FormSubmit review: is FormSubmit.co free, safe and good enough?

How FormSubmit works

Setup has three steps on the homepage. Set your form's action to https://formsubmit.co/ followed by your email address, give every input a name attribute, and submit the form once. That first submission triggers a confirmation email. Once you confirm, submissions are delivered to your inbox. FormSubmit's help page says submissions made before you confirm are held and delivered after activation.

After confirming, FormSubmit sends you a random-string alias. Use it in the action URL instead of your address so bots and visitors can't read your email from the page source. Behavior is controlled with hidden fields whose names start with an underscore.

Two practical gotchas from the help page: the form must be served from a web server, since opening it as a local HTML file returns an "Unable to submit form" error, and changing the destination email means activating the form again.

• _next: your own thank-you page URL
• _subject and _cc: email subject and extra recipients
• _replyto: reply straight to the submitter (needs an email field)
• _template: one of three email layouts, such as table
• _autoresponse: an automatic reply to the submitter
• _webhook: a URL called on every submission
• AJAX: post to https://formsubmit.co/ajax/ followed by your email or alias

Is FormSubmit free? Pricing and limits

Yes. The homepage says setup is easy and free, and the docs promise unlimited submissions from unlimited forms for one email address. No page on formsubmit.co lists a price, a paid tier or an upgrade, so there is nothing to buy. Some software directories list paid credit packs for FormSubmit, but nothing on FormSubmit's own site describes them, so treat those listings as unverified.

Free doesn't mean unlimited in every direction. The archive API can be called 5 times a day and keeps 30 days of submissions. Attachments are capped at 10 MB per submission. The docs say FormSubmit imposes "technical limitations" from time to time to filter bots, and strongly recommend keeping reCAPTCHA on to avoid them. There is no published uptime commitment.

Spam protection

Every form gets Google reCAPTCHA by default. The help page says FormSubmit uses reCAPTCHA v2 and v3 and also checks submissions with its own spam prevention system. You can set _captcha to false to remove the challenge, but the docs advise against it, and autoresponses stop working when it is off.

Two more tools are optional. A hidden _honey text field makes FormSubmit silently drop any submission where that field is filled in, and _blacklist discards submissions that contain phrases you list (the docs suggest 20 phrases at most). There is no spam folder to review, so anything filtered is simply gone and anything missed lands in your inbox.

File uploads and attachments

FormSubmit accepts files on the free service. Add enctype="multipart/form-data" to the form and use one or more file inputs. The combined size of all files must stay within 10 MB. Files arrive as email attachments only. The docs say uploaded files are not retained and can't be fetched through the API.

Attachments are the most common FormSubmit problem: a missing enctype, AJAX submissions and the 10 MB total all cause files to go missing. Our guide to FormSubmit file uploads and attachments, linked below, covers the setup and the fixes step by step.

Dashboard, archive and data storage

FormSubmit has no dashboard or login. Its documentation describes a submission archive instead: you request an API key with a GET request that emails the key to you, then call the get-submissions endpoint for a timestamped list in JSON. The archive keeps 30 days of submissions, and the API can be called 5 times a day.

In practice your inbox is the system of record. If an email is filtered, deleted or never arrives, you have 30 days and 5 API calls a day to recover it, and attachments can't be recovered at all. The privacy policy says the form owner is the rightful owner of the submitted data.

Email delivery and autoresponses

Submissions are emailed by FormSubmit itself. The docs describe no option to send through your own mail server, and FormSubmit publishes no deliverability or speed figures. If emails stop arriving, the help page suggests checking the spam folder and marking the messages as not spam. If the confirmation email never arrives, it suggests checking that your mail server accepts outside email.

Autoresponses (_autoresponse) send the submitter a copy with your custom message, but only on forms with reCAPTCHA on that are not submitted over AJAX. Blank emails usually mean an input is missing its name attribute, or uses a reserved name such as _next or _subject.

Support and documentation

Support is by email at [email protected] or the form on formsubmit.co/support, and the page also recommends asking on Stack Overflow. The help page answers about a dozen common questions, and there is an interactive playground for testing a form. There is no paid support tier, and no status page is linked from the site. The documentation is a single page that covers every option, which makes it quick to read.

FormSubmit compared with splitforms

splitforms, which publishes this review, is also a form backend, so here is where the two differ. FormSubmit is free with no stated submission cap, while splitforms Free is 500 submissions in total, one-time. If you only need emails and will never need to look a message up again, FormSubmit costs less.

What splitforms adds: every plan, Free included, stores submissions in a searchable dashboard with no automatic expiry, sends notification emails at no cost, and runs rule-based spam filtering with a reviewable spam folder and no CAPTCHA required. Paid plans (Pro at $5/month for 5,000 submissions a month, Annual at $49/year for 15,000 a month) add stored file uploads (5 files of 5 MB each per submission) and HMAC-signed webhooks with one automatic retry.