Anonymous Voting Software
Run a genuinely secret ballot online. TapVoter stores each ballot with no voter identifier attached to it — while unique voter keys still prove every vote came from an eligible member and that nobody voted twice. Free for up to 10,000 voters, with no paid tier to unlock ballot secrecy.
What makes a ballot anonymous is the data model, not the checkbox
Plenty of tools describe themselves as anonymous while still writing a voter ID, an email address or a session token onto the ballot itself. If that identifier exists, the vote can be traced, whatever the marketing says. So rather than assert an adjective, here is the actual contents of a TapVoter ballot record — and what it deliberately omits.
What a TapVoter ballot record holds
- The election it belongs to
- The position being voted on
- The voting method used
- The choices themselves
- A receipt code for the voter
- A timestamp
What it does not hold
- No voter ID
- No voter key or hash of one
- No name or email address
- No IP address
- No session or device identifier
- No foreign key to the voter table
Who the ballot is secret from
Secret from other voters, and from the public. No ballot carries a voter identifier, and the public transparency log names nobody. A member cannot discover how a colleague voted, and neither can anyone you share the results with.
Not fully secret from an election administrator. Voter exports deliberately carry no voting time, so the ballot log cannot be joined against them. But the administrator's own voter screen still shows roughly when each person voted, and the ballot log carries timestamps, so a determined administrator could still narrow it down. If your vote must be secret from the people running it, you need a platform that separates those roles cryptographically.
Most platforms will not tell you which of those two they actually provide. Ask any vendor you are considering — including us — to describe exactly what their ballot record stores and who can export it. If they answer in adjectives rather than field names, that is your answer.
How you stay anonymous and still stop double voting
This is the part most organisers get stuck on. If nobody knows who voted, how do you know everyone voted once? The answer is to record the two facts in separate places.
1. Each voter gets a key
A unique 9-character code in XXX-XXX-XXX format, issued per voter. Only holders of a valid key can open a ballot.
2. The key is marked used
On submission the voter record is flagged as having voted. A second attempt with the same key is rejected.
3. The ballot is stored apart
The ballot is written to a separate record carrying no reference back to the key that produced it.
The result is an election you can defend at a members' meeting: you can show that every ballot came from an eligible voter, that no key was used twice, and that the ballot record itself names nobody. Every election also produces a public transparency log listing every ballot by receipt code, so an individual voter can confirm their own ballot was recorded and counted — without the log revealing who cast any of them.
What other platforms say about ballot secrecy
“Is it anonymous?” is one of the most common questions asked about every voting platform, and the answers are surprisingly hard to find. Here is what each vendor states on the pages we checked on 24 July 2026 — linked below each entry. Where a vendor does not address ballot secrecy on those pages we say so rather than guess. That is not a claim that the feature is missing, only that we could not find it stated, and you should ask them directly.
ElectionBuddy
States that voting choices are confidential and cannot be linked to the voter, and that results can be hidden until the election ends.
Election Runner
Their public features page describes voter keys, encryption and single-vote enforcement, but does not address ballot secrecy at all.
OpaVote
Not addressed on their pricing page, which is the page we checked. We have not reviewed their full documentation, so treat this as unverified rather than absent.
Votes that usually require a secret ballot
Nonprofit boards
Officer elections where members should not feel watched by the incumbent board.
HOA & condo
Board seats, bylaw amendments and special assessments, where neighbours vote on neighbours.
Schools & student bodies
Student council and campus elections where peer pressure is the main threat to a free vote.
Ballot templates
Start from a ready-made ballot for your type of vote, then run it as a secret ballot.
Anonymous voting: common questions
Is online voting ever really anonymous?
It depends entirely on how the platform stores the ballot. Anonymity is not a setting, it is a data model: if the ballot record carries a voter ID, a key, or an email address, then the vote can be traced back no matter what the interface promises. On TapVoter the ballot record stores the election, the position, the voting method, the choices, a receipt code and a timestamp — and no voter identifier of any kind. Whether a voter has voted is tracked separately, on their voter record, without any reference to what they chose.
How do you stop someone voting twice if the ballot is anonymous?
The two things are recorded separately. Each voter gets a unique 9-character voter key. When a ballot is submitted, the key is marked as used on the voter record, and the ballot is written to a different record that carries no voter identifier — no key, no name, no email, no IP. That means the ballot itself does not name its author, and the system can still prove every ballot came from a valid key that was used only once.
Can the election administrator see how someone voted?
Other voters cannot, and neither can the public: the ballot record carries no voter identifier, and the public transparency log publishes no voter identity. Voter exports deliberately omit voting times for the same reason — so that downloading both the voter list and the ballot log gives an administrator nothing to join them on. What an administrator can still see is roughly when each person voted, on their own voter screen, and the ballot log does carry timestamps. A determined administrator could narrow things down from that. If your vote must be secret from the people running it, you should know that before you rely on it. We would rather say so than let you find out afterwards.
Is anonymous voting free on TapVoter?
Yes. Anonymous ballots are part of the free election tier, along with the public transparency log, up to 10,000 voters per election, and an unlimited number of elections. There is no paid tier to unlock ballot secrecy.
What is the difference between an anonymous poll and a secret ballot?
An anonymous poll usually means the platform simply does not ask who you are — anyone with the link can respond, and nothing stops one person responding twice. A secret ballot means eligibility is verified but the completed ballot is unlinked from the voter. If you are electing officers, amending bylaws, or running anything whose result could be challenged, you need a secret ballot, not an anonymous poll.
Can we still verify the result if nobody can see who voted?
Partly, and it is worth being precise about how far it goes. Every election produces a public transparency log listing each ballot by its receipt code, timestamp, position and voting method. A voter who kept their receipt can confirm their own ballot appears and was not voided. What the log does not do is publish the ballot choices themselves, so it does not let an outsider independently recompute the result from raw ballots — it evidences that the recorded ballots exist and were not tampered with after the fact.
Run your first secret ballot free
Anonymous ballots, voter keys and the public transparency log are all included on the free tier — up to 10,000 voters an election, and no limit on how many elections you run.
Create a free election