Jotform review: free plan limits, pricing, payments and safety

What Jotform is (and how it differs from a form backend)

Jotform is a hosted form builder. You create a form in its drag-and-drop editor, starting from a blank form or one of the 20,000+ templates its homepage advertises, and Jotform hosts the form, stores each submission in your account and sends the notification emails. You share the form as a Jotform link or embed it on your site. Forms can use the Classic layout, with every field on one page, or the Cards layout, which shows one question at a time.

Jotform has grown well beyond forms. Its product menu lists e-signatures (Jotform Sign), PDF tools, approval workflows, Jotform Tables, an app builder, a store builder, a mobile app and AI Agents, and the same plan limits cover all of them.

That makes Jotform only a partial competitor to splitforms, which publishes this review. splitforms is a form backend: you write the HTML form yourself, point its action at an endpoint, and the backend stores, filters and forwards the submissions. Jotform is the right kind of tool when you want the builder, the hosting and the extras. A backend is the right kind when you already have the form.

Is Jotform free? What the Starter plan includes

Yes. Jotform's free plan is called Starter, it has no end date, and the pricing FAQ says it includes all standard features, such as templates, payment integrations and widgets. There is no free trial of the paid plans: Jotform says Starter is the way to try the standard features, though HIPAA features are not included.

The limits are what matter. Starter allows 5 active forms, 100 submissions a month across all of them, 10,000 form views a month, 100 MB of upload space, 500 stored submissions in total, 100 fields per form, and 10 payment submissions and 10 signed documents a month. The REST API allows 1,000 calls a day. Forms and signed documents on Starter carry Jotform branding, which any paid plan can remove.

• Active forms: 5
• Submissions: 100 a month, plus a 500-submission storage cap
• Form views: 10,000 a month
• Upload space: 100 MB
• Payments and signed documents: 10 a month each
• Branding: Jotform branding stays on

Bronze, Silver, Gold and Enterprise, and what happens at the limits

Paid plans are Bronze ($39 a month, or $408 a year), Silver ($49 a month, or $468 a year) and Gold ($129 a month, or $1,188 a year). Billed yearly, that works out to $34, $39 and $99 a month. Each step raises every limit: Bronze has 25 forms and 1,000 submissions a month, Silver 50 forms and 2,500, and Gold 100 forms and 10,000, with HIPAA features. Enterprise is priced by quote and adds unlimited usage, multiple users, SSO, custom domains and data residency options. Eligible nonprofits and schools get 50% off Bronze, Silver and Gold and 30% off Enterprise.

Jotform charges in US dollars or euros depending on where you are, and adds tax unless you give a valid tax ID. Upgrades take effect at once with prorated billing. Downgrades also take effect at once, with the unused time kept as account credit. A cancelled plan runs to the next billing date and then drops to Starter. Cancel within 30 days of a payment and Jotform will issue a full refund on request.

Limits work in two ways. Monthly limits (submissions, form views, payment submissions and signed documents) reset each usage cycle, and deleting entries does not free up the monthly count. The help center says that when you reach a monthly limit or run out of upload space, Jotform emails you and disables your forms on the date in that email. Visitors then see a "Form over quota" message until the reset or an upgrade. Total submission storage works differently: once it is full, Jotform deletes the oldest entry to make room for each new one, so download and purge old entries before you get there.

Payments, registration forms and HIPAA

Payments are one of Jotform's strongest features. Its payments page lists more than 40 gateways, including Square, PayPal, Stripe and Authorize.Net, for selling products, taking donations and setting up recurring subscriptions. Jotform says it never charges its own transaction fee on top of the processor's. The limit to watch on registration and order forms is payment submissions: 10 a month on Starter, 100 on Bronze, 250 on Silver and 1,000 on Gold.

HIPAA features, including encryption and audit logs, are available only on Gold and Enterprise. Jotform's HIPAA page says covered entities that turn on the HIPAA features receive a signed Business Associate Agreement, and its security page says a BAA is available on request. The HIPAA page also says you remain responsible for following HIPAA rules, and its forms are described as helping with compliance rather than guaranteeing it. HIPAA accounts get their own API address, hipaa-api.jotform.com.

