How verifiable draws work

The short version

1. The organizer locks the entry list. RandNext publishes the list’s fingerprint (entries_hash) and a commitment: the SHA-256 hash of a secret random seed.
2. The organizer shares the record link before the draw time, so participants can save the fingerprint and commitment.
3. At the draw time, RandNext reveals the seed. Anyone can check that it matches the commitment and recompute the winners from the seed and the list.

Because the seed was committed to before anyone could see the result, and the list was locked before the seed was revealed, neither can be swapped afterwards without the record failing to verify. Check one yourself in the verifier, or with the Python reference script.

1. Normalizing the entry list

The list is normalized the same way in the browser, on the server and in every verifier, so the same text always produces the same fingerprint.

1. Split on \n (U+000A) only. A \r left over from \r\n is removed in the next step; a lone \r, U+2028 and other line separators do not split lines.
2. Apply Unicode NFC normalization to each line, then trim leading and trailing whitespace. The whitespace set is fixed (it matches JavaScript’s String.prototype.trim) rather than taken from a language’s own definition: U+0009–U+000D, U+0020, U+00A0, U+1680, U+2000–U+200A, U+2028, U+2029, U+202F, U+205F, U+3000, U+FEFF.
3. Drop empty lines.
4. If the draw uses duplicates = merge, keep only the first occurrence of each line. With keep, repeated lines stay, and each copy is a separate chance to win.
5. Keep the original order. The list is never sorted.
6. entries_bytes = UTF-8(lines.join("\n")), with no trailing newline.

Limits: 2 to 10,000 entries of up to 200 characters, and up to 1,000 winners.

2. Seed and commitment

VERSION      = "randnext-draw-v1"                       (ASCII)
entries_hash = SHA256(entries_bytes)                     32 bytes
server_seed  = 32 bytes from a CSPRNG                    sealed until the draw time
commitment   = SHA256(server_seed)                       published when the list is locked
params       = "id=" + draw_id + "\nwinners=" + k + "\nentries=" + n      (ASCII)
final_seed   = SHA256( UTF8(VERSION) || 0x00 || server_seed || entries_hash || UTF8(params) )

|| is byte concatenation; server_seed and entries_hash are the raw 32 bytes, shown as lowercase hex in records. The draw ID, the number of winners k and the number of entries n are mixed in so a seed can’t be reused for another draw, and the winner count can’t be changed after the fact.

3. Random stream and picking winners

block(i) = HMAC-SHA256(key = final_seed, msg = UTF8(VERSION) || uint32_be(i)),  i = 0, 1, 2, …
stream   = block(0) || block(1) || …   read 4 bytes at a time as big-endian uint32

uniform(m):                            # an integer in [0, m), m ≤ 2^32
  limit = floor(2^32 / m) * m
  repeat u = next_uint32() until u < limit
  return u mod m

a = [0, 1, …, n-1]                     # partial Fisher–Yates
for i in 0 … k-1:
  j = i + uniform(n - i)
  swap(a[i], a[j])
winners = a[0 … k-1]                   # a[0] is 1st place

Rejection sampling keeps every position equally likely. The output is a list of positions in the normalized list; the winning entries are the lines at those positions, in rank order.

Verify a draw yourself

Three independent ways, all following the steps above:

• The browser verifier: enter a draw ID, or paste a record and list. Nothing is sent anywhere.
• Download verify-draw.py, a standard-library-only Python 3 reference implementation written from this specification, separately from the site’s code.
• Your own implementation, from the record at GET /api/v1/draws/{id} and the list at /api/v1/draws/{id}/entries (see the API docs).

python3 verify-draw.py --fetch dr_7kq2m9x4tb1c
python3 verify-draw.py --record record.json --entries entries.txt

The script exits with status 0 only when the fingerprint, the commitment, the final seed and the winners all match.

What you still have to trust

A verifiable draw proves that the published winners follow from a list and a seed that were both fixed before the result was known. It does not prove everything. For v1 records there is one trust assumption: RandNext generates the seed, so you are trusting that RandNext did not pick a seed that favors someone when the list was locked. The commitment only guarantees that the result can’t change after locking. v2 records remove that assumption with a public randomness beacon (below).

If you’re a participant: ask for the record link before the draw time and save the commitment and fingerprint. A link you only see after the draw can’t tell you whether the organizer made other draws first.

randnext-draw-v2: a public randomness beacon

Every draw created since October 2026 uses v2. It mixes in a value from the drand quicknet beacon run by the League of Entropy. When a draw is locked it fixes a beacon round R that hasn’t been produced yet — the first round at least 3 seconds after locking and no earlier than the chosen draw time — and the draw time is moved onto that round.

VERSION     = "randnext-draw-v2"
params      = "id=" + id + "\nwinners=" + k + "\nentries=" + n + "\nbeacon_round=" + R
final_seed  = SHA256( UTF8(VERSION) || 0x00 || server_seed || entries_hash
                      || beacon_randomness(R) || UTF8(params) )
block(i)    = HMAC-SHA256(final_seed, UTF8(VERSION) || uint32_be(i))   (rest as in v1)

quicknet: chain hash 52db9ba7…e971, a round every 3 seconds since 1692803367, round r published at 1692803367 + (r−1)·3. The beacon’s randomness is SHA-256 of its 48-byte BLS signature over SHA-256(uint64_be(r)), checkable against the League of Entropy public key. Anyone can fetch round R from api.drand.sh and compare.

Nobody — RandNext included — can know round R when the list is locked, so the result is unknown to everyone until the draw time. The algorithm field on each record says which version it uses; v1 records stay verifiable with the v1 rules on this page.

Signed statements

RandNext also signs two statements with an Ed25519 key: one when the draw is locked (fingerprint, commitment, beacon round, times) and one when it is drawn (seed, beacon value, final seed, winners). Keep a copy of a record and its signatures and you can later prove what RandNext published, even if the record changed. The public key is at /api/v1/draws/signing-keys; the verifier checks both signatures and the beacon’s BLS signature.

FAQ