How verification works

Most wheel sites ask you to trust them. SpinProof gives you a way to check. Every result is fixed and sealed before the wheel turns, and the proof page lets anyone repeat the calculation.

The short version

1. You press Spin. Our server freezes your entries and creates a random secret.
2. The server sends your browser a lock: a fingerprint of the secret. The lock is shown on screen while the wheel turns.
3. The secret decides the winner. After the spin, the secret is revealed.
4. Anyone can check that the revealed secret matches the lock and that it picks exactly that winner.

Because the lock exists before the result is shown, the secret cannot be swapped afterwards for one that picks a different winner. This technique is called commit and reveal.

The exact maths

Every step uses SHA-256, a standard hash function that any programming language and many online tools can compute.

• Fingerprint = SHA-256 of all entries joined with a line break, in wheel order.
• Secret = 32 random bytes from a cryptographic random number generator, written as 64 lowercase hex characters.
• Lock = SHA-256 of those 64 characters.
• Winner j (counting from 0): take SHA-256 of secret:fingerprint:j, read its first 12 hex characters as a number, and divide by the number of entries still in the draw. The remainder is the position of the winner among the remaining entries, counting from 0. That entry then leaves the draw before the next winner is picked.

The proof page runs these steps in your own browser when you press Check this result. It does not ask our server whether the result is right.

Re-spins are visible

A lock stops a result from being changed, but someone could spin many times and only show the result they like. To prevent that, every spin is saved on our server with a number, and each proof page lists all spins of the same wheel. "Spin 1 of 1" means there was exactly one spin.

Visitors who spin a wheel someone shared get their own copy, so they cannot add spins to the owner's history.

Results nobody revealed

If a host locks a spin and closes the page before the reveal, the proof page reveals the result automatically five minutes after it was locked. A result cannot be locked and then hidden.

Privacy

Entries are saved with the spin so the result can be checked later. On public proof pages they are partly hidden, like A•••a, unless the host chooses to show them in full. Winners are always shown.

When names are hidden, visitors can still check the lock and the winners against the fingerprint. Checking that the list itself was complete needs the full names.

What SpinProof does not claim

SpinProof proves that a result was fixed before the spin and was not changed afterwards. It cannot prove that the host entered everyone who should have been in the draw, so for giveaways it helps to show the full list. Our server creates the secret; a later version will also mix in public randomness from the drand network so that not even SpinProof could predict a result.

Try the giveaway picker