Safe Roster

Point Safe Roster at the roster you were asked for — a CSV, which Excel and Google Sheets both save from File, Save As — and it shows every column with the first row's value, so you recognise the data instead of parsing headers. It marks the name and the ID number to be replaced, and starts a free-text column like Teacher Comment at "Remove column", because a comment field is where a name hides. Change any of it, then read the strip at the bottom: that is the file that will leave, before it leaves.

A student gets a code the first time they appear and keeps it for good. Send the fall roster and the spring one and an analyst can follow a child across both files without ever seeing a name — and when you are handed results keyed by those codes, Safe Roster turns them back into your class list.

The link between names and codes lives in a code list you keep — a .srkey file locked with a password only you know. Nothing else can undo the swap: not us, not the person you sent the file to, not anyone who finds the shared spreadsheet. There is no way to recover a lost password, so Safe Roster also saves a paper backup sheet when you create the list — print it and keep it somewhere locked.

Safe Roster opens in a browser, but nothing about it is online. There is no account, no server behind it, and nowhere for a roster to be sent — a test on every release fails if a single line of code that could reach the internet appears in the file. The spreadsheet you open and the codes it creates stay on your computer. Check it yourself: open Safe Roster, unplug the network, and it still works.