Giveaway comment picker: a random draw anyone can verify

A draw your entrants can check#

Most comment pickers ask entrants to trust a screen recording. This one uses commit-reveal: you publish a fingerprint of a secret seed when you announce the giveaway, and the seed itself after the draw. The seed and the published entrant list decide the winners, so anyone can re-run the draw and get the same names.

How the draw works (pb-draw-v1)#

1. Entrants. Each username becomes a key: Unicode NFC, whitespace runs turned into one space, a leading @ and the outer spaces removed, A to Z lowercased (other characters stay as they are). The filters apply, and with "one entry per person" each key counts once.
2. Entrant list. The keys are sorted by their UTF-8 bytes and joined with line breaks, with no line break at the end. The entrants hash is the SHA-256 of that text.
3. Random numbers. Block i (0, 1, 2 and so on) is HMAC-SHA256 with the seed's 32 bytes as the key and <entrants hash>:<i> as the message. Each block gives eight 32-bit numbers (big-endian), used in order.
4. A fair pick from m entrants. Take the next number x; skip it while x is at least floor(2^32 / m) × m, so no entrant is favoured. The pick is x mod m.
5. Shuffle. For k = 0 up to winners + alternates − 1, swap position k with position k + pick(n − k). The first positions are the winners, the next ones the alternates. With fewer entrants than places, everyone is listed in the drawn order.

Test vector#

Comments @Bob c, alice x, bob again and carol, one entry per person, 2 winners and 1 alternate. @Bob and bob are one person, so there are 3 entrants:

Seed           000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f
Entrant list   alice, bob, carol
Entrants hash  180fb4068fd5af9e707e2cd14ea439ac159703e1baef83af87e8cf2f1868d10f
Fingerprint    630dcd2966c4336691125448bbb25b4ff412a49c732db2c8abc1b8581bd710dd
Winners        alice, bob
Alternate      carol

Facts#

• SHA-256 is specified in FIPS 180-4 and HMAC in RFC 2104; browsers run both through the Web Crypto API.
• Instagram's promotion guidelines require official rules that release Instagram and say Instagram doesn't sponsor or run the promotion, and forbid encouraging inaccurate tagging (Instagram Help Center, checked 2026-10-21).
• The page takes up to 50,000 comments and CSV files up to 5 MB. The API takes JSON bodies up to 128 KB.