A password-protected form

Some forms are for a known group: an internal request form, a survey for one client, sign-ups for a private event. Sharing the link is easy; making sure the link alone isn’t enough is what a password is for.

One setting

Open the form’s Settings, find Password, type one and save. That’s it. The password takes effect immediately, no republish, and you can change or remove it the same way. It’s stored hashed, like an account password, so even the settings page only shows whether one is set.

What the respondent sees

The form opens on a password screen in the form’s own colours and font, with one field and one button. The right password opens the form; a wrong one says so and lets them try again. The password is remembered for their tab, so a refresh doesn’t ask twice.

Checked on submit, not just on screen

The password screen is the front door, but the check that matters happens when the form is submitted. A submission without the password is refused, so the screen can’t be bypassed by fetching the form directly. Attempts are rate limited.

Good for

• Internal forms where the link circulates on a company wiki.
• A questionnaire for one client, sent with the password in the same email.
• Event sign-ups for a private guest list.

A password is a door, not identity. Anyone with the link and the password gets in. If you need to know who answered, ask for an email and turn on verification, or limit the form to one response per person.