Secret Santa Generator

How the draw works, and what is in a link

Every person may draw anybody except themselves and anybody you have kept apart from them. "Each other" removes both directions between two people; "one way" removes only one. Before anything is drawn, the generator checks that a draw keeping every rule exists at all. For one name each that is a matching problem — can every person be handed a different name they are allowed to draw — and it is answered exactly, not by trying and hoping. When the answer is no, the page names the people responsible: a set of givers who, between them, are allowed to draw fewer names than there are of them. Hall's marriage theorem says a draw exists exactly when no such set does, so naming the set is naming the reason.

For one name each, the draw is a shuffle. The whole list is shuffled with the browser's cryptographic random number generator, and the shuffle is kept only if every person landed on somebody they are allowed to draw; otherwise it is shuffled again, up to twenty thousand times. Keeping only the shuffles that pass gives every valid draw exactly the same chance. Only when the rules leave so few valid draws that twenty thousand shuffles all fail does the page fall back on a randomised search, which always finds one but does not promise every draw an equal chance.

For two names each, the existence check is a flow problem: everyone gives two, everyone receives two, nobody draws the same person twice. The draw itself is two rounds of the one-name shuffle, the second barred from repeating the first. That comes close to an equal chance for every valid two-name draw without being exactly equal, and we say so rather than round it up.

The figure in the text below the tool is plain arithmetic. When everyone in a group pulls one name from a hat, the share of draws in which nobody gets their own name is the number of derangements divided by the number of orderings: 9 of 24 for four people, 44 of 120 for five, 14,833 of 40,320 for eight. From four people upward it stays between 36% and 38%, and it settles at one divided by e, about 36.8%.

Each link carries one person's draw: the event name, their own name, the name or names they are buying for with any hints you added, the budget, the date, your note, a four-character draw code and the minute the draw was made. It is scrambled so a name cannot be read at a glance in a message preview. That is not encryption: anybody who opens a link sees what it holds, so send each person only their own. The printed cards carry the same link as a QR code, at error-correction level M, which the QR standard specifies as able to recover about 15% of a damaged symbol, or level L, about 7%, for a link too long to fit at M. The cap of forty people is our own choice — past it the ring of names and the page of cards stop being readable. The calendar file on the reveal page holds one all-day event on the exchange day with a reminder a week before, and names the day and the budget but never the person. The names, exclusions, details and draw are saved in this browser, so the organiser can resend a lost link; there is no account.

Where these numbers come from

1. 1. On Representatives of Subsets (Hall's marriage theorem) — P. Hall, Journal of the London Mathematical Society, 1935
2. 2. A000166: Subfactorial or rencontres numbers, or derangements — The On-Line Encyclopedia of Integer Sequences
3. 3. ISO/IEC 18004:2015 — QR Code bar code symbology specification — International Organization for Standardization
4. 4. Crypto: getRandomValues() method — MDN Web Docs, Mozilla

Every figure above was read out of the code that runs on this page. Where a number is our own judgement rather than a published one, the note says so and cites nothing. Method last checked 28 September 2026.