File uploads, spam protection, integrations and webhooks

The File Upload field accepts up to 1 GB per file. Its default limit is about 10.6 MB, which you can change in the field's options, and the help center recommends no more than 25 files per entry. Every file counts against your plan's upload space, from 100 MB on Starter to 100 GB on Gold. To free space you delete the entries that contain uploads and then purge them.

Against spam, Jotform's help guide recommends adding a CAPTCHA field, which defaults to hCaptcha and can be switched to reCAPTCHA. It also describes a unique-submission check by cookie or by cookie and IP, a unique-field check, blocking free email addresses, an email-verification widget and password protection.

Jotform's homepage advertises 150+ integrations, and its menu says 200+. They cover CRMs (Salesforce, HubSpot), storage (Google Drive, Dropbox), email marketing (Mailchimp) and automation (Zapier, Make, Power Automate). Webhooks are set per form under Settings, Integrations, and a form can have several endpoints. The guide gives a 30-second request timeout and says an encrypted form sends only encrypted data, but it documents no retries and no request signature. The REST API takes an API key and allows 1,000 calls a day on Starter, 10,000 on Bronze, 50,000 on Silver and 100,000 on Gold, with no daily limit on Enterprise.

Where Jotform stores data, and how it is secured

Jotform's privacy policy says form data is stored on servers in the United States unless you choose the EU. The security page names Google Cloud as the main host, in Iowa and Frankfurt, with AWS as a secondary provider in Virginia and Frankfurt, and says EU data stays in the EU. Accounts created in the EU are put in the European data center automatically. Other accounts can move by going to Settings, Data, GDPR Datacenter and choosing Move to EU. Enterprise customers can choose other regions, and the security page names Australia, Canada and the UK as examples.

On security, Jotform says it is a PCI DSS Level 1 service provider and complies with GDPR and CCPA. Forms are served over TLS. Optional form encryption encrypts submissions in the respondent's browser with an RSA 2048-bit key protected by a password you set. Two-factor sign-in is available, and SSO is Enterprise-only. A SOC 2 certified environment is offered only as an Enterprise upgrade, and the page does not say which SOC 2 type. The privacy policy names AWS and Google Cloud, links a sub-processor list, and says Jotform is certified under the EU-U.S. Data Privacy Framework.

On retention, the privacy policy says data is kept while your account is active. Once an account is closed and its forms are taken down, personal data is deleted after one month.

Support, and who runs Jotform

Jotform's contact page says support is available 24/7. Channels are a support request form (listed average response 1 hour), live chat (listed average 2 minutes or less), a US phone number, an AI support agent and a public answers forum, where questions can also be posted privately. Dedicated support is reserved for Enterprise.

Jotform began in 2006. Its About page names Aytekin Tank as founder and CEO, says Jotform opened its San Francisco headquarters in 2014, and lists offices in Sydney, London, Vancouver and several cities in Turkey. US customers contract with Jotform Inc. The terms are governed by California law with arbitration in San Francisco, and they cap Jotform's liability at what you paid in the previous 12 months.

When a plain HTML form plus a backend fits better

Jotform does let you copy a form's full source code into your own page, but only for Classic forms, and the help guide says you have to re-copy it every time you change the form in the builder. If you or your developer already build forms in HTML, React or a site builder, a form backend skips that loop: the form is your own markup on your own domain, and the backend only receives, stores and forwards the submissions.

splitforms is one such backend. Free is 500 submissions in total (one-time, no card), Pro is $5/month for 5,000 submissions a month and Annual is $49/year for 15,000 a month, with unlimited forms on every plan and no form-view or field limits. Notification emails are free on every plan, spam filtering is rule-based with no CAPTCHA required, and paid plans add HMAC-signed webhooks and file uploads (5 files of 5 MB each per submission). A form can also send the submitter to Stripe Checkout for a fixed amount after the submission is saved.

Where Jotform stays ahead is everything that isn't the submission pipe: the visual builder and templates, product lists and many payment gateways, e-signatures, approval workflows, 1 GB file uploads and a HIPAA BAA. splitforms does not offer a HIPAA BAA, so keep protected health information on a tool that does.