# Giveaway comment picker: a random draw anyone can verify Paste the comments from your giveaway post or upload a CSV, then draw winners and alternates in your browser. Publish a fingerprint when you announce the giveaway and the seed after the draw, so anyone can re-run it and check. ## A draw your entrants can check Most comment pickers ask entrants to trust a screen recording. This one uses commit-reveal: you publish a fingerprint of a secret seed when you announce the giveaway, and the seed itself after the draw. The seed and the published entrant list decide the winners, so anyone can re-run the draw and get the same names. ## How the draw works (pb-draw-v1) 1. **Entrants.** Each username becomes a key: Unicode NFC, whitespace runs turned into one space, a leading @ and the outer spaces removed, A to Z lowercased (other characters stay as they are). The filters apply, and with "one entry per person" each key counts once. 2. **Entrant list.** The keys are sorted by their UTF-8 bytes and joined with line breaks, with no line break at the end. The entrants hash is the SHA-256 of that text. 3. **Random numbers.** Block `i` (0, 1, 2 and so on) is HMAC-SHA256 with the seed's 32 bytes as the key and `:` as the message. Each block gives eight 32-bit numbers (big-endian), used in order. 4. **A fair pick from m entrants.** Take the next number `x`; skip it while `x` is at least `floor(2^32 / m) × m`, so no entrant is favoured. The pick is `x mod m`. 5. **Shuffle.** For k = 0 up to winners + alternates − 1, swap position k with position k + pick(n − k). The first positions are the winners, the next ones the alternates. With fewer entrants than places, everyone is listed in the drawn order. ## Test vector Comments `@Bob c`, `alice x`, `bob again` and `carol`, one entry per person, 2 winners and 1 alternate. `@Bob` and `bob` are one person, so there are 3 entrants: ```text Seed 000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f Entrant list alice, bob, carol Entrants hash 180fb4068fd5af9e707e2cd14ea439ac159703e1baef83af87e8cf2f1868d10f Fingerprint 630dcd2966c4336691125448bbb25b4ff412a49c732db2c8abc1b8581bd710dd Winners alice, bob Alternate carol ``` ## Facts - SHA-256 is specified in FIPS 180-4 and HMAC in RFC 2104; browsers run both through the Web Crypto API. - Instagram's promotion guidelines require official rules that release Instagram and say Instagram doesn't sponsor or run the promotion, and forbid encouraging inaccurate tagging (Instagram Help Center, checked 2026-10-21). - The page takes up to 50,000 comments and CSV files up to 5 MB. The API takes JSON bodies up to 128 KB. ## How to use 1. Before you announce the giveaway, open "Before you announce", generate a seed and keep it private. Paste the fingerprint line into your giveaway post. 2. When entries close, copy the comments from the post (one per line, starting with the username) or upload a CSV export and pick the username and comment columns. 3. Paste your seed, set the filters (one entry per person, keywords, @mentions, usernames to leave out) and the number of winners and alternates, then select Draw winners. 4. Publish the results block with the seed, and the entrant list, so entrants can re-run the draw in "Verify a draw". ## FAQ ### How does verification work? The draw is fixed by two things: the seed and the entrant list. In "Verify a draw", anyone pastes the published list and seed, and the picker re-runs the same steps. It shows a check mark when the seed matches the fingerprint from the giveaway post, and when the winners match the ones you announced. ### Why publish the fingerprint before the giveaway starts? The fingerprint is the SHA-256 hash of your secret seed. Publishing it first locks the seed in: you can't find a seed that gives the same fingerprint, so you can't pick a different seed after seeing who entered. Once you publish the seed after the draw, anyone can hash it and compare. ### Can I re-roll the draw? Yes, before you publish the fingerprint: make a new seed. After that the seed is fixed and the same list always gives the same winners. If you must draw again, announce it with a new fingerprint first. ### Are my comments uploaded anywhere? No. The picker runs in your browser. Pasted comments and CSV files are read on your device and nothing is sent to PostBoost. ### Does it work with Instagram, TikTok, YouTube and Facebook comments? Yes, with any comments you can copy or export. The picker doesn't log in to your accounts or fetch comments from a post link, so it has no 100-comment cap and needs no Instagram login. It takes up to 50,000 comments on the page. ### What are Instagram's rules for giveaways? Instagram's promotion guidelines say you must not tag content inaccurately or ask people to tag themselves in content they aren't in. Your official rules must release Instagram and say the promotion is not sponsored, endorsed or run by Instagram. You are responsible for running the promotion lawfully. ### Can I run the draw from code? Yes. The same draw is in the free PostBoost API (pickGiveawayWinners), the SDKs and the MCP server, with the same results for the same input. API requests are capped at 128 KB, so send big lists from the page. ## Related - [Engagement rate calculator for Instagram, TikTok and LinkedIn](https://postboost.co/tools/engagement-rate-calculator): Calculate engagement rate by followers, reach or impressions, for one post or several. See the formula with your own numbers. Free, in your browser. - [Instagram caption generator](https://postboost.co/tools/instagram-caption-generator): Write Instagram captions faster with a simple caption formula, 10 ready templates and, when on, three AI caption drafts for your post. Free. - [QR code generator with UTM tags](https://postboost.co/tools/qr-code-generator): Make a QR code for any link or text, add UTM tags so scans show up in analytics, and download it as SVG or PNG. Free, no signup, no expiry. - [Engagement Rate by Reach vs Followers: Which to Use](https://postboost.co/learn/engagement-rate-reach-vs-followers): Engagement rate by reach or by followers? See what each method answers, worked examples with the same posts, the multi-post trap and how to report it. - [Analytics](https://postboost.co/features/analytics): Account and post analytics for your social accounts in one place, and reports you can download as CSV or a branded PDF. Last verified: 2026-10-21 ## Sources - [Instagram Help Center: promotion guidelines](https://www.facebook.com/help/instagram/179379842258600) - [RFC 2104: HMAC, keyed-hashing for message authentication](https://www.rfc-editor.org/rfc/rfc2104) - [FIPS 180-4: Secure Hash Standard (SHA-256)](https://csrc.nist.gov/pubs/fips/180-4/upd1/final) Canonical: https://postboost.co/tools/giveaway-comment-picker