How the Winner Picker actually works.

A complete, technical breakdown of how a winner is chosen, what the audit certificate proves, and where the tool's responsibility ends and the draw organiser's begins.

1. The problem this solves

Every prize draw arrives at the same awkward moment. The entries are in. Someone needs to pick a winner. They open random.org, enter a range, click a button, and write the number on a Post-it. Sometimes that's the end of it. Sometimes a trustee, an auditor, an entrant, or a journalist asks: how do we know that wasn't rigged?

The honest answers are usually unsatisfying. "We used a random number generator." Which one? "I don't remember the URL." When did you run it? "Some time on Thursday." Who saw it? "Just me." Where's the record? "There isn't one."

That gap is what the Winner Picker closes. It does the same job as random.org, but it captures the inputs, the time, the method, and a fingerprint of the entry pool, and packages all of that into a single document you can hand to anyone who asks.

2. How the winner is chosen

The selection runs entirely in your browser using the Web Crypto API, the same cryptographic source browsers use to generate HTTPS keys, secure session tokens, and password hashes. It is the strongest random source available in a normal web page.

The exact steps:

1. Build the valid entry pool. Take every integer from 1 to your total entry count, then remove any numbers you've excluded (typically test entries or disqualified entrants). The result is a sorted list of every legitimate ticket number.
2. Fingerprint the pool. Compute a SHA-256 hash of the sorted pool serialised as JSON. This produces a 64-character fingerprint that locks in exactly which entries were eligible. Any later change to the pool, even one number, produces a completely different hash.
3. Pick using cryptographic randomness. Use crypto.getRandomValues to generate uniformly distributed random bytes. Convert those bytes to an index into the entry pool using rejection sampling, which avoids the modulo bias that simpler approaches like random() % N introduce. Take the entry at that index.
4. Pick the next winner without replacement. Remove the chosen entry from the pool and repeat for any additional winners or runners up. No entry can win twice.

3. What the certificate proves

Every draw produces a certificate (visible on screen and as a downloadable PDF) with the following fields. Each one exists for a specific reason.

4. How to verify the entry pool hash

The entry pool hash on the certificate is the part that proves nobody quietly changed the entries. Think of it as a fingerprint of the exact list of tickets that went into the draw. You feed that list through a standard, well-known calculation (SHA-256) and it returns a 64-character string. Add an entry, remove one, or alter a single number, and the string comes out completely different.

Because the calculation is fixed and public, anyone can repeat it. Take the list of entries you believe went into the draw, run the same calculation yourself, and you get your own 64-character string. If it matches the one printed on the certificate, the draw used exactly the entries you expected, and no more. If it does not match, the entry list was different at draw time, and that is worth asking about.

In other words, the certificate does not just say "trust us". It hands you everything you need to check the entries for yourself. Here is exactly how:

1. Take the full list of valid entry numbers (1 to N, with any excluded entries removed).
2. Sort ascending.
3. Serialise as JSON, e.g. [1,2,3,4,5,7,8,9,10] if entry 6 was excluded from a 10-entry pool.
4. Compute SHA-256 over the UTF-8 bytes of that string.
5. Compare to the value on the certificate.

One-liners in common languages:

# Python
python3 -c "import hashlib,json; print('sha256:'+hashlib.sha256(json.dumps([1,2,3,4,5,7,8,9,10],separators=(',',':')).encode()).hexdigest())"

# Node
node -e "const c=require('crypto');console.log('sha256:'+c.createHash('sha256').update(JSON.stringify([1,2,3,4,5,7,8,9,10])).digest('hex'))"

# Shell with openssl
echo -n '[1,2,3,4,5,7,8,9,10]' | openssl dgst -sha256

Whichever you use, a matching result confirms the entry pool was exactly what you expected. This is the same kind of check banks and software companies rely on to prove a file has not been tampered with. You do not have to take our word for the draw. The maths does the proving.

5. Where the tool's job ends

The Winner Picker handles one specific job: choosing a winner at random and recording the choice in a way that holds up to scrutiny. Picking the winner fairly is the part most people worry about. In practice it is the easy part, and it is rarely where a draw goes wrong.

The things that actually decide whether a prize draw is lawful sit entirely outside the moment of selection:

• The structure of the draw, including whether there is a fee, whether a free entry route is offered, and whether the prize counts as gambling consideration
• The terms and conditions communicated to entrants
• Whether the operator holds the right licences, or operates under exemptions that match how the draw is run
• How the draw is promoted, and to whom

Get any of those wrong and a draw can be unlawful no matter how fairly the winner was picked. So while a clean selection record is worth having, it is not what makes a draw compliant. Using the Winner Picker on its own does not certify, guarantee, or imply compliance with the Gambling Act 2005 or any other legislation.

Structuring a draw so it is lawful from the start is precisely what we do at The Prize Draw Company. We set the draw up correctly, and the Winner Picker then provides the evidence a properly structured draw needs: a verifiable record of fair random selection you can show to a trustee, an auditor, a regulator, or an unhappy entrant. If you are running a draw yourself and are not certain it is structured correctly, talk to us before you run it.

6. What a trustee or auditor should check

If a draw certificate lands on your desk, the questions worth asking are:

1. Does the draw name match the campaign you expect? Anyone can run a draw on the tool. The name on the certificate confirms which one this is.
2. Does the total entry count match the campaign records? Cross-reference with whichever platform recorded entries (Crowdfunder, Raffall, your own database).
3. Is the attempt counter equal to 1? If it is higher, the operator pressed the draw button more than once before producing this certificate. There may be a legitimate reason. Ask.
4. Do the browser and server timestamps agree? A significant gap suggests the operator's system clock was wrong or tampered with.
5. Does the entry pool hash reproduce? Use the recipe above and verify.
6. Is the draw reference ID present in the operator's records? A genuine certificate has a unique UUID. Operators should keep their own log.

7. Browser support and limitations

The Web Crypto API is supported in every current version of Chrome, Firefox, Safari, and Edge. If your browser cannot produce a SHA-256 hash, the Winner Picker will still choose a winner using cryptographic randomness, but the certificate will display a clear "Verification Unavailable" notice in place of the hash. If you see that notice, the certificate is honest about what it can and cannot prove. If you need a fully verifiable certificate, run the draw again in a current browser.

The tool does not currently support uploading a list of entries by name or email. It works with numbered entries only, which means whichever platform records your entries needs to give each one a sequential number. This is deliberate: by handling only the totals and the winning numbers, the tool never sees who entered, and your entrants' personal data never leaves your own systems.

Questions

If you have questions about how the tool works, or want to suggest improvements, get in touch via theprizedrawcompany.com.