Password protected form builder

Build a password-protected form in minutes

Add a password gate to any Formester form. The respondent sees a short login screen before the form. Wrong password, no access. Right password, the form opens and submits as normal.

One-click login gate Bcrypt-hashed passwords Full access log
Peabody
Aramark
L'Oreal
Toptal
Grab
SFU
World of Hyatt
Iolani School
Austin Independent School District
Virgin

What a password-protected form is (and what it is not)

A short definition.

What it is

A regular online form with a login screen in front of it. Anyone with the link sees the login screen. Only people with the password see the form itself. Once they submit, the response lands in your dashboard like any other submission.

What it is not

A PDF is a static file you encrypt locally. A password-protected form is a live web form behind an access gate. Use a protected PDF for a finished document someone will read. Use a password-protected form when you need someone to fill it out, not just read it.

What the password gate actually does

Three things that change the moment you turn protection on.

Access control before the form loads

Respondents who do not have the password never see the form fields, never see the questions, never know what data you collect. The login screen is the entire surface the public sees. Wrong password, the form stays invisible.

Shared password or one per user

Pick the model. Shared password works for a confidential team form or a gated download (one password for everyone on the list). Per-user password works for HR or legal forms where each person gets a unique code. Both modes log every attempt.

Bcrypt-hashed passwords, full access log

Passwords are hashed with bcrypt server-side; Formester never stores or transmits the plaintext after the initial set. Every access attempt, success or failure, lands in the form's activity log with timestamp and IP. Compliant with GDPR, UK GDPR, and CCPA out of the box.

Six confidential form scenarios that need a password gate

When a public link is too open and an internal-only tool is too closed.

HR

HR document intake

Salary surveys, exit interviews, sensitive employee feedback. The form goes to a specific group of employees, not the open internet. A shared password limits access to the group; per-user codes if anonymity needs to be auditable.

Legal

Legal client intake

Case-evaluation forms with sensitive details (incident dates, parties, financial exposure). Pass the password to the prospective client over phone or signed engagement letter. The form is private until they enter it.

Finance

Financial onboarding

Tax-prep questionnaires, wealth-management intake, lending applications. The form collects PII (SSN, bank, employer). A password gate adds a second barrier on top of the encrypted submission.

Healthcare

Healthcare patient portals

Patient history, insurance card upload, symptom intake. Add a password tied to the patient's appointment confirmation to gate the form until the booked patient arrives.

IT / Ops

Internal IT and ops requests

Access requests, equipment provisioning, security incident reports. Restrict the form to the employee directory; only authenticated users can submit.

Private events

Exclusive event RSVPs

Private launch invites, members-only meetups, paid-program registrations. Share the password only with the guest list. The link can travel, the form cannot be filled without the code.

Turn on password protection in three steps

No code, no plugin, no separate auth tool.

Open form settings

In your Formester form's Settings tab, find the Security section and toggle "Password protection" on.

Choose the password mode

Pick Shared password (one password for everyone) or Per-user passwords (a list of unique codes you can revoke individually). Enter the password or upload the list.

Publish and share

Publish the form. The URL stays the same; the form now opens to a login screen. Share the link and the password through your channel of choice (email, SMS, signed letter). The access log starts recording on the first attempt.

Password-protected form vs. the workarounds

What you would otherwise have to do.

Capability
Native password protection on the form itselfNoTenant onlyYes
Works for external respondents (outside your org)No, requires Google sign-inNo, requires MS accountYesYes
Per-user passwords with revocationNoNoNoYes
Access log of every attemptNoLimitedNoYes
Bcrypt-hashed password storageMS-managedLocal file, weakerYes, server-side
GDPR / UK GDPR / CCPATenantTenantUp to youOut of the box
Setup timeWorkaroundLimited to tenantPer file, manualOne toggle

Takeaway: If the form has to be private and you cannot force every respondent into your Google or Microsoft tenant, a Formester password-protected form is the cleanest fit. PDFs work for finished documents; forms work when you need someone to fill it out.

Pre-built Templates

Get Started with ready-made Templates

Testimonials

What teams are saying about Formester

Real reviews from G2, Trustpilot, and Product Hunt.

