ГСЧ randomness lab

Giveaways

Fairness check of the giveaway

Recalculate the result according to the published secret and the list of participants.

instant computed locally SHA-256 without a server
Check result check not started
Enter the secret and the list of participants, then click 'Check'
Verification method SHA-256 · sort by ascending
  1. 1
    Secret hash

    First, we calculate SHA-256(secret) and compare it with the hash that was published before the draw. Different values mean that the secret was replaced.

  2. 2
    Hash of each line

    For the participant with number i, we calculate h = SHA-256(secret + ":" + i + ":" + name). The number is the position of the line in the list, starting from 1.

  3. 3
    Sorting and winners

    All h are sorted in ascending order (in case of equality — by row number). The first N participants are the winners.

Formula h = SHA-256(secret + ":" + (index + 1) + ":" + name)
The reverse side is also public: page giveaway creates a secret and a hash, counts the winners, and compiles a report.

How to verify a giveaway

The verification takes one minute and does not require trust in the organizer: you only need the secret, the list of participants in the original order, and the number of winners.

  1. Take the secret from the draw protocol — it is 32 hex characters next to the word 'REVEAL'.
  2. Insert the list of participants line by line, in the same order as in the draw.
  3. Enter the number of winners N and click 'Check'.
  4. Compare the hash of the secret with the published commit, and the list of winners with the announced one.

What does hash mean

A hash is a fixed-length fingerprint of data. The same string always gives the same SHA-256, and changing even a single character completely changes the result. Therefore, the organizer cannot 'rewrite' the secret: a new secret will give a different hash.

Commit is published before the draw and binds the organizer with a promise, reveal reveals the secret afterwards. If the SHA-256 of the revealed secret matches the published hash, the obligation is fulfilled.

Is it possible to forge the result

It is impossible to substitute winners without changing the result: any change of a name or the order of lines changes all the hashes. Finding another secret with the same SHA-256 is computationally impossible — this is a property of a cryptographic hash function, not a promise of the website.

The only thing that needs to be checked separately is that the hash was indeed published until start. To do this, save the link to the publication: a channel post, a screenshot, or an archived copy. Without this evidence, the scheme remains an honest word.

Why the order of participants is important

The row number is included in the formula, so the same person in different positions gets different hashes. When checking, the list must be inserted in the same order and with the same composition: otherwise, the result will consistently not match — this is not an error, but a different condition of the task.

Frequently Asked Questions
Where can I get the secret?
In the draw protocol — the line «REVEAL (secret)». It also comes in the link generated by the draw page: then the fields will be filled in automatically.
The hash of the secret does not match the published one. What does this mean?
The revealed secret differs from the one that was used to make the commit. Such a trick cannot be considered verified: the result could have been recalculated after the hash was published.
Why did I end up with different winners?
Check three things: the composition and order of the list, the number of winners N, and that duplicates were not removed during the draw. Any discrepancy changes the row numbers, and therefore all the hashes.
What if there were duplicate names in the list?
By default, the giveaway page removes duplicates: one person — one chance. When checking, use the same list that was published, without manual cleaning.
Can I verify someone else's giveaway?
Yes. The page is public and does not require registration: you only need the secret, the list of participants, and the number of winners.
Where is the data sent?
Nowhere. The secret and the list are processed in the browser, SHA-256 is computed by WebCrypto. The site does not store or log the entered data.
Who is responsible for the legality of the draw?
Organizer. The site provides a random selection tool but does not hold lotteries, does not accept bets, and does not pay prizes. Check the requirements of Federal Law 138-FZ 'On Lotteries' and Federal Law 38-FZ 'On Advertising' as they apply to your event.
The page checks arithmetic, not honesty: you should trust it exactly as much as you trust the SHA-256 algorithm.
↑↓ navigation Enter to open Esc close