How to Use This Tool
Paste a list and draw. The shuffle is Fisher-Yates using the browser's cryptographic random source, and you can measure the alternative for yourself at the bottom of the page.
Why the one-line shuffle is broken
The most-copied shuffle in JavaScript is array.sort(() => Math.random() - 0.5). It is
short, it looks obviously fair, and it produces a measurably skewed distribution.
The reason is that sorting algorithms rely on the comparator being consistent — if a is less than b and b is less than c, then a must be less than c. A random comparator breaks that promise, so the algorithm's internal decisions no longer mean anything and the final order depends on the implementation's traversal order rather than on chance.
The measured result on four items: the first element stays in position about 36% of the time instead of 25%, and lands in the middle two positions only about 16% each. That is not a rounding artefact. Run the comparison below and watch it appear.
What Fisher-Yates does instead
Walk backwards through the array. At each position, pick a random index from the part not yet fixed and swap. Every one of the possible orderings comes out with equal probability, and it takes one pass.
It has been the correct answer since 1938 and it is four lines long. The only reason the broken version persists is that it fits on one.
Math.random is not secure
It is a pseudo-random generator: a deterministic algorithm producing a sequence that looks random. For a game, an animation or picking a placeholder, that is entirely fine.
It is not fine when someone has a reason to game the result. The sequence is predictable in principle
from enough observed output, and browsers make no promises about it. This tool uses
crypto.getRandomValues, which draws on the operating system's entropy pool, because a prize
draw is exactly the case where the difference matters and it costs nothing.
Drawing more than one winner
With "no repeats" on, the list is shuffled and the first few are taken, which is the correct way to draw several distinct winners. Without it, each draw is independent and the same name can come up twice — which is what you want for dice or simulated trials and not what you want for a raffle.
If it needs to be provably fair
For anything with real value at stake, a tool on a web page is the wrong instrument — not because the arithmetic is wrong, but because nobody can verify what happened. The usual answer is to publish the list and a commitment in advance, then draw using a public source of randomness that nobody controls, so participants can check afterwards. That is a different problem from generating a good random number, and it is the one that matters when people care about the outcome.
