EmailJS review: email from front-end code, through your own email account

How EmailJS works

EmailJS does not send emails itself. You connect an email service in the dashboard, either a personal account such as Gmail, Outlook 365 or Fastmail, or a transactional provider such as Amazon SES or SendGrid, and EmailJS sends through it. You then build email templates in the dashboard, with dynamic variables like {{name}} filled in at send time.

Your code calls emailjs.send or emailjs.sendForm with a service ID, a template ID and your public key, or posts the same values to the REST API at api.emailjs.com. EmailJS looks up the template, fills in the variables and sends the email through your connected service. The docs list a rate limit of 1 request per second for the send methods.

EmailJS recommends personal email accounts only for development or very low volume, because the provider can block an account that exceeds its daily limit or flag it for spam. For production it recommends a transactional provider.

The public key: what it exposes and how to lock it down

Your EmailJS public key sits in client-side code, so anyone who views your page source can copy it along with your service and template IDs. EmailJS's own FAQ acknowledges this. Its position is that a copied key can only send your predefined templates with your content, not arbitrary spam. Your email provider's credentials are never exposed to the browser.

The practical risks are still real. Someone with your key can send your templates repeatedly, using up your monthly quota (requests over 100% are dropped, so your real form stops sending too) and sending mail through your connected account. Template fields, including the recipient, can take dynamic variables, so a template whose To address comes from a variable can be pointed at addresses you did not choose. Keep the recipient fixed in the template.

• Domain allowlist (Personal and up): only requests whose origin matches your listed domains are processed.
• IP-based rate limits on the EmailJS side, plus the documented 1 request per second limit.
• reCAPTCHA v2 per template: once enabled, that template cannot send without a solved CAPTCHA.
• Private key: an optional second key enabled under Account, Security, for server-side or app use.
• SDK options blockHeadless, blockList and limitRate. These run in the SDK, so they stop casual bots rather than someone calling the REST API directly.
• Triple-bracket {{{variables}}} insert raw HTML; the docs warn they are unsafe and can be abused.

The EmailJS dashboard and login

You sign in at dashboard.emailjs.com. The dashboard is where you connect email services, edit templates (with a Test It dialog and a generated JSFiddle), view email history, manage contacts and find your public and private keys. Multi-factor authentication with any TOTP app is free on every account.

Email history shows each send with its template variables and any provider error, kept for 7 days on Free and 30 days on paid plans. It can also be read through the /history REST endpoint with your private key. Templates can optionally save each sender as a contact, viewable and exportable as CSV in the dashboard (500 contacts on Free, unlimited on paid plans).

Team access is on Professional (3 seats) and Business (unlimited), with four permission levels: Account, Service, Template and Read-Only.

Spam protection for contact forms

EmailJS's spam tools are about stopping bots from triggering your templates, not about filtering what a submitter writes. The FAQ lists IP-based rate limits, the origin allowlist and reCAPTCHA support, and notes that it is up to the developer to turn reCAPTCHA on. The SDK can also refuse headless browsers and block requests where a chosen variable matches a blocklist.

The docs we checked describe no content-based spam scoring, no honeypot field and no spam folder. A message that passes the CAPTCHA and rate limits is sent as an email.

File attachments

Attachments are configured per template, either static (the same file on every email) or dynamic. Dynamic attachments come from a file input in a form sent with sendForm, or from a Base64 or URL variable, such as a canvas image.

The plan sets the total attachment size per request: none on Free, 500 KB on Personal, 2 MB on Professional and 30 MB on Business. EmailJS notes that some email services cap attachments at 10 MB and recommends staying under that. Files travel inside the email; there is no separate file storage to browse later.

Privacy, data storage and who runs EmailJS

EmailJS is operated by EmailJS Pte. Ltd., and its terms are governed by Singapore law. The privacy policy (last modified September 8, 2026) says all servers are in the USA on Amazon Web Services, data is stored encrypted, and its subprocessors are Cloudflare, AWS, Redis, Zendesk and Sentry, all in the United States. EU and UK transfers use Standard Contractual Clauses or the UK IDTA.

Per the policy, EmailJS stores email requests (unless you switch history off for a template) and request metadata, active accounts' data is retained for 30 days, and deleting an account removes its data from production servers immediately. The policy says it uses only session cookies and has no advertising, and the pricing FAQ says EmailJS does not sell email content, metadata or logs.

EmailJS publishes a data processing agreement, an nFADP page and a HIPAA page. The HIPAA page offers a BAA on the Business plan and requires the template setting that stops private data being saved. Payments go through Paddle, so charges appear as PADDLE.COM * EMAILJS.

Support, uptime and billing

Support is community-only on Free, standard on Personal and priority on Professional and Business. There is a contact page and a public status page at status.emailjs.com.

The pricing page advertises a 99.5% uptime SLA, while the terms of service promise 99% for paid plans, with service credits of 10% of the monthly cost below 99% and 30% below 95%. There are no long-term contracts: upgrades apply immediately and downgrades or cancellations at the end of the billing cycle. The terms describe fees as generally non-refundable.

EmailJS vs a form backend like splitforms

splitforms is a form backend and publishes this review. The difference is the model. EmailJS sends an email through your account and keeps a short send log. A form backend receives the submission on its own server, stores it, filters spam and then emails you, so there is no email-sending key in your page.

splitforms Free is 500 submissions in total (a one-time allowance), with owner email notifications on every plan and stored submissions that do not expire automatically. Pro is $5/month for 5,000 a month with signed webhooks, and Annual is $49/year for 15,000 a month. EmailJS remains the better fit when you need to send many kinds of transactional email from client code, not just collect form submissions.