Checking The Count

You shouldn't have to take RCV Lab's word for it. Once a contest closes, there are three independent ways to check the result: confirm your own ballot was counted as you cast it, download every ballot and count them yourself, or have a separately-written certified tabulator count them and compare.

None of the three requires trusting this site, at least if you believe our copy of RCTab is legitimate.

Your receipt

When you submit, the server computes a SHA-256 hash of your ballot's contents together with a random salt, and that hash — 64 hex characters — is your receipt. The salt (a random number used to help create the hash) is stored alongside your ballot.

The receipt on its own reveals nothing about how you voted; a hash can't be run backwards.

Once the election closes, every ballot is published with its contents and its salt. Your browser then recomputes the hash from the published ballot and compares it with your receipt. If they match, that published ballot is yours, unaltered — and it's in the set that was counted. If even one ranking had been changed, the hash wouldn't match.

The verification table does this for every ballot on the page and shows you the result, so you can confirm both that your ballot is right and that everyone else's checks out too. Paste your receipt into the find box and it will highlight yours.

Two details that make this more than a gesture:

The published list is shuffled. Ballots are not published in the order they were cast, so nobody can work out who voted when — or match the third ballot to the third person through the door.

The organizer can't read your ballot while voting is open — though they can watch the totals. While voting is open there is no public list at all. Only the organizer can see the arriving ballots, and that view is served with every ranking stripped out — it shows how many ballots have arrived, not what is on them. But the organizer can tabulate preliminary results at any time, and it is worth being honest about what that means in a small election: totals that update one ballot at a time can suggest how the newest voter voted, and an organizer using emailed one-time links also knows who has voted so far. This is the same property as any ballot box that is tallied while voting continues — the individual ballots stay sealed, and the running count still tells a story. The ballots are published once, when the election closes: full rankings, shuffled order, no longer private.

The cast vote records

The verification table proves your own ballot is right. The cast vote records let you check the arithmetic on everyone's.

From the closed election's page, Show Cast Vote Records lists every ballot, and Download CVR gives you the whole set as a CSV — one row per ballot, one column per candidate, holding the ranks that voter gave. It's one of the formats the tabulators read, so you can feed it straight back into this site's Analysis page, or into another ranked-choice tabulator, and see whether you get the published result.

The file contains rankings and nothing else. There are no names, no email addresses, and no timestamps, and the rows are in the shuffled published order rather than the order votes arrived.

Who can get it depends on how the election was run. A fully open election publishes its records to anyone. An election run with voter links or restricted access requires a participant credential — a voting link or a receipt — because the full set of ballots is exactly what such an election shouldn't be handing to outsiders.

Cross-checking with RCTab

Counting the ballots yourself catches arithmetic errors, but it can't catch a bug in this site's tabulator — you'd be re-running the same code that produced the result.

So we have a copy of RCTab available to count for you, that we set up as an online service. RCTab is a tabulator used for some official ranked-choice elections in the United States, written by a different team, tested and certified independently of anything here.

There are two ways to run this cross-check. The organizer's Results page offers a per-contest button to tabulate through RCTab. But you don't have to be the organizer: anyone who has the ballots can run the same check on the Analysis page — load a cast vote record file, like the one downloaded as described above, choose RCTab Server as the tabulator, and compare the two results side by side.

Either way, the option appears only when the contest's rules are ones RCTab can express. Some of the options here have no RCTab equivalent — most notably equal ranking, which RCTab treats as a spoiled rank rather than a split vote. Rather than quietly hand RCTab a config that means something different and present the disagreement as a cross-check, the option is simply not offered for those contests. A comparison that isn't comparing the same rules is worse than none.