An encrypted form, in the sense that matters for sensitive answers, is one where each response is encrypted in the respondent's browser before it is submitted, to a key only the form owner holds. The form service stores ciphertext and cannot read the answers. To create one, you need a form builder that works this way; you cannot turn an ordinary form into one with a setting, because the encryption has to happen before the answer leaves the respondent's device.
Almost every form builder can say "encrypted", and almost every one is telling the truth about something. The question is which of three things the word covers.
Three things "encrypted form" can mean
Encrypted in transit. The page is served over HTTPS, so the answers are protected between the respondent's browser and the form provider's servers. Every reputable form tool does this. It says nothing about what happens once the answers arrive.
Encrypted at rest. The provider encrypts its disks or database, with keys it manages. This protects against someone walking off with a hard drive. The provider's own systems decrypt the data whenever they need it — to show you a dashboard, run a chart, send an email notification with the answers in it, or answer a legal request — so the provider can read every response.
End-to-end encrypted. Each response is encrypted on the respondent's device to the form owner's public key. The provider receives and stores only ciphertext, and only the owner's private key, which the provider never holds, can decrypt it. This is the only one of the three where the form host cannot read the answers.
The one-line test: if the form service can show you a chart of your responses, email you the answers, or recover them after you lose your password, it can read them. That is not a flaw in those products; server-side features need readable data. It is just not an end-to-end encrypted form.
When you need one
Use an end-to-end encrypted form when a readable copy of the answers sitting with a third party is itself the risk: a health history or intake questionnaire, a legal intake form describing a client's situation, a financial or identity questionnaire, a whistleblower or HR complaint, a membership application with personal details. For those, the provider's storage is one more place the answers can leak from, be subpoenaed from, or be read by staff.
You probably do not need one for a newsletter signup, an event RSVP, a product survey, or anything where the answers would not hurt anyone if they leaked. An ordinary form builder is simpler there, and gives you analytics, integrations and automations that an end-to-end encrypted form cannot.
An end-to-end encrypted form is also not a compliance certificate. Laws such as HIPAA or the FTC Safeguards Rule ask for outcomes — encryption, access control, vendor agreements, retention — across your whole process. Encrypting the form covers one part of that; the rest is still yours to do.
How an end-to-end encrypted form works
- The owner has a key pair. When you set up the form builder, your browser creates a private key that stays with you (protected by your password) and a public key that can be published.
- The form link carries the public key. When a respondent opens the form, the page gets the public key it will encrypt to.
- The respondent's browser encrypts the answers. On submit, the answers are encrypted locally to your public key. What leaves the device is ciphertext.
- The server stores ciphertext. It can see metadata — how big a response is, when it arrived, the connection it came from — but not the answers.
- You decrypt in your browser. When you open your responses, your browser uses your private key to decrypt them locally and shows them to you.
The honest limit of any web-based version: the provider serves the JavaScript that does the encryption, and the public key the respondent encrypts to. A compromised provider could, in principle, serve altered code. Good implementations reduce that risk with a strict Content-Security-Policy, no third-party scripts on the form page, and open-source cryptography that can be reviewed — but the accurate claim is "encrypted in the browser, ciphertext at rest", not "impossible for the provider to ever read".
What you give up
End-to-end encryption removes everything that needs the server to read your answers:
| Feature | Ordinary form builder | End-to-end encrypted form |
|---|---|---|
| Charts and summaries on the provider's dashboard | Yes | No; you decrypt and view responses in your browser |
| Answers included in notification emails | Often | No; the server has nothing readable to send |
| Integrations that push answers into other apps | Often | No, unless they run in your browser |
| Recover responses if you lose your password and recovery key | Usually | No; without your key the ciphertext stays unreadable |
| Provider can read the answers | Yes | No |
If you need those features more than you need the provider to be unable to read the answers, an ordinary form builder with good access controls is the right tool.
How to create an encrypted form with ShieldFive Secure Forms
ShieldFive Secure Forms is an end-to-end encrypted form builder. Creating a form:
- Sign up for a free ShieldFive account. You need one because responses are encrypted to keys that belong to you; respondents never sign up.
- Build the form. Question types are short text, long text, single choice and date, and each question can be required or optional. You can set a cap on the number of responses and a date after which the form closes.
- Publish it and share the link. The form's title and questions are encrypted too, with a key carried in the link, so a form on a sensitive topic is not readable on our servers either. A link without its key is refused.
- Respondents open the link and answer, with no account. Each response is sealed in their browser to your public key, a hybrid of ML-KEM-1024 and X25519 through the open-source @shieldfive/crypto library, before it is sent.
- Open your responses. Your browser decrypts them locally and shows them in a table.
What it does not do: there are no file-upload questions, no conditional logic, no charts or analytics on our side, and no integrations that push answers elsewhere. To collect documents rather than answers, ShieldFive File Request uses the same approach for files. For what the server can and cannot see, the JavaScript-delivery limit and how team access works, read how Secure Forms encryption works.
Price: for 14 days there is no limit on open forms; after that the free plan allows 1 active form at a time, no card. Seats at €29 per seat per month give unlimited active forms and a shared response inbox. Respondents never pay.