SpinOfLuck
Open

Verify a giveaway draw

Every verified draw on SpinOfLuck publishes its complete entry list, every participant's odds, the random seed it used and the exact algorithm — so you can recompute the winner yourself and confirm it. You do not have to trust the organiser, and you do not have to trust us.

How verification works

1

Commit

Before entries close, the SHA-256 hash of a secret seed is published. That fixes the seed without revealing it — nobody, including us, can swap it later.

2

Freeze

When entries close, the full participant list and every weight are hashed. From that moment no name can be added, removed or edited without the hash changing.

3

Reveal

The seed is published in full and the winning ticket is derived from it. Anyone can re-run the arithmetic and land on the same winner.

Running a giveaway?

Publish a draw your audience can check for themselves. It takes three steps and no account — you get a permanent link and a downloadable PDF certificate at the end.

Run a verifiable draw

Build your own verifier

The record is public, CORS-enabled and free to use. Reproducing a draw needs nothing but a SHA-256 implementation — no bignum library, no custom PRNG.

GET/api/verify/{drawId}
The complete record: entries with ticket ranges and odds, both hashes, the revealed seed, every round's random number, and the winner. Returns 404 for an unknown draw.
GET/api/verify/{drawId}/certificate
The PDF certificate for a completed draw. 409 while the draw is still in progress.
POST/api/draws
Open a draw and publish its commitment. Returns the draw plus a host key, shown once. Followed by /close and /complete.

Algorithm: spinofluck-draw-v1

# 1. the commitment held
sha256(seed) == commitHash

# 2. derive the seed the draw actually used
finalSeed = sha256(seed + "|" + publicSeed + "|" + drawId + "|" + completedAt)

# 3. draw round k (0-based) from a pool of N tickets
for attempt in 0, 1, 2, ...:
    block  = sha256(finalSeed + ":" + k + ":" + attempt)
    sample = int(block[0:12], 16)          # first 48 bits
    limit  = 2**48 - (2**48 % N)
    if sample < limit:                     # else retry: this keeps it uniform
        ticket = (sample % N) + 1          # 1-based
        break

# 4. the winner is whoever owns that ticket. Participant i holds
#    entries_i * weight_i consecutive tickets, in published order.

Full specification, worked example and security model: docs/verification.md in the project repository.

Frequently asked questions

What is a SpinOfLuck verification link?
It is a permanent public page for one giveaway draw. It publishes the complete entry list, every participant's odds, the random seed the draw used, the exact algorithm, and the winner — so anyone can recompute the result and confirm it, without trusting SpinOfLuck or the host.
How do I check that a draw was fair?
Open the verification link and press "Verify in my browser". Your own device re-derives the winner from the published seed and entry list and tells you whether it matches. You can also download the JSON record and check it with your own code, using nothing but a SHA-256 implementation.
What stops the organiser changing the winner afterwards?
The random seed is committed as a SHA-256 hash before entries close, and the entry list is hashed and frozen when they do. A completed draw is immutable in our database. Editing any published value makes the winner stop matching the published seed, and the verification page turns red.
Can the winner be predicted in advance?
No. The seed stays secret until the draw runs, and it is never derivable from the published commitment hash. For high-value giveaways the host can also mix in public entropy — a blockchain block hash, for example — that did not exist when the commitment was made, so neither the host nor SpinOfLuck alone determines the outcome.
Are participant names always public?
Only if the host chooses. In privacy mode, names are replaced with anonymous IDs before anything is stored or published. The odds and the result stay exactly as verifiable; only the host holds the mapping back to real people.
What is the giveaway verification certificate?
Every completed draw can be downloaded as a one-page PDF certificate. It records the draw ID, the date and time, the number of entries, the winner, the entry-list hash, the commitment hash, and the revealed seed — the same values published on the verification page. It is a shareable summary for a sponsor, a client, or a prize claim, not a substitute for the live page: the certificate states the numbers, and the verification link is where anyone can recompute them for themselves. Certificates are generated on demand and are free.
Does the certificate prove the draw was fair on its own?
No, and it does not claim to. A PDF is a document, and a document can be edited. What makes a draw checkable is that the seed, the entry list and the algorithm are all published, so anybody can rerun the draw and get the same winner. The certificate carries the draw ID and the verification URL precisely so a sceptical reader can leave the PDF behind and confirm the result at the source.
Is there an API for third-party verifiers?
Yes. GET https://www.spinofluck.com/api/verify/{drawId} returns the complete record as JSON, CORS-enabled and free to use. It contains everything needed to reproduce the draw independently.