Running a draw people can verify

The bias hiding in most random pickers, and how to make a result anyone can check afterwards.

The bias almost nobody accounts for

Picking a random winner from a list looks like a solved problem. It mostly is, and the two common ways of doing it are both slightly wrong.

Math.random() is not designed for anything that matters. It is fast, it is predictable from its own previous output, and it makes no guarantees about the quality of its distribution. For a prize draw it is the wrong tool.

getRandomValues() % n is the sophisticated-looking mistake. It uses a proper cryptographic generator, and then throws away its uniformity with a remainder. A 32-bit generator produces a number from a range of 4,294,967,296 values. If you have 1,000 entries, that range does not divide evenly — some remainders come up slightly more often than others, and the ones that do are always at the start of the list.

With 1,000 entries the effect is tiny. It is also not random: it favours the same people every time, in every draw you ever run with that code. And it is entirely avoidable.

The fix is called rejection sampling: discard any value that falls in the uneven tail of the range and draw again. It costs a fraction of a millisecond and makes every entry exactly equally likely.

The same care applies to shuffling. Fisher–Yates is the standard algorithm and produces every ordering with equal probability; the intuitive “sort by a random number” approach does not, and is biased in ways that depend on the sorting algorithm.

Making the result checkable

A draw nobody can verify is an assertion, not a draw. Entrants have only your word for it, and if the prize is worth anything somebody will wonder.

Two things help, and they stack.

Publish a digest of the entry list

A digest is a short string derived from the exact contents of the list. Change one name, add one entry, reorder them, and the digest changes completely.

Publish it when entries close. After the draw, anyone can check that the list you drew from is the list you published — you cannot have quietly added a friend or removed someone.

Announce a seed in advance

This is stronger. A seed makes the draw reproducible: the same seed and the same list always produce the same winners, so anyone can re-run it and get your result.

The trick is that the seed must be something you could not have chosen to suit yourself. Announce beforehand that you will use, say, a particular lottery number, or a stock index close, on a stated date. When that value exists, run the draw with it. Now anybody can repeat the draw exactly and confirm the winners — and you demonstrably could not have picked a seed that gave you the answer you wanted.

Without a seed, a draw using the system's cryptographic generator cannot be reproduced. That is not a flaw, but it should be stated rather than glossed over.

Cleaning the list first

Most entry lists need work before they are a list of people. Decide before you draw:

• What makes two entries the same person? Usually a handle ignoring capitalisation, a leading @ and trailing punctuation, so @Alice, @alice and @alice. count once.
• One entry each, or one per comment? Either is fine; say which in the rules.
• What disqualifies an entry? A missing tag, a link, an account you have excluded.

Whatever you choose, keep the record of what was removed and why. “Why is my name not in the list” is the first question you will be asked, and having the answer immediately is the difference between a query and an argument.

Alternates

Draw more names than you have prizes. Winners do not reply, accounts turn out to be ineligible, people have already won something recently. Drawing alternates at the same time, in order, means you never have to run a second draw — which always looks worse than it is.

What a fair draw does not do

It does not make a promotion legal. Prize draws are regulated differently in different countries and sometimes differently between regions of one country, covering who may enter, how the rules must be published, how the prize is described, whether a purchase may be required, and what records you keep and for how long. Some jurisdictions distinguish sharply between a draw of chance and a contest of skill, with different rules for each.

Platforms have their own requirements on top, typically including a statement that the promotion is not associated with them.

A verifiable draw is one part of running a fair promotion. It is not a compliance check, and no tool that offers you one should be believed.

Frequently asked questions

Why can a random picker be biased?

Because taking a random number modulo the number of entries is not uniform unless the entry count divides the generator's range evenly, which it almost never does. The excess falls on the entries at the start of the list, every single time. Discarding values in the uneven tail and redrawing removes the bias.

How do I prove the draw was fair?

Publish a digest of the eligible list when entries close, so nobody can claim the list changed. For a stronger guarantee, announce in advance a seed you could not have chosen to suit yourself — a lottery number or a market close — and anyone can re-run the identical draw.

What does the seed actually do?

It makes the draw reproducible. The same seed and the same list always give the same winners. Without one, the draw uses your browser's cryptographic generator and cannot be repeated.

Can it read entries from my post's comments?

No. Nothing is scraped from any platform. You paste the list yourself, which is also the only way to be certain the entries drawn from are the ones you meant to include.

How many alternates should I draw?

Enough that you never need a second draw. One or two per prize is usually plenty; more if past experience says winners often do not reply.

Does this make my giveaway legal?

No. Prize promotions are regulated differently in different places, and platforms add their own rules. A verifiable draw is one part of running a fair promotion, not a substitute for knowing the rules where you are.