4.7 G2 (11 reviews) 4.7 Trustpilot (24 reviews) 5.0 Product Hunt
G2

Formester offers a ton of features and my developer loves using it to integrate to various marketing pages. It's quick and easy to create using drag and drop. It allowed me to remove branding unlike Typeform that has branding even in paid plans. Their support is top notch.

K
Karthik B.
Social Media Manager · B2C, SaaS, EdTech
Trustpilot

Formester brings together some amazing technology all in one easy to use tool. The AI form builder makes things a breeze to set up and completed 75% of my build and then another 25% tweaking. Combined with the AI agent workflow automation after forms are submitted, it's one amazing package.

V
Verified Trustpilot reviewer
April 2026
G2

Beautiful and easy to use. The templates and the floating button feature with easy-to-use integration with Google Sheet is crazy. I was looking for a simple and beautiful form to put on my website for free.

J
Justin C.
Online Private English Teacher
Trustpilot

We were looking for a new platform for building quizzes for our educational program. This one has not let us down. It has tons of features and is easy to use. The company is super responsive if you have questions or need help with anything.

J
Judy
April 2026
Product Hunt

While comparing it with other players in the market, Formester appears to be fast and very easy to use. Highly recommended for anyone looking for a clean form builder.

P
Piyush Singhania
Product Hunt reviewer
Trustpilot

Formester is an incredibly professional company. They are very helpful, they help solve any problems quickly. At my request, features were enabled and changed in a short time, so I was able to completely customize my Quote Form to my needs.

V
Verified Trustpilot reviewer
February 2026
G2

Formester solves the problem of complicated data collection by providing a quick tool to create customized and automated forms. Ultra-fast form creation thanks to drag and drop.

G
Guibril D.
Engineer · Renewables & Environment
Product Hunt

Great form and always good support. Easy to set up, easy to share, and the team behind it actually responds when you need something.

B
Banghyun Joo
Dunoit
G2

We are able to easily build so many forms for our daily business work. These are easy for sharing too with our clients at one time instantly. There is also a feature for identifying if there is any spam in the form filling process.

A
Aashika S.
Manager
Trustpilot

Great support and the price-performance ratio is good. The team is quick to reply and the product does exactly what it promises.

V
Verified Trustpilot reviewer
January 2026

Common questions

How is this different from a password-protected PDF?

A password-protected PDF is a static, finished document you encrypt with a password before sharing. A password-protected form is a live web form with a login screen in front of it. Use a PDF for "here is the contract, read it." Use a form when you need the person to fill in fields and submit data back to you.

Can I add password protection to a Google Form?

Not natively. Google Forms restricts access by Google account (sign-in required) or by domain, but does not support a per-form password for external respondents. The workaround is to rebuild the form in a tool that does support it, like Formester.

Shared password for everyone, or unique passwords per user?

Both modes are supported. Shared password is one code that everyone with access uses; good for team-wide forms or gated invites. Per-user passwords are unique codes you generate per respondent; good for HR audits, legal intake, or anywhere you need to revoke one person's access without changing it for the rest.

How is the password stored?

Passwords are hashed with bcrypt on the server. Formester never stores or logs the plaintext password after the initial set. If you forget the password, you reset it (the old one is unrecoverable, by design).

What does a respondent see when they enter the wrong password?

A generic "wrong password, try again" message — no detail that would help an attacker. After repeated failed attempts, the form rate-limits the IP. Every attempt lands in the form's access log with timestamp.

Does this work alongside form encryption?

Yes. Password protection gates access. The submission itself is also encrypted in transit (TLS 1.2+) and at rest (managed encryption). The two layers are independent — turn on either or both depending on the sensitivity.

Can I make the form password-protected AND require a sign-in?

No, those are two different access models. Pick one: password protection for external respondents who do not have an account with you, or a sign-in-required flow if you run a respondent portal (separate Formester feature).

Password protected form builder

Add a password gate to your next form in 30 seconds

Free to start. One toggle in form settings. Share the link, share the password, the access log starts recording.

Free plan. No credit card. Bcrypt-hashed passwords, full access log.

30sTo turn on
bcryptPassword hashing
GDPR+ UK GDPR + CCPA