Sealed DrawLocked draw · step one
Make your code
Your organizer is running a Locked draw. This page makes a key pair on this device. Send your organizer the short code and keep the link yourself. The envelope they then send you is sealed to your key, so they cannot open it.
What this page does
Your browser makes an elliptic-curve key pair, P-256, with its own Web Crypto implementation, which this site did not write. The public half becomes the short code you send your organizer. The private half goes into the part of a URL after the #, which browsers never send to a web server, and that URL is your keep link. This site transmits nothing you see on this page: the key is made here, shown here, and goes only where you paste it.
Your organizer can still learn pairings in other ways. The draw runs in their browser and stays in that tab's memory until they close it, so with developer tools they can read it. Printed fold-over slips show every pairing, and a drop-out repair shows them one. If your group would rather no player had that access, the organizer can hand the draw to someone who isn't playing.
The keep link has no passphrase. Locking the private key with one and handing the locked copy to the organizer would give the one person this mode keeps out a permanent target for offline password guessing, and the page would have to print a strength estimate it cannot compute reliably. A keep link is one more message in the thread your sealed link will arrive in, so keeping it safe means looking after that message, which you can see and manage. With a passphrase, your envelope would only be as safe as your passphrase is hard to guess.