Is Secret Santa fair?

Usually not quite. Drawing from a hat and putting your own name back sounds fair and isn't: with three people, one of the two possible draws comes out twice as often as the other. This page explains how the Secret Santa draw avoids that, how it keeps the list private, how it proves a draw is impossible, and how all of it is checked.

What goes where · The proof when no draw exists · Equally likely, and how · What the rules give away · How lopsided the usual methods are · Who else does this · The checks · Limits

What goes where

The page is a set of static files. Once they have loaded, everything happens on the organiser's device.

Wiping the address. A script at the very top of the page reads the part after # into memory and removes it from the address bar before any other script on the page runs. So no script on the page, and nothing the page reports, can see a name in it. The browser's own history still records the address as it was opened, so on a shared device a participant should delete the message and the history entry after looking.

Scrambled is not encrypted. A link's pairing is an exclusive-or with a keystream seeded by four random bytes, with a checksum so a damaged link is refused, then written in base 62 (letters and digits only, because chat apps turn underscores into italics). It stops a name being read at a glance in a link, a file or a chat preview. Anyone who reads this page's code can unscramble one. Every link is also padded to a length fixed by the names, details and hints alone, so every link of a draw has the same length whoever drew whom; otherwise a longer recipient's name, or a recipient's long hint, would make a longer link, and an organiser comparing links could guess who has whom from length alone. True secrecy from the organiser would need either a trusted third party or a protocol run between all the players, and both cost more than a family's Christmas is worth. So the honest claim is the narrow one: the screen never shows the list unless the organiser presses "I'm not playing: show me the whole list" or prints fold-over slips, which are for someone who isn't playing. Opening a link is enough to see that pairing and the organiser holds every link, so a playing organiser has to choose not to look, as with a hat. Nor can the page stop a playing organiser drawing again until they like their name. Every slip says how many draws of that list the organiser's browser has made, which discourages a quiet re-draw; but a different browser or a private window starts counting again at one, so it cannot prove there wasn't one.

Link previews. When you paste a link into a chat app, the app may fetch the page to draw a preview. That fetch, like every request, leaves out the part after #, so the preview is the tool's general card and spoils nothing.

The proof when no draw exists

Suppose a family puts a household of four on one line and has only two other people. The four may not draw each other, so between them they may only draw the other two: four people, two names. No draw exists, and no amount of reshuffling will find one.

That shape is the only way a draw can be impossible. Philip Hall proved in 1935 that a matching exists exactly when every group of k people may, between them, choose from at least k different names (his "marriage theorem"). So when there is no draw, there is a group of k who may only choose from fewer than k names, and the page prints it, with each member's allowed names beside them. Anyone can check it with a pencil: read the right-hand column, count the different names, compare with the number of people.

How the group is found: the page looks for a matching of givers to names, growing it one augmenting path at a time. If someone is left without a name, the people reachable from them by alternating paths (each name they could take is already held by someone else, who joins the group) form a group of k who may only draw k − 1 names between them. That is the constructive half of the theorem, by the standard alternating-path argument. The page then removes members one at a time while the group stays short, so the printed proof can't be cut down further, and it does the same from the other side (a group of people who between them have too few possible Santas) and prints the shorter of the two.

It also tries removing each rule, household and last-year pairing in turn, and lists the ones whose removal would make a draw possible. If no single change works it tries pairs.

Equally likely, and how

"Fair" here means one precise thing: every draw that follows your rules has the same chance. The page uses one of three methods, depending on the size of the group, and records which one it used.

1. Counting (up to 18 people). Counting the valid draws is the permanent of the who-may-draw-whom table, which Leslie Valiant showed in 1979 is as hard as counting problems get (#P-complete), so exact counting has to stop at a size. Up to 18 people, the page counts every valid draw exactly, using whole numbers with no rounding, and builds a table of partial counts. It picks a whole number uniformly below the total and walks the table down to the one draw that number stands for. Every valid draw has exactly one number, so each comes up with probability exactly 1 over the total.
2. Reshuffling. Shuffle everybody (Fisher and Yates' shuffle, on random integers taken from the browser's cryptographic source without modulo bias), keep it if it breaks no rule, otherwise shuffle again. Every shuffle is equally likely and each valid draw is reached by exactly one shuffle, so the one kept is uniform over valid draws. This is slow only when valid draws are a tiny fraction of all shuffles.
3. A bounded sequential draw (large groups with heavy rules). When valid shuffles are too rare, the page uses Huber and Law's 2008 sampler. It goes through the recipients in turn and picks a giver for each with a probability built from an upper bound on the number of ways to finish; with the left-over probability it throws the attempt away and starts again. Every completed draw is reached with probability exactly 1 over the bound, the same for every draw, so the ones that complete are uniform. This one is computed in floating point, so here "exactly" means up to rounding error.

