Send an HTML form to your email, no backend

1. The browser POSTs the fields to forms.formward.eu. Before the submission is accepted, Formward checks the origin against the form's allowed origins (if you set any), applies a per-IP rate limit using a hashed IP, and looks at the honeypot field.
2. The submission is saved to your dashboard, where you can read and search it later. Deleting the email does not delete the record.
3. A notification goes to the form's address. Each extra recipient has to confirm their address before they receive anything, so a typo cannot send submissions to a stranger.
4. The visitor lands on your thank-you page, or on Formward's default page if you have not set one. A fetch() request with Accept: application/json gets { "ok": true, "id": "..." } instead.

Fields whose names start with an underscore are instructions for Formward rather than answers from the visitor.

Copy<form action="https://forms.formward.eu/f/YOUR_FORM_ID" method="POST">
  <input type="hidden" name="_subject" value="New message from the website">
  <input type="hidden" name="_redirect" value="/thank-you">
  <input type="email" name="email" required>
  <textarea name="message" required></textarea>
  <!-- Honeypot: off-screen, must stay empty -->
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
         style="position:absolute;left:-9999px;opacity:0">
  <button type="submit">Send</button>
</form>

• _subject sets the notification subject line. Without it you get "New submission to" plus the form name.
• A field named email sets the Reply-To header on its own, so pressing Reply answers the visitor and the form above needs nothing extra. _replyto overrides it, for example when the email field has another name or the form has several; the special fields docs have the details.
• _redirect accepts a relative path, or an absolute URL whose origin is on the form's allowed list. Anything else falls back to the redirect set in the dashboard.
• _gotcha is the honeypot. A bot that fills it gets a normal-looking success response, and the submission is marked as spam and never emailed.

If you would rather show a message in place than redirect, send the same form with fetch(). The Accept header is what switches the response from a redirect to JSON.

Copyconst form = document.querySelector("form");
form.addEventListener("submit", async (event) => {
  event.preventDefault();
  const res = await fetch(form.action, {
    method: "POST",
    headers: { Accept: "application/json" },
    body: new FormData(form),
  });
  const data = await res.json();
  if (res.ok) {
    form.reset();
    form.after("Thanks, your message was sent.");
  } else {
    alert(data.error || "Something went wrong. Please try again.");
  }
});

Errors come back as { "ok": false, "error": "..." } with a 4xx status: 429 when rate limited, 402 when the monthly limit is reached. The AJAX docs cover CORS and the full status table.

• Monthly submissions: 50 on Free, 200 on Personal, 2,000 on Professional and 20,000 on Business. Free and Personal stop at the limit; Professional and Business accept 20% more as overage first. Submissions caught by the honeypot do not count.
• Several notification recipients, CSV export and search start on Personal.
• The autoresponder and file attachments start on Professional. Attachments are not mailed; the notification lists them and links to the dashboard.
• On Free, submissions are deleted after 30 days. Paid plans choose any period from 1 to 3,650 days, or keep them.

Full details are on the plans page.

A notification email contains the submission. If it goes to a mailbox hosted outside the EU, the content goes there too, and that transfer is yours to account for. Each form has a link-only setting for this case: the email then says only that a new submission arrived and links to the dashboard. Field values, the custom subject, attachment names and the Reply-To address are all left out.

Formward stores submissions, file attachments and backups in Sweden, on servers run by Hostup AB. Notification email goes out through Mailjet from an EU data centre. Submitter IP addresses are replaced with a keyed HMAC-SHA-256 hash on receipt, so the raw address is never written to disk. On Professional and Business, AI features run on Mistral AI in France and can be switched off per form.

Data leaves the EU only where you send it: a notification inbox hosted outside the EU, a webhook URL, a Slack channel or a Google Sheet. Cloudflare Turnstile is a US service, and it is off unless you switch it on for a form. The details are in the sub-processor register, the data residency page and the published DPA. For the wider picture, see GDPR form backend.