How it keeps the secret

The draw happens on your device. This page is a set of files that runs in your browser. The names you type and the draw never leave it, except inside the links you send; the only thing it tells our server is that the page was viewed. Its own security policy stops it from contacting any other website. You can switch off your connection once the page has loaded and still draw.

The screen doesn't show the list. After the draw, this screen shows only the givers' names, each with a link. A link carries one pairing, scrambled, after the #. Browsers never send that part of an address to a website, so this site never receives it. It does travel inside the message you send, so whoever carries the message (your messaging or email service, and any filter that checks links) can see it.

What it can't promise. Anyone who opens a link sees that pairing, and as the organiser you hold every link, so if you're playing, don't open anyone else's. Scrambling stops an accidental glance at a link or a chat preview, not someone who means to look. Your device keeps the whole draw, scrambled, so a lost link can be re-sent, until you press "Forget this draw"; and a link stays in the browser history of whoever opens it. Nor can the page stop a playing organiser drawing again until they like their name. Every slip says how many draws of that list the organiser's browser has made, which discourages it, though a different browser starts again at one. If the organiser is playing too, it's the same trust you'd place in whoever shakes the hat. The full privacy account.

When the rules make a draw impossible

With enough couples and exclusions, there can be no way to draw at all. Many generators just tell you it didn't work and to try removing a rule. This one proves it, using a theorem of Philip Hall's from 1935: a draw exists exactly when every group of people can, between them, draw at least as many different names as there are people in the group. So when no draw exists, there's a group that can't, and the page names it. You can check it with a pencil.

Every valid draw is equally likely

Lots of ways of drawing names are lopsided without anyone noticing: drawing from a hat and putting your own name back favours some draws over others, and giving each person the next name on a shuffled list can never produce some draws at all. This page picks uniformly from every draw your rules allow (exactly; for very large groups with heavy rules, to within rounding), and checks the draw against your rules before showing a single link. How it works, and how lopsided the other methods are.

Questions

Can you do Secret Santa with 3 people?

You can, but it can't stay secret: three people have only two possible draws, so your own slip tells you who has you. With four people your slip tells you nothing about who your Santa is. Two couples who can't draw their partners will each know who their partner is buying for. The page checks your own group before you draw and says what it gives away. The numbers for 3 to 6 people.

Can I take part if I'm organising?

Yes. You'll get your own link like everybody else. The screen doesn't show who drew whom; only the "I'm not playing" button and the fold-over slips, both marked, do.

Someone lost their link.

If you saved the draw file, load it on this page and copy their link again. If you're on the same device and browser, the draw is still here.

Why did it warn me that someone's pairing is "forced"?

Sometimes the rules leave a person only one name they're allowed to draw. Then anyone who knows the rules knows who has whom, and the page tells you so you can loosen a rule.

Can it email everyone?

No. Sending email needs a server that knows everyone's names and addresses, which is exactly what this page avoids. Send the links however you normally message people.

Wish lists?

Type a gift hint for anyone under "Details", like "Ann: loves tea", and it travels inside the link of whoever draws Ann. What this page can't do is let people write their own wish lists after the draw and pass them to their Santa: that needs a server that knows who drew whom.