Guide · The organizer question

Secret Santa without the organizer knowing: four tests that settle it

Someone has to run the draw, and that person is usually playing in it. Four tests show how well a Secret Santa site can keep the results from its organizer. They take about two minutes and work on any site. This page runs all four on Sealed Draw as well, and our own Quick draw fails the fourth.

Tests you can run4 This site, Quick drawpasses 3 of 4 Strongest testwifi off

Run them here first, then on any other site you are thinking of using.

Open the generator and test it

Why this question keeps getting asked

The organizer collects the names, presses the button, and then spends December as the one person at the party who might already know. That comes with the job, whoever does it: organizing means handling the results, the one thing nobody wants anybody to do.

Most tools answer with a reassuring sentence near the footer, and the same sentence appears word for word on sites with completely different machinery underneath, so on its own it tells you nothing. What a site is capable of can be tested from outside, and the four tests below do that.

The four-test audit

1. Does it ask for email addresses?

Look for an email field before you read any promise. If the site sends the links, it has the addresses, and at the moment of sending it holds each address next to the assignment it is about to deliver. So a tool that emails assignments has, at least once, held the complete mapping in one place with real identities attached. Whether it keeps that mapping, and whether it ever shows it on a screen the organizer can reach, is a product decision, and product decisions can change. A tool with no addresses never has that decision to make.

2. Does it work offline?

Load the site normally, let it finish, then switch on airplane mode and run the whole draw without reloading. If it completes, the draw happened on your device, because with no network there was no server available to have done it. If it hangs or spins, the work was going somewhere else.

This is the strongest of the four, and the only one that runs outside the site's own code. Two rules keep it fair: do not reload while offline, since no ordinary page loads without a connection and that failure proves nothing; and give a site one online visit first, in case it caches something the first time.

3. Is there an admin URL?

Hunt for a “view results”, “manage draw”, or “resend links” page. Resend tells you the most. To send somebody their assignment a second time, something must still be able to reproduce that assignment, which means it is stored and can be retrieved. A manage-your-draw page is a database with a front door on it.

A stored pairing that no screen shows today can still be retrieved, which puts it one product decision away from being displayed. It is also one breach, one support ticket, one acquisition and one court order away.

4. Is the promise a policy or a property?

“We don't look at the results” is a policy. “There is nothing to look at” is a property. The two read almost identically in marketing copy and behave nothing alike. A policy is a statement about the current owner's intentions and the current staff's discipline; a property is a statement about what exists.

Only a property survives a change of owner, a breach or a subpoena, because it leaves nothing to hand over. When you read a reassuring sentence, work out which kind it is. Most are policies, and most do not say so.

The same four tests, run on this site

Emails: pass. There is no field for an address anywhere in this tool, because nothing here sends. You type names, your browser draws, and you get one sealed link per person to pass on however you already talk to them. The generator prints the cost: twenty-five people means twenty-five separate messages.

Offline: pass. Open the generator, switch your wifi off, and run a complete draw. Nothing you type is transmitted by this site, and you can check that for yourself in thirty seconds.

Admin URL: pass. There is no results page, no manage-draw page and no resend button, because there is no account and nothing stored to hang one on. The send list never shows who drew whom, and there is no database that could.

Policy or property: fail, in a Quick draw. In a Quick draw the key that opens a link travels inside the link, and the organizer hands out every link. So the organizer could open one. It would take a deliberate act, one person at a time, past a screen that names someone else before anything is revealed. Like a sealed envelope, that stops accidents and a passing glance, and it does not stop the person carrying it.

Two options if test four matters

Locked draw

Before the draw, each participant opens the key page on their own phone. Their device generates a keypair, keeps the private half in a link they save and send to nobody, and gives them a 92-character code (the public half) to send back to the organizer. The organizer pastes the codes in, and each assignment is then sealed to the matching person's key. The organizer ends up holding envelopes they cannot open.

The organizer can still learn pairings in three ways, and all three apply in both modes. The draw runs in the organizer's browser and stays in that tab's memory until the tab is closed, so developer tools can read it. Printing fold-over slips puts every pairing on paper. Repairing a drop-out shows the organizer one pairing. If you would rather nobody had that access, hand the draw to someone who is not playing.

Know the practical cost before you choose it for a group: one extra step for everyone, two extra messages per person, and a keep link that cannot be recovered if it is lost. A participant who loses theirs makes a fresh code, and you seal the draw again, which gives everyone new links.

Delegation

This is the cheapest option, and it needs no cryptography at all. The generator makes a roster link carrying your names and rules and no pairing, because none exists yet. Send it to somebody who is not in the draw and they run the whole thing; you receive a link like everyone else.

The delegate has to be able to message everyone in the group already, and that is where this usually falls down. In a family draw a spouse is normally a participant, which rules out the obvious candidate. An adult child, a colleague from another team, or a friend who is not receiving a gift can do it.

What none of this fixes

Small groups give pairings away through arithmetic alone. Three people have exactly two possible draws, so whoever reads their own link has worked out the other two. Four people have nine. Below about five participants no tool of any design can keep much hidden, and the generator says so on screen.

The audit measures what a site is capable of, and says nothing about how anyone behaves. A pass today also says nothing about next month's version of a site, so re-run test two now and then if it matters to you.

Every server-backed tool on the first page of results takes the organizer's access away by adding a company with total access: the names, the addresses, the mapping, all of it. Sealed Draw leaves the company out, and you can check that without taking our word for it. Turn off your wifi and draw.

Frequently asked questions

Can a Secret Santa draw really be run without the organizer knowing who has who?

Partly. No database here holds the mapping, and the send list never shows it. The person handing out the links can open any of them, unless each link is sealed to a key only its participant holds, which is what a Locked draw does. In both modes, fold-over slips print every pairing, a drop-out repair shows the organizer one, and developer tools can read the draw in the organizer's browser tab until it is closed.

How do I test whether a Secret Santa site does the draw on my device?

Load the page normally, let it finish, then switch on airplane mode and run a complete draw without reloading. If it works with no connection, no server was involved, because none was reachable. Two fairness rules: do not reload while offline, since no ordinary page loads without a connection, and give a site one online visit first in case it caches something on the first load.

What is the difference between a Quick draw and a Locked draw here?

A Quick draw is one round: your browser draws, and each assignment is sealed into its own link with the key that opens it riding inside the link. Anyone holding a link can open it, including the organizer who hands it out. A Locked draw adds a step first. Each participant makes a keypair on their own device, sends the organizer only the public half, and keeps the private half, so the organizer ends up holding envelopes they cannot open. It costs everyone one extra step and two extra messages, and a lost keep link cannot be recovered.

Does a bigger or paid Secret Santa site solve this?

No. It changes who holds the information, and somebody still holds it. Any tool that emails assignments has to hold the addresses and the mapping together at the moment it sends, and any tool with a resend button stores enough to reproduce a result. That is true of the whole category, whichever product you pick. Paying buys a better reason to expect careful handling; it does not remove the thing being handled.

The organizer is playing too. What is the least awkward way to handle it?

Settle it before the draw. The two options that need no negotiation are handing the draw to someone who is not receiving a gift, or running a Locked draw so the organizer holds envelopes they cannot open. If neither is practical, say plainly who ran it and on what tool. Most groups do not mind, and the ones that do would rather have been told than reassured.