How the draw works

The rule

1. A draw's round is the first drand quicknet round at least 60 seconds after 18:00 UTC.
2. Check the round's signature against the quicknet public key. The randomness is the SHA-256 of the signature.
3. Take the first 32 hex characters of the randomness and group them 8-4-4-4-12.
4. Set character 13 to 4, and the first two bits of character 17 to 10, so it is 8, 9, a or b.

The rule never changes quietly. A new rule would be published with the first draw it applies to.

Worked example, Thu, 8 Oct 2026

Round

32893032, round published 18:01:00 UTC

Randomness, the first 32 marked

944653856969823bb4d8a4f325e40da20e0e287d08110f47f6bd157273ef7a2b

Grouped

94465385-6969-823b-b4d8-a4f325e40da2

13: 8 → 4, 17: b → b

94465385-6969-423b-b4d8-a4f325e40da2

Check it yourself

In a terminal (macOS, Linux):

r=$(curl -s https://api.drand.sh/52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971/public/32893032 | sed -E 's/.*"randomness":"([0-9a-f]{64})".*/\1/')
h=${r:0:32}
v=$(printf '%x' $(( (0x${h:16:1} & 3) | 8 )))
echo "${h:0:8}-${h:8:4}-4${h:13:3}-$v${h:17:3}-${h:20:12}"

And that the randomness is the hash of the signature:

printf '%s' <signature> | xxd -r -p | openssl dgst -sha256

Chain 52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971

Every ticket came in before the draw

1. At the cutoff the draw's ticket list closes: one line per ticket, its id and UUID, in UUID order. No ticket gets in after that.
2. The lines go into a Merkle tree (RFC 9162, as in Certificate Transparency). Its root goes into a short statement with the draw, its drand round and the number of tickets.
3. Two independent timestamp authorities, freeTSA.org and Certum, sign the statement (RFC 3161). A timestamp earlier than the round shows the list was fixed before anyone could know the draw.
4. Every ticket's page carries the proof that it's in the list, and anyone can recount the whole list.

For the draw of Fri 16 Oct, in a terminal with openssl and Node:

d=https://uuidlotto.com/draws/2026-10-16
v=https://uuidlotto.com/verify
curl -s -O $d/list.txt -O $d/statement.txt -O $d/freetsa.tsr -O $v/freetsa.pem -O $v/check-list.mjs
node check-list.mjs list.txt statement.txt
openssl ts -verify -in freetsa.tsr -data statement.txt -CAfile freetsa.pem
openssl ts -reply -in freetsa.tsr -text | grep 'Time stamp'

Then compare the timestamp's time with the round's time on drand.

What you take on trust

The draw and the ticket list can be proven. Who the tickets belong to can't: we could add tickets of our own before the cutoff, as anyone with a few browsers can. That gains nothing but more names in the list.

Check a draw in your browser

This runs our code in your browser, which fetches the round straight from drand and does the steps above. For a check that trusts none of our code, use the commands.