What “dropping a hash” means
“Dropping a hash” is a long-standing practice among security researchers to demonstrate you knew something at a given point in time without revealing it until a later date. In April 2020, Patrick McKenzie (@patio11) wrote Dropping hashes: an idiom used to demonstrate provenance of documents, a clear introduction on the topic.
A hash is a fingerprint of a piece of text, without a practical way to reverse engineer the original text. The same text will always give you the same fingerprint, change one character and you get a different hash. First, you publish only the hash. After the event happens, publish the text and anyone can run it through the hash function to check whether it matches the original fingerprint.
In March 2020, McKenzie wrote a memo explaining Japan had a widespread covid epidemic, much larger than what official accounts showed at the time. To avoid panic while still proving what he knew beforehand, he published a string of 128 characters.
A month later, Japan was in a state of emergency and Patrick could post a follow-up proving it had been possible to foresee the events that transpired. Anyone could hash the memo and see it matched the string he tweeted on March 22: it was the same document.
Why we’re doing it
A public track record builds trust in our predictions. Last week, we discussed our forecasts for the Brazilian Presidential election on Substack. Mantic predicted Lula would receive 45.12% of the first-round vote, and he got 45.16%. That kind of after-the-fact publishing can only bring so much credibility. Cherry-picking is a fair concern: we make thousands of forecasts, and we can choose which ones to write about.
One solution would be to publish all of our forecasts publicly before events happen. But that erodes the value we provide our customers.
We believe that posting hashed predictions that we can later reveal allows us to establish a track record without this compromise. We’ll select forecasts we’re committed to sharing publicly and post their hashes. Anyone will then be able to monitor our track record with confidence.
What it would have looked like for the first round of the Brazil election
Early on the morning of October 4, before polls opened, our forecast for Lula’s share of the valid vote had a median of 45.17%, and an 80% chance of landing between 42.67% and 47.64%. We would have written it as one line, with a label, the date, the forecast and a random string at the end:
Lula first-round vote share, Brazil 2026|2026-10-04|median 45.17% (80%: 42.67 to 47.64)|8e8e7dad1d4e0e1d0da204e86a758d3dThen, we would have published this hash on X:
65a8a8ffca64af9700897ae52b23078027f49507e5d3cacd7a7591926b41b574After the count, we would have revealed the original text and anyone would then be able to verify that hash was a match.
How our version differs from Patrick’s
We add a random string so that outsiders can't reverse engineer our forecasts with brute force. Patrick hashed a whole memo, which nobody could guess. We only publish a single line, and without the random string, someone could quickly hash every plausible forecast and find the one that matches.
We will also number our drops and reveal every one, so we can’t hide the ones which scored badly. If you see #4 and #6, you’ll know #5 is missing. If we posted ten versions of a forecast, all of them would be numbered, and we would have to reveal all ten.
Our first drop: Brazil’s runoff
Brazil votes again on 25 October, Lula against Flávio Bolsonaro. Here is our first hash:
#1 · The winner of the 2026 Brazilian presidential election
d7c1d93f11a5a02387ae595535928f4bee7ca37d0e735595e118222c50fd38cb
We’ll reveal it after the result.
How to verify the hashes yourself
Once a forecast is revealed, we will post the full line we hashed. To check it, you can simply run the line through SHA-256 and compare the result with the initial hash. This will confirm the forecast is the one we committed to; if even one character differs, the hash will be different.
macOS:
printf '%s' 'Lula first-round vote share, Brazil 2026|2026-10-04|median 45.2% (80%: 42.7 to 47.6)|8e8e7dad1d4e0e1d0da204e86a758d3d' | shasum -a 256Linux:
printf '%s' 'Lula first-round vote share, Brazil 2026|2026-10-04|median 45.2% (80%: 42.7 to 47.6)|8e8e7dad1d4e0e1d0da204e86a758d3d' | sha256sumWindows (PowerShell 7; in 5.1, replace ::HashData( with ::Create().ComputeHash( ):
$s = 'Lula first-round vote share, Brazil 2026|2026-10-04|median 45.2% (80%: 42.7 to 47.6)|8e8e7dad1d4e0e1d0da204e86a758d3d'
-join ([Security.Cryptography.SHA256]::HashData([Text.Encoding]::UTF8.GetBytes($s)) | % { $_.ToString('x2') })