One detail of that third method is easy to get backwards and worth recording. Huber and Law's inequality runs down a column (one recipient, every possible giver) with the bound taken over row sums. Expanding along a row instead looks almost the same and is false: for a family of five with two couples, the weights for the single person's draw (the one who may draw all four others) add up to 1.0099, so that version would quietly favour some draws. The page's sampler runs recipient by recipient, and stops with an error rather than drawing if the weights ever add up to more than 1. The verifier checks the sum at every step on 1,200 random groups, and checks that the wrong orientation does exceed 1 on that family.

All three are exactly uniform only as far as the browser's cryptographic random generator is unpredictable, which is the same assumption every secure website makes. None of them falls back to an unequal method: if a group is so large and so restricted that none can find a draw in a few seconds, the page says so instead.

"No two-person swaps" and "one big circle" are applied by drawing from all valid draws and discarding any that break the option. Restricting a uniform draw to a smaller set leaves it uniform on that set, so each method's exactness carries over.

Finally the page checks the finished draw against every rule before it makes a single link, and refuses to show links if anything is wrong.

What the rules give away

Exclusions can leak the secret on their own. If the rules leave someone only one name they may draw, anyone who knows the rules knows who has whom. Leo Liberti and Franco Raimondi made this precise in 2008, as part of a test for whether a set of rules can keep everyone's secret at all; three people with no other rules never can. The page finds these exactly, using standard matching theory (a pairing in one valid draw happens in every valid draw exactly when it lies on no alternating cycle), and warns you before you draw, with the names behind a "show who" so a playing organiser isn't spoiled by accident.

For groups of up to 20 (fewer with an option switched on) it also works out the exact chance of every pairing, from the rules alone, before any draw. And for groups of up to 14 it works out how much each person's own slip tells them: if they know the rules and who they drew, how often could they name their Santa by guessing the likeliest person? Two cases surprise people:

• Three people. There are only two possible draws, two circles going opposite ways. Your slip says which circle you're in, so you know exactly who has you. Every time.
• Two couples, with "no two-person swaps" switched on. Only two draws are left, and again everyone can work out who has them from their own slip.

When last year's draw is being avoided, the table of chances is hidden, because its empty squares would show last year's pairs.

Can you do Secret Santa with 3, 4 or 5 people?

You can: a valid draw exists for any group of three or more. Whether it stays secret is a separate question with an exact answer. Suppose you know the rules and you have read your own slip. How often could you name your Santa by guessing the likeliest person, and does your slip tell you anybody else's pairing for certain? Every valid draw listed, each equally likely; where people differ, the row shows the best-placed guesser:

Three people can never keep the secret. Four people can: your slip tells you nothing about your Santa beyond a blind guess. Two couples who mustn't draw their partners are a quieter leak: your slip doesn't help you guess your own Santa, but it always tells you who your partner is buying for. The draw page runs this same calculation on your own group and rules before you draw, and warns you.

How lopsided are the usual ways?

To measure a method you have to say exactly what it is. These are the shapes found in practice, each with the group drawing in list order:

• Hat. Draw a slip. If it's your own name, or someone the rules forbid, put it back and draw again. If the people at the end are left with only slips they can't take, everyone puts their slips back and it starts over. Each person, in effect, takes a uniformly random allowed slip from what is left, and a dead end means starting again. It is also a common pattern in code: give each person a random allowed name, restart on a dead end.
• Backtracking. The same, but a dead end steps back and tries another name instead of starting again. Each person ends up choosing uniformly among the names that can still lead to a complete draw.
• Next on a shuffled list. Shuffle the names and give each person the next one, the last giving to the first. It only ever makes one big circle.

