Verify it yourself
The verify page runs in your browser, which is convenient but still our page. Here is how to check a draw without running any of our code at all.
Every completed draw offers a verification package: a single archive containing the entry list, the receipt, the beacon round and the timestamp token. Everything below works on that archive, offline, with tools you already have.
1. Confirm the entry list is the one that was sealed
sha256sum entries.csv
Compare it to snapshot.sha256 in the package and to the fingerprint printed on the draw
page. All three must be identical. If they are, the list you are holding is the list that was drawn
from.
2. Confirm the seal predates the randomness
openssl ts -verify -in anchor.tsr -data snapshot.sha256 \ -CAfile tsa-chain.pem
This prints the time the fingerprint was certified, signed by a timestamping authority with no relationship to us. Check it falls before the beacon round's own timestamp. That ordering is the whole argument: the list was fixed before the number existed.
3. Fetch the randomness from drand, not from us
curl https://api.drand.sh/52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971/public/<round>
The round number is on the draw page. Compare the randomness field to the value in the
receipt. If they differ, the draw used something other than what it claimed.
4. Recompute the winner
The receipt names its algorithm version and every parameter. The derivation is HKDF-SHA256 over the beacon randomness and the snapshot fingerprint, then an HMAC-SHA256 counter stream with rejection sampling — never a modulo, because modulo over a range that does not divide evenly quietly favours the low numbers.
The package includes a self-contained verifier script and published test vectors, so you can confirm your implementation agrees with ours on known inputs before trusting it on a real draw.
If all four agree, the result is what it claims to be — and you established that using drand's servers, a timestamping authority's certificate and your own shell. Our involvement was limited to handing you a zip file.
Where it disagrees
Tell us, publicly. A recomputation that contradicts a published result governs over the published result — that is written into the operator's terms, not just this page. There is no version of this where we get to explain why the arithmetic is wrong.