File uploads

Adding a file input

Add a standard file input to your form and give it a name. So that the browser sends the file bytes along with the rest of the fields, the form must encode its body as multipart/form-data:

<input type="file" name="resume" />

Set enctype="multipart/form-data" on the <form> element, or, if you submit with JavaScript, POST a FormData object via fetch (the browser sets the correct multipart encoding for you). The honeypot field from Spam protection works exactly the same way on multipart forms.

Allowed file types

Formcrest validates each upload by its actual content — the file's magic bytes — not by its filename or extension. Renaming malware.exe to resume.pdf will not get it past the filter, because the bytes are inspected directly. The following types are accepted:

• Images: PNG, JPEG, GIF, WEBP
• Documents: PDF, DOCX, DOC
• Spreadsheets: XLSX, XLS
• Text: TXT, CSV

The following are blocked, regardless of how they are named:

• Executables
• Scripts
• HTML
• SVG
• Generic archives and zip files

If an upload fails this content check, that file part is rejected. The text fields in the same submission are still processed normally.

Size and count limits

Limits depend on your plan:

You can include up to 10 files in a single submission by adding multiple file inputs (or one input with the multiple attribute). See Plans & pricing for the full plan comparison.

Where uploaded files appear

Uploaded files are stored with the submission. Open the submission's detail page in the dashboard and each attachment is listed with a Download link, so you can retrieve the original file at any time.

Behavior on the Free plan

File uploads are Pro+. On the Free plan, any file parts in a submission are ignored — they are not stored — but the submission itself is still accepted and its text fields are saved as usual. Upgrade to Pro or Agency to start capturing attachments.

Complete example

This form combines a file input, ordinary text fields, and the _honey honeypot. Point action at your form's endpoint:

<form action="https://api.formcrest.com/v1/submit/abc123"
      method="POST"
      enctype="multipart/form-data">
  <label>
    Email
    <input type="email" name="email" required />
  </label>

  <label>
    Cover note
    <textarea name="message"></textarea>
  </label>

  <label>
    Résumé (PDF, DOCX)
    <input type="file" name="resume" />
  </label>

  <!-- Honeypot: hidden from users, irresistible to bots -->
  <input type="text" name="_honey" style="display:none" tabindex="-1" autocomplete="off" />

  <button type="submit">Apply</button>
</form>

Next, decide who receives the submission in Multiple recipients, or review the field-handling options in Configuration. For a from-scratch HTML walkthrough, see HTML installation.