Skip to main content
Limited Release
Forms are in limited release and are not generally available. Contact your account manager to request access.

Password Protection

Password protection requires a visitor to enter a password before the public form opens. Use it for forms you share with a known audience, such as a staff intake form or a customer portal form posted behind a login on your own site.

Turn On Password Protection​

  1. Click Apps in the top bar, then click Forms.
  2. Open the form and select the Advanced tab.
  3. Select Require a password to view this form.
  4. Enter the password in Public Form Password.
  5. Save the form.

Share the public URL and the password with the people who need to complete the form.

What the Visitor Sees​

The public page shows a password screen instead of the form:

  • The heading Enter Password
  • The text "This form is password protected."
  • A password box and a Continue button

The form appears after the visitor enters the correct password. A wrong password shows "The password is incorrect." and the visitor can try again.

If someone changes the password while a visitor has the form open, the visitor sees "The password is incorrect or has changed." and enters the new password to continue.

Secure connections are required

The browser protects the password before sending it, which needs a secure connection. A visitor on an insecure connection sees "Password protection requires a secure browser connection." Public form URLs use HTTPS, so this only appears in unusual hosting setups.

How It Protects the Form​

  • Every public request for the form requires the password, including loading the form, loading the brand logo, uploading files, running Pre-Submission Workflows, and submitting.
  • The browser never sends the password itself. It sends a one-way fingerprint of the password with each request.
  • The password is encrypted in storage.
  • A wrong password and a missing password produce the identical response, so nobody can probe the form to learn whether a password exists.

Choosing and Managing a Password​

Everyone who uses the form shares the same password, so treat it as an access code for a group rather than an individual credential.

TaskHow
Change the passwordEdit Public Form Password and save. Visitors enter the new password on their next request.
Remove protectionClear Require a password to view this form and save.
Cut off access completelySelect Regenerate URL on the Public tab, or clear Enable public access.

Anyone in your account who can edit the form can read the password in the Advanced tab. Do not reuse a password that protects anything else.

A shared password is not per-person verification

Password protection controls who can open the form. It does not tell you which individual submitted it, and it does not verify that a visitor is entitled to the specific record they are working on. To verify a per-visitor secret, such as a key tied to one ticket, use a Pre-Submission Workflow with a submission condition. See Verify a Ticket Secret Key.

Rate Limiting​

Public form endpoints are rate-limited per IP address, which slows down automated password guessing. There is no per-form lockout, so choose a long password that is not easy to guess. Rotate it when someone who had it no longer needs access.