How a provably fair giveaway draw works
A provably fair draw is one where anyone can check that the winner was not chosen by hand. On winner-picker.online, your browser fingerprints the cleaned list, our server stores that fingerprint and only then issues a random seed, and the winners follow from the list and the seed alone. Re-running the same inputs always gives the same winners.
At a glance
- Algorithm
- wp-sha256-ctr-v1
- Random seed
- 32 bytes, issued by the server after the list fingerprint is stored
- List fingerprint
- SHA-256 of the cleaned, sorted list
- Picks per draw
- Up to 10 winners and 5 backups
- Result pages
- Public by link, not indexed, deleted after 12 months
What happens when you press Draw?
- 1Your browser cleans the list (or the YouTube comments that pass your rules), sorts it into a fixed order and computes a SHA-256 fingerprint of it.
- 2The fingerprint, entry counts and settings are sent to our server and stored. The list itself is not sent.
- 3Only after the fingerprint is stored does the server generate a 32-byte random seed and return it.
- 4Your browser turns the seed into winner positions with the wp-sha256-ctr-v1 algorithm.
- 5For standard draws, the server recomputes the winner positions from the entry count and the seed and rejects any result that does not match.
- 6The reveal animation plays. It only displays winners that were already decided.
Why does the order of the steps matter?
Because the seed is issued after the list is locked, a host cannot see the seed first and then edit the list to favour someone. If a host starts another draw for the same list within 24 hours, the public result page says how many.
How is the random number generated?
The wp-sha256-ctr-v1 algorithm hashes the seed together with a counter using SHA-256 to produce a stream of random 32-bit numbers. Rejection sampling removes modulo bias, and a partial Fisher–Yates shuffle picks winners without repeats. Weighted draws use the same stream with each entry's ticket count. Math.random is never used.
How do YouTube comment draws work?
For a YouTube draw, our server loads the video's public comments through the official YouTube Data API and caches them briefly. Your browser applies the entry rules, and then the same steps run: fingerprint, server-issued seed, winners. Comments can be edited or deleted later, so a comment draw is recorded by its fingerprint and seed rather than re-checked from a file.
What stays private?
An uploaded list never leaves the host's device. A stored result contains the fingerprint, counts, settings, the seed and the winners, with email addresses always masked. Result pages are not indexed by search engines and are deleted after 12 months.
What can no picker verify?
Official platform APIs do not reveal who liked, followed or shared a post, so winner-picker.online never offers “must like” or “must follow” rules. Hosts remain responsible for their giveaway's official rules and local law.
How can I verify a draw?
Open the public result page, choose “Verify this draw” and load the original list. Your browser recomputes the fingerprint and the winners from the published seed and shows whether they match. Nothing is uploaded during verification.
Open the verify page