An online Secret Santa generator, without accounts or email addresses
Type the names, set your rules, and get one sealed link per person to send however you already talk to them. There is no database behind the page, and you can check: turn off your wifi and the draw still works.
The generator needs no account and no email addresses, yours or your friends'.
People—RulesnonePossible draws—Method—Sealed withlink keyNetwork since first name—
Someone handed you this draw to run. Their names and rules are loaded below; check them, then seal.
One name per line, or paste a messier list: commas, semicolons, "Name <email>" and "Name - partner" all parse. Add a hint after a vertical bar and whoever draws that person sees it. You typed the hints, so you can see them too.
Households and couples
Nobody gives to anyone they live with. One household per row, names separated by commas. A household can never be more than half the group.
Blocked pairings
Usually last year's result. Tick “both ways” to block it in both directions.
Send everyone this line: “Open sealeddraw.com/code/ on your own phone, keep the link it gives you, and send me the SD1- code.” Paste each code below. A lost keep link cannot be recovered: that person makes a fresh code, and you seal the draw again, which gives everyone new links.
Both optional. They appear on each participant's event card and set the "Add to calendar" reminders.
0 of 160 bytes per link
With this few people, anyone who opens their own link can work out most of the others.
A draw from this tab is still here. Your sealed links survived the reload; the pairings did not, so drop-out repair is no longer available for it.
Draw ID —. It tells a participant that two links came from the same run, so after a redraw “any link showing this ID is dead” is clear. It does not prove the draw was fair or that nobody looked, and anyone who can make a link can put this ID on one.
Save the list before you start sending. There is no server holding these links, so if this tab goes away before you save them somewhere durable, the draw is gone and there is no repair.
Each row shows a masked link and a four-character fingerprint, so you can tell rows apart without the screen ever naming who a link is for. Nothing here shows who drew whom.
Sent checkmarks are manual and stay only in this tab. Copying or opening Share never marks a row for you; use Mark sent only after you finish sending it.
Someone dropped out
While this tab is open the page can repair it: whoever was giving to them takes their recipient, and exactly one link is re-sealed. No participant learns anything, but you will see which row changed, so you will know who was giving to the person who left. That one pairing is what it costs to fix this with a single message. If you would rather not know, seal the draw again from scratch and tell everyone the old links are dead. Close the tab and this repair is gone.
Fold-over slips print the whole draw: name outside, assignment below the fold. Whoever collects them from the printer can read every one, and so can you. It is the only thing here that puts the pairings on a surface.
This page holds the draw in memory until you close it, so it can repair a drop-out for you. It never displays it, never writes it down, and never sends it anywhere. Close the tab and it is gone. Your sealed links and the names they are for are kept in this tab until you close it, and never sent anywhere; “Forget this draw” clears them.
Let someone else run the draw
To keep the organizer out of it without any cryptography, hand the whole thing to someone who isn't playing. This makes a link carrying your names, your rules and any hints you typed, for them to open and draw from. It holds no pairing, because none exists yet. Whoever holds that link can read all of it, so send it to your delegate and nobody else.
Your delegate has to be able to message everyone, and in a family draw a spouse is usually a participant.
How this generator works
Nothing you type is transmitted by this site, and the whole draw runs with your wifi switched off. Your browser builds a table of who may give to whom. Self-draws are always removed, and households and blocked pairings are removed by your rules. Then it draws a uniform random derangement: a pairing where everyone gives once, receives once, and nobody draws themselves. It shuffles with your browser's cryptographic random number generator, checks the result against every rule, and throws the whole shuffle away if anything breaks. Conditioning a uniform distribution on a rule leaves it uniform over whatever survives, so the draw you keep is exactly uniform over the draws your rules allow. There is no seed, because a printed seed plus your name list would reconstruct the entire draw.
Each result is then sealed on its own. The opener's name, who they drew, your event label and note, and any hint are packed into a fixed-length block, encrypted with a fresh key made for that one link, and written into the part of a URL after the #. Browsers never send that part to a web server, so it stays out of our logs, our host's logs and a chat app's link-preview fetch. Every link in a draw is padded to the same length. Without that, a link's length would give away the length of the recipient's name, and on a twelve-name roster that alone narrows 176,214,841 possible draws to a few hundred with nothing opened.
Exclusions can make a draw impossible, and the readout says so before you press anything. A household can never be more than half the group, because everyone in it gives to someone outside it. On very tightly constrained lists shuffle-and-reject would run impractically long, so after twenty thousand attempts the tool builds one valid pairing directly and randomises it with swaps. That output obeys every rule, but it is not proven to give every valid draw an even chance, so the readout labels it constrained; a shuffled draw is labelled uniform. Even a uniform draw leaves some people likelier to draw certain others when the rules are lopsided, and no draw method can undo that.
Frequently asked questions
Can the organizer see who drew whom?
Yes, if they go looking. The send list never shows who drew whom, and there is no database that could. But printing fold-over slips puts every pairing on paper, repairing a drop-out shows the organizer one pairing, and an organizer with developer tools can read the draw while its tab is open. In a Quick draw the organizer can also open any link they hand out, one person at a time, past a screen with someone else's name on it. A Locked draw seals each link to a key the recipient's own device made, so the organizer cannot open it. If the organizer should not know at all, let someone who isn't playing run the draw.
Do I need everyone's email address?
No, and there is nowhere to put one. You type names, the browser draws, and you get one sealed link per person to send however you already talk to them. The site sends nothing, so it never asks for an address. The cost is one message per person: 25 people means 25 separate messages.
What happens if someone loses their link?
Send them the same link again. While the draw tab is open, copy it from their row in the send list; after that, use the copy the tool made you save before sending. If that copy is gone too, the cheapest fix is a redraw: one announcement, a new draw ID, and nobody has to admit who they had. In a Locked draw, someone who lost their keep link makes a fresh code, and then you redraw.
Can I stop couples from drawing each other?
Yes. Add a household for anyone who lives together, and nobody in it draws anyone else in it, in either direction. You can also block one specific pairing, in one direction or both, which is how most people record last year's result. Before you press anything, the readout tells you whether your rules still leave a draw possible, and if they don't, it names the person or rule in the way.
Is the draw actually random?
Yes. It is uniformly random over every assignment your rules allow: all 1,334,961 possibilities for ten people with no exclusions are equally likely. The party shortcut, shuffling everyone into one circle, is not uniform: it can never produce a draw where two people simply swap. The readout prints which method produced your result and how many shuffles it took, and the maths and its test suite are published.
Sealed Draw