Verifiable random number generation

Every random number generator asks you to take its word for it: the numbers arrive from a server, and there is no way from the outside to tell that they were not picked in advance.

Verifiable generation is built so that trust is not required. The numbers are computed from a value that did not exist for anyone at the moment of the request, us included — and once it appears, it is published by a network independent of the service, so anyone can repeat the computation.

How it works

1. The conditions are fixed and published

At the moment of the request the site records the conditions of the generation — the range, how many numbers, whether repeats are allowed — and the number of a future beacon round. The protocol page opens right away, still without the numbers: they do not exist yet, and the link can already be handed to the participants.

2. The site waits for the round

The round is taken 6–9 seconds ahead, and until it is published its value is unknown to everyone — to the participants, to us, and to the network itself. That wait is the whole point of the mode: the conditions are recorded before the value the numbers come from ever exists.

3. The numbers are computed from the round value

Once the round is published, the numbers follow from its value and the recorded conditions through an open algorithm. The computation is deterministic: the same inputs always give the same result, so anybody can repeat it.

What drand is

drand is a public source of randomness: every 3 seconds the network publishes a new random number, a "round". Rounds are numbered and stay available forever, so the number alone pins down both the moment of publication and the value — it can be worked out without asking anyone.

The value is produced not by one server but by a group of independent organisations from different countries — the League of Entropy. Members include Cloudflare, Protocol Labs, EPFL, Kudelski Security, the University of Chile and others; Cloudflare, for one, draws its share of randomness from a wall of lava lamps in its office. Each contributes a share, and the number appears only when enough of them agree: no single participant can learn the value in advance or substitute it.

Every round is signed with the group's shared key, so the authenticity of a value is checked mathematically. More on the project site: drand.love.

How to check the result

The protocol page has a "Verify it yourself" button. The check runs right in your browser: the round is fetched straight from drand relays, bypassing our server, the value is matched against its signature, and the numbers are recomputed from scratch. Every step is shown with its inputs, intermediate values and output.

You do not have to take that check on faith either: the same window holds ready-made Python, JavaScript and Go programs that repeat the computation without any of our code, plus a one-line shell command for the seed. The result must match down to the last number.

Who needs it

Prize draws and contests, lotteries of places and queues, sampling for audits and reviews — anything where the result concerns several parties and may be unwelcome to one of them. The protocol link can be published in advance, before the numbers exist: participants can see that the conditions were recorded before the result.

The service is not intended for lotteries or gambling, where the law requires a certified random number generator.

How to turn it on

On the generator page turn the "Authenticity check" switch on and press generate — the numbers appear a few seconds later, once the round comes out. On the site the mode is free and needs no account.

In the public API it is the source=beacon parameter: the response arrives with code 202 and without the numbers, which are then fetched with a separate request after the round is published. In the API the mode requires a plan — see the documentation.

Generate a verifiable number

Questions and answers

How is verifiable generation different from the ordinary one?
In the ordinary mode the numbers come from the server's cryptographic generator: the result is honest, but there is no way to confirm that from the outside — you are left taking the service at its word. In the verifiable mode the numbers are computed from the value of a future round of the drand public beacon: at the moment of the request that value does not exist, and once it is published anyone can take it from the network and recompute the numbers themselves.
Can the result be cherry-picked by someone who knows the algorithm?
No, and the algorithm being open is exactly what makes that so. It is deterministic: the round value plus the conditions of the generation always give the same result. Cherry-picking would require knowing the round value in advance, but the round is chosen before the network produces it, and the conditions cannot be changed afterwards — they are published before the value.
What happens if the drand network is unreachable?
The generation does not happen and the site reports an error. Falling back to the ordinary generator is not allowed: any inconvenient result could then be explained away as a network outage, and that is precisely the freedom this mode removes. The numbers appear once the round has been fetched.
Do I need a paid plan?
On the site verifiable generation is free and needs no account. In the public API it is enabled with the source=beacon parameter and is included in the plans that provide for this mode.