For each method and group, every valid draw was listed and the method's exact probability of producing it computed as a fraction, with no simulation. (The verifier then simulates the hat literally, slips and restarts and all, for every group below, and checks the two agree.)

That the hat is lopsided is not news, and the people who showed it deserve the credit. Jerrold Grossman's OEIS sequence A102262 (2005) and Brian Parsonnet's A136300 (2008) give how often the last person is left with their own name; Parsonnet's notes linked from A136300 (revised 2011) count each person's choices as one fewer while their own slip is still in the hat, which is the product each draw's chance is made of, and work the three-person case. The Possibly Wrong blog showed in 2010 that the hat's results are "nowhere near uniform" even with restarts, and Pranav Hosamani's essay of April 2026 writes the product out and shows that a drawer is most likely to pick the person who drew just before them. This page's code reproduces the published figures: the stuck-at-the-end chances 1/4, 5/36 and 19/144 for three, four and five people, and the blog's figure of 1.94869 for how much likelier the ninth drawer is to get the eighth than the first. The exact ratio below follows from that product in a line; we did not find it stated anywhere.

Three people, by hand

Call them A, B and C, drawing in that order. A can't keep their own slip, so A gets B or C, a half each. If A drew B, the hat holds A and C: B draws A half the time, which strands C with their own slip and sends everyone back to the start, and C the other half, leaving A for C. If A drew C, the hat holds A and B, B must take A, and C gets B. So the circle A→C→B→A has weight ½, the circle A→B→C→A has weight ½ × ½ = ¼, and the remaining ¼ is a restart. After restarts the two come out 2/3 and 1/3. A fair draw would give each a half.

n people: exactly n − 1 times

With n people and no other rules, the hat's likeliest draw is exactly n − 1 times as likely as its least likely. The reason fits in a paragraph. The chance of a particular draw is a product with one factor per person: 1 over the number of slips that person may take when their turn comes. The first person always has n − 1 choices and the last always has 1. Everyone in between, person k counting from 0, has either n − k − 1 choices (their own slip is still in the hat) or n − k (someone already drew them). The draw where everyone gives to the person before them, and the first person to the last, keeps every own slip in the hat until its owner's turn; the draw where everyone gives to the person after them removes each one first. The ratio of the two products telescopes:

(n−1)/(n−2) × (n−2)/(n−3) × … × 2/1 = n − 1

Every other draw falls between those two. The table below is the exact computation, which agrees.

Whether that matters is a fair question. Nobody at the table can see the distribution, and every pairing still happens sometimes. But it is the kind of unfairness that grows with the rules: in a family of eight with three couples, drawing in the order shown below, the hat's likeliest draw is fifteen times as likely as its least likely. The cases below are measured the same way.

Families and rules

"Next on a shuffled list" is fair to every one-circle draw but simply can't make the others: with four people it never produces the three draws made of two swaps. That can be what a group wants, and the page offers it as the "one big circle" option, drawn uniformly from the circles that follow your rules.

Who else does this

This is not the first careful Secret Santa page, and it would be wrong to suggest it is. A screen of about a dozen generators on 2026-11-01 found four that already do a good part of what this one does. In their own words, as read that day:

• Toggle9's generator, by Jeremiah Say, draws in the browser with each link's draw after the #, explains an impossible draw with Hall's theorem (naming the stuck group and the people they may buy for), lets the organiser add a gift hint for each person, reshuffles until a draw breaks no rule, counts the possible draws exactly for up to 16 people, and remembers last year's draw in the browser.
• AgentCalc's generator counts the valid draws exactly for up to 18 people, draws by rejection sampling, and names the group of givers whose permitted recipients are too few. It says plainly that the organiser sees the whole table, and that when its cap on tries is reached it falls back to a backtracking construction whose distribution is not guaranteed uniform.
• MiniWebtool's generator runs the draw in the browser, keeps each match in the part of the link after the #, never shows who drew whom on its results screen, and gives a clear message when the rules leave no possible draw. By default it makes one big loop, and it suggests a one-way rule for avoiding last year's pairs.
• VISU's generator draws in the browser, gives each person a link carrying their match after the #, can keep the links off the organiser's screen, and looks first for a single loop through everyone.

