How to pick giveaway winners fairly and show your work

To pick a winner fairly, use a generator built for security, give every entry the same chance, and let people check the result afterwards. Most unfairness in a simple picker comes from one of two places: a weak source of randomness, or a small arithmetic slip called modulo bias. Both are fixable. A published list of entries and a record of the draw are the best proof that nobody chose the winner.

Random pickerPick a winner fairlyOpen

True and pseudo-random

A true random source takes its unpredictability from a physical process, such as electronic noise. A pseudo-random generator is a formula. It starts from a seed, applies deterministic steps and produces a sequence that looks random. The sequence is fully determined by the seed, so anyone who knows the seed and the formula can predict every number.

Most software uses pseudo-random generators, and that is fine for shuffling a playlist or randomising a game level. For a draw where people have something to win, the question is whether someone could predict or influence the output. A generator that is fast but predictable is the wrong tool.

Use the browser's cryptographic generator

In JavaScript, Math.random() is a fast pseudo-random generator. Its documentation says it is not suitable for cryptography, and a prize draw is a security-sensitive choice. The Web Crypto function crypto.getRandomValues() fills an array with values from the operating system's cryptographic random source. That is the one to use. A picker that does not say what it uses is harder to trust, so ask before you rely on it.

Modulo bias, with one example

Suppose your source gives a random byte, a whole number from 0 to 255, and you want one of three entries. The easy route is to take the remainder when you divide by 3. It looks fair, but 256 does not split evenly into groups of three.

• Values 0, 3, 6 and so on up to 255 leave remainder 0. There are 86 of them.
• Values that leave remainder 1 number 85, and values that leave remainder 2 also number 85.

So entry 0 comes up 86 times in 256, about 33.6%, while entries 1 and 2 come up 85 times each, about 33.2%. The gap is small, but it is real, and it grows as the number of entries becomes large compared with the source's range.

The fix is rejection sampling. Draw a value, and if it falls in the uneven leftover part, draw again. For the byte example, you reject 255 and accept only 0 to 254, which divides evenly into threes. With a 32-bit random number the leftover is about one value in 4.3 billion, so the bias is negligible for a giveaway. A careful picker still handles it, because the same slip gets worse as the range shrinks.

Draws without repeats

If you need several winners, drawing a random index three times can pick the same entry twice. Two clean methods avoid that:

1. Remove each winner from the list, then draw again from the rest.
2. Shuffle the whole list once with the Fisher–Yates method, then take the winners from the top.

Fisher–Yates walks through the list from the end, swaps each position with a randomly chosen position at or before it, and produces every ordering with equal probability when the random choices are fair. It is short, well understood and easy to explain to entrants.

Make the draw checkable

A fair draw is one anyone can verify. Before the draw:

• Publish the entries as a numbered list, along with the rules for who was eligible.
• Publish a SHA-256 fingerprint of that list. Any SHA-256 tool can produce one. A fingerprint changes completely if a single entry changes, so the list cannot be quietly edited afterwards.

During and after the draw:

• Record the screen from the moment you start the picker to the displayed result.
• Publish the final list with the winning number, so people can recompute the fingerprint and confirm nothing changed.
• Say how the winner was picked, for example "chosen with a browser-based picker that uses the operating system's cryptographic random source".

Giveaway rules differ between platforms, and prize draws can carry legal requirements that depend on where you live. Check the platform's promotion rules and your local law before you run one. This is general guidance, not legal advice. When you are ready, pick a winner with the random picker.

Quick answers

Is Math.random() fine for a giveaway?

It is fine for games and shuffles, but not for a draw people will check, because its output can be predicted. Use a cryptographic source.

Why not just take a random number modulo the number of entries?

When the range does not divide evenly, the remainder is uneven, so some entries are slightly more likely. Rejection sampling removes that bias.

Can I pick several winners from one draw?

Yes. Remove each winner before the next pick, or shuffle once and take the top entries. Either way, no entry can win twice.