Learn · Practical guides
Secret Santa without collecting email addresses
The hat, a friend who draws for you, sealed links and a trustless protocol, with who can see the pairings in each.
You can run a Secret Santa without collecting anybody's email address. Most generator sites ask for every address because the site is what tells each person who they drew: it draws, then emails the result. Take the site out of that job and the addresses aren't needed. Below are four ways to do it, and what each one lets the organizer see.
Why the usual sites want your list
The reason is plain delivery. Someone has to hand each person their name, and email is the channel those sites picked. Whether the addresses also end up on a marketing list depends on the privacy policy of the site, so read it before you paste in your whole office. Thirty seconds is enough.
There's a second cost that gets less attention. On some of these sites the organizer's admin screen can show who drew whom, and the instruction is "please don't look." That's a rule about manners, not about what the software allows. If the point of your exchange is a real surprise, it's worth asking what the screen is willing to show.
The four ways, side by side
| Method | Who can see the pairs | What everyone needs |
|---|---|---|
| Names in a hat, in person | Nobody, if nobody peeks at the slips | To be in the same room |
| A friend outside the group draws and sends private messages | That friend, and anyone who later reads their chat history | A chat app |
| Sealed links, one per person | Nobody on screen; the organizer's browser knew the pairs for about a second | A phone or computer, or a printed card |
| A trustless protocol (nobody can cheat) | Nobody | Everyone online at once, taking turns |
The hat, when everyone is in one room
If the group fits around a table, a hat is hard to beat. Nothing is sent anywhere, so there's nothing to leak. The trouble is that a hat fails about 63% of the time with ten people, because someone pulls their own name, and the failure rate barely drops for bigger groups (the mathematics of Secret Santa has the full count). When it happens, put every slip back and start the whole draw over. Don't let the unlucky person swap with a neighbor. That feels fair and isn't, for reasons covered on the math page.
A hat also can't keep couples apart without a lot of redrawing, and it stops working the moment one person can't make it to the party.
A friend who isn't playing
This is the oldest remote version. Someone outside the exchange draws the names, then sends each person a private message with the one name they need. They're the only one who ever sees the whole list. A neutral friend, a sibling who's skipping this year or a spouse who doesn't mind the job, makes it clean.
Two cautions. A chat app keeps its history, so the messages containing every pairing sit in that friend's account indefinitely, and the draw is exactly as private as that account. And if the organizer is also a player and does the draw, they know their own recipient and everyone else's. For a family that's usually fine. For an office it's often the thing people quietly worry about.
Sealed links
This is what the Secret Santa on this site does, and it exists because of the two cautions above. The organizer types the names into the page. The draw runs in that browser tab, and the result for each person is locked into a card with its own random key. The key sits in the part of the link after the #, which browsers never send to a server (why that works). What the server stores is a set of locked cards it can't open. No email addresses are collected because the link is the delivery.
The organizer ends up with a page listing each name next to a link, and none of them says who drew whom. Send each person their own link however you normally talk: a text, a direct message, a QR code on your screen. Or print the cards and hand them out at the party, which suits the person who doesn't have a smartphone.
Some habits keep this private:
- Send each link by itself. Don't paste the whole list into the group chat. Anyone in the chat could open anyone's card.
- Know that opening leaves a mark. If someone opens a card that isn't theirs, its owner sees "opened before" with a time when they load it. That doesn't stop it, but it means it can't go unnoticed.
- Press Forget the links when you're done handing them out. Your page still shows who has opened their card, and it can no longer open any of them, yours included.
The honest limit is the draw itself. For about a second the organizer's browser knows every pair. Nobody sees a screen with the answer, but somebody who stopped the code mid-draw with developer tools could read it. If the organizer is also playing and that bothers anyone, have somebody else press the button.
A draw that nobody can cheat on
It does exist. Shamir, Rivest and Adleman worked out the machinery in 1979 for dealing cards over the phone with no dealer, and a 2010 paper showed the same idea gives a Secret Santa where no single person ever knows the pairs, the organizer included. You can read how it works in mental poker. The catch is practical: every participant has to be online and take a turn shuffling and locking the list. For a dozen relatives spread across time zones that's a scheduling project bigger than the gift exchange. We chose the version where one browser draws for a second.
Smaller questions
What if someone loses their link? If you haven't pressed Forget the links, their link is still on your page. If you have, the way out is a redraw, which gives everyone a new card. The site can't resend anything, since it never had the link.
Where do wishlists go? Into the card. Each person can write one, and only their Santa can read it. Their Santa can also ask them a question without being identified, so "what size?" doesn't need a group-chat announcement.
How long does it stay up? The exchange deletes itself 30 days after the gift date, and never later than 120 days after the draw. The organizer can end it sooner with End it now, which deletes every card and note from the server at once.
How big can the group be? From 3 to 60 people, which is enough for a large office.
Couples, housemates and the people who should never draw each other are covered in Secret Santa for couples, and a team that's spread out has more to plan than the names, so running one remotely has the schedule and the shipping details.