An online Secret Santa generator, without accounts or email addresses
Type the names, set your rules, and get one sealed link per person to send however you already talk to them. Server-backed tools ask you to trust that their database won't show the organizer. We don't have a database. That difference is checkable: turn off your wifi and the draw still works.
No account. No email addresses — not yours, not your friends'.
People—RulesnonePossible draws—Method—Sealed withlink keyNetwork since first name—
Someone handed you this draw to run. Their names and rules are loaded below — check them, then seal.
One name per line. Add a hint after a vertical bar and whoever draws that person sees it — you typed it, so you can see it too. The pairing is the secret, not the wish list.
Households and couples
Nobody gives to anyone they live with. One household per row, names separated by commas. A household can never be more than half the group.
Blocked pairings
Usually last year's result. Tick “both ways” to block it in both directions.
Send everyone this line: “Open sealeddraw.com/code/ on your own phone, keep the link it gives you, and send me the SD1- code.” Paste each code below. A participant who loses their keep link cannot be recovered — they need a fresh code and a fresh link from you.
0 of 160 bytes per link
With this few people, anyone who opens their own link can work out most of the others. That's a property of the maths, not of us.
A draw from this tab is still here. Your sealed links survived the reload; the pairings did not, so drop-out repair is no longer available for it.
Draw ID —. It tells a participant that two links came from the same run, so “any link showing this ID is dead” is unambiguous after a redraw. It does not prove the draw was fair, does not prove nobody looked, and anyone who can make a link can make one bearing it.
Take a copy before the list appears. There is no server holding these links, so if this tab goes away before you have them, the draw is gone and there is no repair.
Each row shows a masked link and a four-character fingerprint, so you can tell rows apart without the screen ever naming who a link is for. Nothing here shows who drew whom.
Someone dropped out
While this tab is open the page can repair it: whoever was giving to them takes their recipient instead, and exactly one link is re-sealed. No participant learns anything — but you will see which row changed, so you will know who was giving to the person who left. That is one pairing, disclosed to you, and it is the price of fixing this with one message instead of resending every link. If you would rather not know, seal the draw again from scratch and tell everyone the old links are dead. Close the tab and this repair is gone.
Fold-over slips print the whole draw — name outside, assignment below the fold. Whoever collects them from the printer can read every one, and so can you. That is the cost of paper, and it is the only thing here that puts the pairings on a surface.
This page holds the draw in memory until you close it, so it can repair a drop-out for you. It never displays it, never writes it down, and never sends it anywhere. Close the tab and it is gone. Your sealed links and the names they are for are kept in this tab until you close it, and never sent anywhere — that is what “Forget this draw” clears.
Let someone else run the draw
The honest way to keep the organizer out of it without any cryptography: hand the whole thing to someone who isn't playing. This makes a link carrying your names, your rules and any hints you typed — never a pairing, because there isn't one yet — for them to open and draw from. Whoever holds that link reads all of it, so send it to your delegate and nobody else.
The precondition is real: your delegate has to be able to message everyone, and in a family draw a spouse is usually a participant.
How this generator works
You type names; nothing is transmitted by this site. The whole draw runs with your wifi switched off. Your browser builds a table of who may give to whom — self-draws removed always, households and blocked pairings removed by your rules — then draws a uniform random derangement: a pairing where everyone gives once, receives once, and nobody draws themselves. It shuffles with your browser's cryptographic random number generator, checks the result against every rule, and throws the whole shuffle away if anything breaks. Conditioning a uniform distribution on a rule leaves it uniform over whatever survives, so the draw you keep is exactly uniform over the draws your rules allow. There is no seed, deliberately: a printed seed plus your name list would reconstruct the entire draw.
Each result is then sealed on its own. The opener's name, who they drew, your event label and note, and any hint are packed into a fixed-length block, encrypted with a fresh key made for that one link, and written into the part of a URL after the #. Browsers never send that part to a web server, so it is not in our logs, not in our host's logs, and not in a chat app's link-preview fetch. Every link in a draw is padded to the same length, which is not tidiness: otherwise a link's length would give away the length of the recipient's name, and on a twelve-name roster that alone narrows 176,214,841 possible draws to a few hundred with nothing opened.
Where it stops, stated because the tool reports it rather than hiding it. Exclusions can make a draw impossible, and the readout says so before you press anything — a household can never be more than half the group, because everyone in it gives to someone outside it. On very tightly constrained lists shuffle-and-reject would run impractically long, so after twenty thousand attempts the tool builds one valid pairing directly and randomises it with swaps. That output obeys every rule, but we cannot prove it gives every valid draw an even chance, so the readout says constrained rather than uniform — the only place either word means anything. And uniform across whole draws is not the same as every person being equally likely to draw every other: lopsided rules skew those odds, and no draw method can undo that.
Frequently asked questions
Can the organizer see who drew whom?
In a Quick draw, this tool has no screen, button, or export anywhere that shows the organizer who drew whom, and there is no database that could. What we won't claim is that the organizer can't look. They hand out every link, so they could open one — deliberately, one person at a time, past a screen with someone else's name on it. A sealed envelope, not a vault: it stops accidents and stops a glance, and it does not stop the person carrying it. If that matters, use a Locked draw — sealed to a key the recipient's own device made — or hand the draw to someone who isn't playing.
Do I need everyone's email address?
No, and there is nowhere to put one. You type names, the browser draws, and you get one sealed link per person to send however you already talk to them. Every server-backed alternative collects addresses because it has to: something has to do the sending. We don't send anything, so we never ask. The trade is printed on the page: 25 people means 25 separate messages.
What happens if someone loses their link?
While the draw tab is still open, the page can re-seal that one person's link without touching anyone else's. Once you close the tab that repair is gone, so keep the copy the tool makes you take. If it is already too late, the cheapest fix is a redraw: one announcement, a new draw ID, and nobody has to admit who they had.
Can I stop couples from drawing each other?
Yes. Add a household for anyone who lives together and nobody in it draws anyone else in it, in either direction. You can also block one specific pairing, in one direction or both, which is how most people record last year's result. The readout tells you before you press anything whether your rules still leave a draw possible, and if they don't it names the rule that broke it rather than just refusing.
Is the draw actually random?
It is uniformly random over every assignment your rules allow: all 1,334,961 possibilities for ten people with no exclusions are equally likely. The party shortcut of shuffling everyone into a circle is not — it can never produce a draw where two people simply swap. The readout prints which method produced your result and how many shuffles it took, and the maths and its test suite are published.
Sealed Draw