Every random picker asks the same underlying question: why should you believe the result was actually random? Most tools answer with a shrug — a spinning animation and a request for blind trust. In 2022, a popular classroom wheel was caught letting teachers silently re-roll until they liked the outcome; in 2024, a giveaway spinner was shown to weight entries by engagement. Trust-based randomness has a track record, and it isn't good.
Lineupdraw is built on the opposite principle: a draw you cannot verify is a draw you should not trust. This guide publishes the entire method. If any part of it stops being true, this page is wrong — and you can prove it.
01 Where the randomness comes from
When you press the draw button, your browser generates a seed using its cryptographic random source (crypto.getRandomValues). This happens on your device, not on our server. We never see the seed before you do, which means we cannot pre-compute it, bias it, or re-roll it behind your back. If you are offline, the draw still works — there is no server in the loop at all.
02 The shuffle is published, deterministic math
The seed feeds a seeded pseudo-random number generator (an xmur3 hash into a mulberry32 stream), and that stream drives a Fisher–Yates shuffle. This is standard, well-studied computer science — the same shuffle family used in card games and lotteries. Because the stream is fully determined by the seed, the same seed over the same list always produces the same result, on any device, forever. That determinism is the whole point: it turns "trust us" into "check it yourself".
Seeded PRNGs are reproducible, not cryptographic. A truly adversarial setting (someone choosing seeds to engineer outcomes) needs a commitment scheme — we describe exactly that trade-off below, and our receipts are designed so we never choose the seed: your browser does, in front of you.
03 Every draw ships with a receipt
Each result includes a copyable receipt: the seed, the mode, the full result, and a checksum of the receipt text. Paste a receipt next to a recorded spin and anyone can confirm the draw matches what was promised — days or weeks later. This is what makes lineupdraw usable for contested situations: fantasy draft order, classroom participation audits, giveaway outcomes.
| Claim | How it's guaranteed | Can we cheat it? |
|---|---|---|
| The seed is random | crypto.getRandomValues, in your browser | No — we never see it first |
| The result follows the seed | xmur3 → mulberry32 → Fisher–Yates, published here | Any deviation is reproducible proof of cheating |
| No silent re-rolls | Redraw always creates a visibly new seed | Old seeds keep working — a re-roll can't erase history |
| Nothing leaves your device | No analytics on draw events; state in localStorage | There is no server call to intercept |
04 What this does not protect against
Verifiability proves a draw matched its seed; it cannot prove you typed the list you claimed. If a teacher secretly removes a student's name from the roster before drawing, the draw is still "fair" relative to the list. That is why the share link encodes the roster itself — for high-stakes draws, share the link, not a screenshot. And for commitment-grade fairness (both parties lock in before the seed exists), run the draw live in front of everyone rather than preparing it privately.
05 Verify a draw right now
Open any tool, make a draw, and copy the receipt. Then re-run the tool with the same list and enter the same seed: you will get the identical result. That one action — which takes under a minute — is the entire trust model.