Your form fills up with bots
The honeypot ships hidden inside the snippet, behind rate limits per key and per IP and heuristics on the message — free on every plan. Turnstile is there when you need it, off until you do.
No server, no backend code. Paste one snippet (or let your AI agent do it) and confirm your email once. Submissions land in your inbox.
Free forever. No card. Your form is working in about twenty seconds; you click one confirmation email to start receiving.
<form action="https://honeyforms.dev/s/YOUR_KEY" method="POST"> <input type="email" name="email" required> <textarea name="message" required></textarea> <button type="submit">Send</button> </form>
Try it right here: create a key and send yourself a real submission from this page.
Creating a key accepts the Terms, which incorporate the Privacy Policy and the Data Processing Agreement.
Your key:
Keep your read_token private — it reads the messages people send you,
which are their personal data, not yours.
Set the action on the form you already have, and deploy. No build
step, no dependency, no JavaScript required.
From the very first one, before you have confirmed anything. Nothing waits on you to be safe.
One click, once. Everything held until then arrives in a single digest, in order, with each original date.
The form backend your AI agent can wire up alone
The agent you already have open can finish the job, and the only thing left for you is one click in your inbox.
Paste into Claude Code, Cursor or Codex
Add a contact form to this site using honeyforms.dev. Create the endpoint with my email and paste the snippet into the contact page.
Follow the guide on honeyforms.dev/llms.txt
POST /v1/endpoints → submit_url, read_token, snippet no auth
Machine-readable docs live at /llms.txt and /agents.json.
The honest reason to pick this one is the free tier itself. No trial, no card, nothing expiring. Here is how it sits against what a free form backend usually gives you.
| HoneyForms Free | Typical free plan | |
|---|---|---|
| Submissions per month | 500 | 50–250 |
| Forms on the free plan | unlimited | 1 – unlimited |
| Submission history | 30 days | up to 30 days |
| Honeypot, rate limits, domain lock and Turnstile | ✓ | usually paid |
| Export your data, CSV and JSON | ✓ | usually paid |
| Custom redirect after submit | ✓ | usually paid |
| Nothing dropped past the limit | ✓ | — |
| Endpoint from one unauthenticated API call | ✓ | — |
Each one is a way a contact form dies quietly. These are the mechanisms, not the adjectives.
The honeypot ships hidden inside the snippet, behind rate limits per key and per IP and heuristics on the message — free on every plan. Turnstile is there when you need it, off until you do.
Mail leaves our own authenticated domain with the visitor in Reply-To, so hitting reply answers the person who filled the form — not us, and not a no-reply address.
Past your limit we keep receiving and storing, hold the email, and release everything in one digest when the month turns or you upgrade. The visitor never sees an error.
It has to be — it lives in your HTML. On the first real submission we lock the endpoint to that domain, apex and www together, so a copied key cannot spend your quota.
Autoresponder, webhooks and the REST API, file upload to 5 MB, hosted thank-you page, history kept while you subscribe.
Everything in Pro, plus conditional lead routing, team members, file upload to 25 MB, SMS and WhatsApp alerts, priority support.
| Free $0 |
Pro $9/mo · $90/yr |
Scale $20/mo · $200/yr |
|
|---|---|---|---|
| Available | Not yet | Not yet | |
| Submissions per month, per account | 500 | 5,000 | 20,000 |
| Extra submissions | — | $1 per 1,000 | $1 per 1,000 |
| Endpoints | unlimited | unlimited | unlimited |
| Nothing is ever lost | ✓ | ✓ | ✓ |
| When you go past the limit | held, then delivered in one digest | delivered, extras billed | delivered, extras billed |
| Domain locking | ✓ | ✓ | ✓ |
| Honeypot, rate limits, heuristics | ✓ | ✓ | ✓ |
| Turnstile | ✓ | ✓ | ✓ |
| Custom redirect | ✓ | ✓ | ✓ |
| Endpoint from one API call, no signup | ✓ | ✓ | ✓ |
| History retained | 30 days | while you subscribe | while you subscribe |
| Export CSV and JSON | ✓ | ✓ | ✓ |
| Data processing agreement | published | published | published |
Recipients, cc included | 1 | 5 | 20 |
| Our line in the email footer | yes | removed | removed |
| Autoresponder, webhooks, REST API | — | ✓ | ✓ |
| Hosted thank-you page | — | ✓ | ✓ |
| File upload | — | 5 MB | 25 MB |
| SMS and WhatsApp alerts | — | — | ✓ |
| Conditional lead routing | — | — | ✓ |
| Team members | — | — | ✓ |
| Priority support | — | — | ✓ |
Extras are meant to push an upgrade, not to punish one. At about 16,000 submissions a month, Pro plus extras costs exactly what Scale costs; above that Scale is cheaper, and we say so instead of letting the bill grow quietly.
The questions worth asking about a free service that will be holding messages from your visitors.
The paid plans above are the plan: people whose forms outgrow 500 submissions a month, or who need webhooks, an autoresponder and the REST API, will pay for them. The free tier is not a trial and does not expire — it is how you find out whether the thing works before any of that matters.
Nothing is lost and your form never breaks for the visitor: the endpoint keeps answering normally, keeps receiving and keeps storing. It is the email that waits. Everything held goes out in a single digest, in order and with each original date, when the month resets or the account upgrades. Held submissions are never deleted by retention.
One number the pricing table does not show: before you click the confirmation link, the cap is 50 rather than 500. Confirming lifts it immediately, and nothing received in the meantime is lost.
No. A plain HTML <form> with an action is the whole
integration, and it works with JavaScript disabled, in a browser that never loaded
a framework. The single exception is Turnstile, which needs a widget script — and
it ships off, for exactly that reason.
Not to create an endpoint and not to receive submissions. The key comes back in the
API response, and the confirmation email is the only step that needs a human. You
sign in — with a one-time link, there is no password — when you want the panel:
history, the domain editor, CSV export and your read_token.
The people filling your form own that data, you are its controller and we are the processor. The Data Processing Agreement says so, is published rather than signed, and is incorporated into the Terms by reference — creating a key accepts it, and we record the acceptance with the version that was in force. The Privacy Policy lists what we keep and for how long.
Yes, on the free plan, with no paywall in the way: every submission exports as CSV
or JSON, from the panel or from the API with your read_token. The
snippet is a plain form action, so switching away is editing one
attribute. Nothing here is designed to be hard to leave.
Free, no card. About twenty seconds from here to a snippet you can paste.
Submissions are stored from the very first one, before you confirm anything.