What this page adds, as far as that screen found: the exact chance of every pairing, with warnings for forced pairings and for slips that give the secret away; a proof cut down so that nobody can be removed from it, with the rules whose removal would fix it; uniform draws at every size with no non-uniform fallback; last year's draw avoided from a file, on any device, without showing it; QR slips; the measurements above; and a check an assistant can call that will not make the draw. And a security policy, enforced by the browser, that stops this page contacting any website but this one.

The checks

The page's engine is one file, and everything above is re-derived by a separate program: verify.mjs. It recomputes every count, chance and proof with its own code (it reads the example groups with the page's parser, and checks that parser separately). It lists every draw by brute force, tests Hall's condition on every subset of givers, and runs its own uniformity tests. Each family of checks also includes a deliberately wrong input that must fail, because a check that can't fail proves nothing.

• Impossible or not. The page's verdict against Hall's condition checked on every subset, and against brute force, on thousands of random groups of 2 to 9 people.
• The proofs. Every printed proof re-checked from scratch, confirmed to list no name a member couldn't actually draw, and confirmed that no smaller group inside it is short (every subgroup tried).
• Counts and chances. Exact counts and every pairing's chance against listing every draw; forced and never-possible pairings likewise; what your own slip tells you likewise. The page's example group has 2,496 valid draws by both routes.
• Uniformity. Each sampler run hundreds of thousands of times from a fixed seed on groups where every valid draw can be listed, with a chi-square test against equal counts. The control is the hat method on the same family, which must fail the same test, and does by a wide margin.
• The bound sampler's inequality at every step it is used, and the wrong orientation shown to fail.
• Links round-trip for names in several alphabets and with accents and emoji, never contain a name in readable form, and differ every time even for the same pairing; damaged links are refused.
• Privacy, read from the served files: no network calls in the page's code, the address-wiping script first in the page, the security policy present.
• This page's tables are rebuilt from the computed fractions in bias.mjs by build-method.mjs; a hand-edited figure fails the check.

Limits

• Up to 300 people. Exact counts up to 18 people (estimates to 20), exact chances up to 20, what-your-slip-tells-you up to 14. Above those sizes the draw is still uniform; the page just says less about it.
• With "no two-person swaps" or "one big circle" on, exact numbers come from listing every draw, so the page lists them only while that takes under about a tenth of a second (around nine people with few rules) and never for more than 11 people. Above that the page searches for a draw when you press Draw, and if it can't find one in a few seconds it says so plainly rather than claiming none exists.
• The organiser's device keeps the whole draw, scrambled, until they press "Forget this draw". See what goes where.
• It doesn't send emails or pass wish lists between people. Both need a server that knows who drew whom, which is exactly what the page avoids.
• The bias figures describe the methods as defined above. A group that handles a stuck hat differently (for example, by swapping the last two slips) has a different method, with different numbers.

← Back to the draw

Sources

• P. Hall, "On representatives of subsets", Journal of the London Mathematical Society 10 (1935), 26–30.
• J. Grossman, OEIS A102262 (2005), the probability that the last person in a redraw-if-self hat draw is left with only their own name: oeis.org/A102262.
• B. Parsonnet, OEIS A136300 (2008, corrected 2011), and "Probability of Derangements" (revised 2011): oeis.org/A136300.
• "Deranged Secret Santa", Possibly Wrong (24 October 2010): possiblywrong.wordpress.com.
• P. Hosamani, "'Tis the season: a mathematical foray into Secret Santa", Tom Rocks Maths (April 2026).
• L. Liberti and F. Raimondi, "The Secret Santa Problem", Algorithmic Aspects in Information and Management (AAIM 2008), LNCS 5034, 271–279.
• L. G. Valiant, "The complexity of computing the permanent", Theoretical Computer Science 8 (1979), 189–201.
• M. Huber and J. Law, "Fast approximation of the permanent for very dense problems", Proceedings of SODA 2008, 681–689.
• R. A. Fisher and F. Yates, Statistical Tables for Biological, Agricultural and Medical Research (1938); the in-place form is Durstenfeld, Communications of the ACM 7 (1964), 420.