How to do Secret Santa: a hat, an email generator, an app, or sealed links

The five methods, side by side

All five work. They differ in what they ask of the group, what they leave behind, and who ends up knowing something they did not need to know.

The 63% number, and why group size barely changes it

In a blind hat draw, everyone writes a name, everyone picks at the same moment, and then you check whether anybody got themselves. About 63 times in 100, somebody did, and the size of the party hardly changes that. A draw in which nobody picks their own name is called a derangement, and the share of all possible draws that qualify settles almost immediately on 1/e, about 0.368. For four people, 9 draws out of 24 work: 37.5%. For six, 265 out of 720. For ten, 1,334,961 out of 3,628,800, still 36.8%. A family of five and an office of fifty face the same odds of starting again.

The usual repair is for whoever drew themselves to swap with the person beside them. It is quick and cheerful, but the result is no longer a random draw: it now depends on who stood where, and that one pairing was settled by position. Picking one at a time with a put-it-back rule only moves the problem to the end, where the last person can be left holding their own name. If you redo the draw, redo all of it.

The generator here redoes all of it for you. It shuffles, checks the result against every rule, and discards the whole shuffle if anything breaks, until one survives. Conditioning a uniform distribution on a rule leaves it uniform over the survivors, so the draw you keep is evenly likely among all the draws your rules allow. With no exclusions that takes about 2.72 shuffles on average, and fewer than one draw in a thousand needs more than sixteen.

One party method dodges the redraw entirely: seat everyone in a random circle, each giving to the next. That is Sattolo's algorithm wearing a paper hat, and every result it produces forms a single loop. It can never produce the three four-person draws where two pairs simply swap, and its reach falls away with size: about 67% of valid draws at four people, 27% at ten, 14% at twenty.

What each method leaks, to whom, and when

Names in a hat, at a party

Leaks to nobody, provided the slips are identical, folded the same way, and the bowl is not transparent. The realistic failure is physical: a slip left face-up, or two told apart by a crease. The organizer draws with everyone else, so no privileged position exists. It is the best method here, but it needs the one thing many groups cannot arrange: everybody in a room at once.

Hat drawn over a video call

Leaks to whoever holds the bowl, at the moment they pick, because somebody has to read out what comes out. It leaks to the call as well: a recording holds the entire draw, and the calendar invite that arranged it shows every address to every guest.

Email generator site

Leaks the address list to the operator for good, the moment you paste it in. A server cannot deliver a result without an address to send it to, so this comes with the design, whatever the operator intends. The mapping is stored there too, and the features show it: a site that can resend a lost assignment can reproduce that assignment. Whether anyone looks is a matter of policy, and a policy is something you take on trust.

App with accounts

Leaks the same address list plus a durable identity per person: everyone ends up with a login they did not have, often on a reused password. In exchange the app does real work, chasing people who have not opened anything and absorbing a drop-out without you thinking about it. For a sixty-person office that can be the right trade.

Sealed links, the method here

Leaks nothing to us: nothing you type is transmitted by this site, and the whole draw runs with your wifi switched off. There is no account, no database and no server of ours for anything to sit on. Each result lives inside its own link, in the part of a URL after the #, which browsers never send to a web server. It does leak to the carrier the moment you press send, because Slack, Gmail or WhatsApp stores that message like any other. And in a Quick draw the key rides inside each link, so anyone holding a link can open it. That includes the organizer, who hands out every one and could open them on purpose, one person at a time, past a screen with someone else's name on it.

What is still there in February

By February the exchange is over, but whatever each method created in December is still where it was left.

The paper draw leaves a folded slip in a coat pocket. The video call leaves a recording and a chat log. The generator site leaves a database row per participant per draw, a copy of the assignment email in every mailbox for as long as people keep mail, and often a seasonal mailing list nobody consciously joined. The app leaves an account per person, which lasts longest of all, since accounts outlive the group and take a support request to remove.

Sealed links leave the messages you sent, in the threads you sent them in, held by whoever runs those threads, plus the link list the generator had you save before sending. There is no row, no account, no address book, and nothing on our side to delete, because none of it was created.

Choosing, and what this method costs you

If everyone will be in one room, use paper: identical slips, the organizer draws too, and if anybody draws themselves, redo the whole draw. If the group is remote, use sealed links. If it is a large workplace that needs reminders, wish lists and somebody chased on the 18th, an app will do that work, and everyone gets an account out of it.

What sealed links cost you: twenty-five people means twenty-five separate messages, and you send every one yourself. There is no send button, because there is no server to send from. A Locked draw seals each assignment to a key the participant's own device made and sent to nobody, so the organizer holds envelopes they cannot open. In both modes the organizer can still learn pairings: the draw runs in their browser and stays in that tab's memory until it is closed, so developer tools can read it; printing fold-over slips puts every pairing on paper; and repairing a drop-out shows them one. If you would rather nobody had that access, hand the draw to someone who is not playing.

In a very small group the maths gives the game away, whichever method you use. With three people there are only two possible draws, so anyone who sees their own result knows the other two.