Send a form to your inbox — without a backend

Create a form in the dashboard, copy its endpoint, point your HTML at it. Submissions arrive by email, spam filtered, nothing else to run.

1. Get your endpoint

Every form gets its own key. Requests go to:

POST https://quietform.dev/api/v1/submit/YOUR_KEY

Accepts application/json, application/x-www-form-urlencoded and multipart/form-data. No API key in the page — the endpoint key is public by design, and abuse is handled by rate limits and spam scoring rather than a secret you would have to hide in client HTML.

2. Paste it into your site

<form action="https://quietform.dev/api/v1/submit/YOUR_KEY" method="POST">
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>

  <!-- honeypot: hidden from humans, bots fill it -->
  <input type="text" name="_gotcha" tabindex="-1" autocomplete="off"
         style="position:absolute;left:-9999px" />

  <button type="submit">Send</button>
</form>

Stopping spam

Honeypot (on by default). Add a hidden field named _gotcha. Bots fill it, humans can't see it, and filled submissions are dropped silently — the bot gets a 200 so it never learns it was filtered.
Content scoring. Link dumps, injected markup, bulk-mail phrases and shouting are scored and held back from your inbox. Held submissions stay visible in your dashboard, so a false positive is never a lost lead.
Rate limits. Per form and per IP, applied at the edge before anything is stored.
Turnstile (optional). Enable per form if you want a CAPTCHA. Off by default: it needs JavaScript, and half of static sites don't run any.

Options

Field	What it does
email	Used as Reply-To, so you can answer straight from your inbox.
_gotcha	Honeypot field. Keep it hidden and empty.
redirect (form setting)	Where the browser goes after a classic HTML submit. Without it the endpoint answers JSON.
zero-storage (form setting)	Relay the submission by email and keep nothing. Data lives in the delivery queue only until it is sent.

Webhooks

Point a webhook at your own service and every submission is POSTed as JSON, signed with HMAC-SHA256 over timestamp.payload using your endpoint secret. Verify X-Quietform-Signature against X-Quietform-Timestamp before trusting the body.

Where your data lives

Submissions are processed and stored in the EU (Frankfurt), and email is sent from EU infrastructure. Turn on zero-storage per form and nothing is persisted at all — useful when the form collects anything you would rather not keep.