Guide · The organizer question
Secret Santa without the organizer knowing: four tests that settle it
Someone has to run the draw, and that someone is usually playing in it. Every Secret Santa site says the organizer cannot see the results; the sentence is free to write, so it tells you nothing. Four tests do tell you something. They take about two minutes, they work on any site, and the fourth is the one our own Quick draw fails — so all four are run here in public, on us.
Run them here before you run them anywhere else. A claim you can check is worth more than a claim you cannot.
Why this question keeps getting asked
The person who runs a Secret Santa is almost always in it. They collect the names, they press the button, and then they spend December as the one person at the party who might already know. It is less a trust problem than a structural one: organizing means handling the results, which is the one thing nobody wants anybody to do.
Most tools answer with a reassuring sentence near the footer. The same sentence appears word for word on sites with completely different machinery underneath, which is a good sign it carries no information. What matters is not what a site promises but what it is capable of, and capability can be tested from outside.
The four-test audit
1. Does it ask for email addresses?
Look for the field before you look for the promise. If the site sends the links, it has the addresses, and at the moment of sending it necessarily holds each address next to the assignment it is about to deliver. That is what sending means. So a tool that emails assignments has, at least once, held the complete mapping in one place with real identities attached. Whether it keeps that, and whether it ever puts it on a screen the organizer can reach, is a product decision rather than a limit on what the software could do. A tool with no addresses is not in a position to make that decision either way.
2. Does it work offline?
Load the site normally, let it finish, then switch on airplane mode and run the whole draw without reloading. If it completes, the draw happened on your device, because with no network there was no server available to have done it. If it hangs or spins, the work was going somewhere else.
This is the strongest of the four, and the only one that runs outside the site's own code. Two rules keep it fair: do not reload while offline, since no ordinary page loads without a connection and that failure proves nothing; and give a site one online visit first, in case it caches something the first time.
3. Is there an admin URL?
Hunt for a “view results”, “manage draw”, or “resend links” page. Resend is the loudest of the three. To send somebody their assignment a second time, something must still be able to reproduce that assignment, which means it is stored and can be retrieved. A manage-your-draw page is a database with a front door on it.
This does not mean the pairing is on the organizer's screen today. It means it is retrievable, and retrievable is one product decision away from displayed. It is also one breach, one support ticket, one acquisition and one court order away.
4. Is the promise a policy or a property?
“We don't look at the results” is a policy. “There is nothing to look at” is a property. The two read almost identically in marketing copy and behave nothing alike. A policy is a statement about the current owner's intentions and the current staff's discipline; a property is a statement about what exists.
Only one survives a change of owner, a breach, or a subpoena, because only one has nothing to hand over. When you read a reassuring sentence, work out which kind it is. Most are the first kind, and most do not tell you so.
The same four tests, run on this site
Emails: pass. There is no field for an address anywhere in this tool, because nothing here sends. You type names, your browser draws, and you get one sealed link per person to pass on however you already talk to them. The cost is printed on the generator rather than hidden: twenty-five people means twenty-five separate messages.
Offline: pass. Open the generator, switch your wifi off, and run a complete draw. Nothing you type is transmitted by this site — and please do not take that as a claim, because it is the one thing here you can settle for yourself in thirty seconds.
Admin URL: pass. There is no results page, no manage-draw page and no resend button, because there is no account and nothing stored to hang one on. This tool has no screen, button or export anywhere that shows the organizer who drew whom, and there is no database that could.
Policy or property: fail, in a Quick draw. In a Quick draw the key that opens a link travels inside the link, and the organizer hands out every link. So the organizer could open one. Not by accident and not in bulk: deliberately, one person at a time, past a screen that names someone else before anything is revealed. A sealed envelope, not a vault. It stops accidents and it stops a glance. It does not stop the person carrying it.
We removed the company. We did not remove the person holding the envelopes, so that sits here in the middle of our own audit rather than in a footnote.
Two honest answers if test four matters
Locked draw
Before the draw, each participant opens the key page on their own phone. Their device generates a keypair, keeps the private half in a link they save and send to nobody, and gives them a 92-character code — the public half — to send back to the organizer. The organizer pastes the codes in, and each assignment is then sealed to the matching person's key. The organizer ends up holding envelopes they cannot open.
There is exactly one moment we cannot protect. The draw itself runs in the organizer's browser, so an organizer with developer tools open at that instant sees the pairing. We cannot remove that moment without a server, and a server is what every other tool has. If you would rather nobody had that moment at all, hand the draw to someone who is not playing.
The rest of the cost is ordinary, and worth knowing before you commit a group to it: one extra step for everyone, two extra messages per person, and a keep link that cannot be recovered if it is lost — that participant needs a fresh code and a fresh envelope.
Delegation
The cheapest answer, and it costs no cryptography at all. The generator makes a roster link carrying your names and rules and no pairing, because none exists yet. Send it to somebody who is not in the draw and they run the whole thing; you receive a link like everyone else.
The precondition is real, and it is where this usually falls down: the delegate has to already be able to message everyone in the group. In a family draw a spouse is normally a participant, which rules out the obvious candidate. An adult child, a colleague from another team, or a friend who is not receiving a gift is the shape that works.
What none of this fixes
Small groups leak by arithmetic rather than by architecture. Three people have exactly two possible draws, so whoever reads their own link has worked out the other two. Four people have nine. Below about five participants no tool of any design can give you much, and the generator says so on screen instead of letting you assume otherwise.
The audit also measures capability, not conduct, and a pass today does not bind tomorrow's deployment — so re-run test two now and then if it matters to you.
What is left is the comparison worth making. Every server-backed tool on the first page of results takes the organizer's access away by adding a company with total access: the names, the addresses, the mapping, all of it. We removed the company instead. That difference is not a promise, and you do not have to believe us about it. Turn off your wifi and draw.