 or more cards) then following that a group of 4 (if there are 4 or more cards), then following that possibly a group of 2 and possibly a single odd card. The single odd card will be present always and only if there is an odd number of cards left on the table.

Each group has a priority over a smaller group. So you form the group of 8 only if there are enough cards left after forming the 4x4 squares, and you form the group of 4 only if there are enough cards for it after forming (or failing to form for lack of cards) the group of 8, and you form the group of 2 only if there are enough cards left after the attempt to form the larger groups. And all of these smaller groups are formed only after forming as many as possible 4x4 squares. After the 4x4 squares there can only be at most one of each smaller group.

Note that this forming into groups is purely conceptual or imaginary and there is no need to physically move cards in order to represent them because they are easy to visualise when the cards are first laid out in squares of 16 followed by rows of 4. The group of 8 is two complete rows; the group of 4 is one complete row following. The groups of one or two cards following these will be on the last row and obvious: only the last row will ever have less than 4 cards because you always move the last card into the gap made by removing a card from the table. Figure 1 shows an example.

****
****
****
***A

****
****
*B**
****

****
C***
*DZ

In Figure 1, dealing a card that matches the card at position A means you write “f” in the row of hex digits and “0” in the row of bits. Matching the card at position B means you write “9” in the row of hex digits and “1” in the row of bits. Matching the card at position C (which is in a group of 8) means you write “100” in the row of bits. Matching the card at position D (which is in a group of 2) means you write “1” in the row of bits. Card Z is an odd card and matching it would mean that you write nothing. Card Z is also the last card, which will be moved to fill the gap created by matching any other card.

When a card matches a card in a group of 4, which will always be a complete row, then you write down two random bits according to the following map, which is the binary encoding of the position in the row.

00 01 10 11

If a card matches a card in the group of 8, which is two rows of 4, then you write an extra bit. If it is in the first row write “0” and if it is in the second row write “1”. Then write the two bits defined by its position in the row of 4, as for a group of 4.

If a card matches a card in a group of 2, you write a single bit, “0” if it is the first position in the row and “1” if it is the second position in the row. (It can't be anywhere else).

Caveat

This method will directly produce some bits written immediately in hex and some written in binary and will likely produce more than you need. You have to decide which bits to use and what order to put them in. For example, you could take all the bits written in hex first and then only if there are not enough top up with ones written in binary. You could stop dealing cards when there are enough bits in total or you could continue hoping to get enough in hex without converting any from binary.

So an important point is to decide how you are going to select the bits before you start and not change this decision. If you make ad-hoc decisions after seeing the value of the bits, then theoretically you might be introducing a bias.

Appendix: calculating probabilities

This appendix explains how the probabilities shown in Table 1 are calculated.

The method is iterative. We calculate the probability of having derived a cumulative total of k bits after dealing N cards, for all possible values of k. Then these probabilities are used to calculate the probabilities of every possible value of k after dealing N+1 cards. We start at deal 0, having dealt no cards, where the probability of k = 0 is 1 and all other probabilities are zero, and iterate until all the cards have been dealt.

We have to sum the probabilities of all the different ways we could have derived the k bits after dealing N+1 cards, given the probabilities after dealing N cards. Suppose P(k, N) is the probability of a cumulative total of k bits having been generated after N cards have been dealt and suppose p(g, N) is the probability of generating g bits on dealing card N where the first card dealt is 1. Then

P(j, N) = ∑(P(k, N - 1)p(g, N)) over all k, g where k + g = j

Example

After dealing the first card, the probability of having 5 bits (k = 5) is 32/52, the probability of having 4 bits (k = 4) is 16/52 and the probability of having 2 bits (k = 2) is 4/52 and the probability of any other number of bits is zero.

After dealing the second card, things are more complicated because there are multiple ways of getting some values of k. For example for k = 9, we could have got 4 bits on the first card and 5 bits on the second, or vice versa. There are no other combinations at this stage that result in a total of 9 bits, so we can write the probability of k = 9 after dealing two cards is:

P(9, 2) = 32/52 x 16/51 + 16/52 x 32/51

GPL free software

The following file on this website, with the following SHA256 hash is a GPLv3 programme for calculating the probabilities shown in Table 1, based on this method

/download/bitprobs.cc

d8520902feb508df36d585f241041919fe2345fc5512051029164dce3079a0b2