Uploading Files and Images

If you're a Forma Plus user, you will receive 25 GB of storage for files and images. This allows you to accept user-submitted files and store them securely on a private object-storage server.

Form encoding

By default, HTML forms are encoded using the application/x-www-form-urlencoded strategy. When you have an input with type="file" inside of your <form>, any files that get uploaded will be converted into strings using the filename of the uploaded file.

This is a very common problem that people run into. The fix is to use enctype="multipart/form-data" on your <form> instead:

<form action="https://useforma.app/s/[YOUR_FORM_ID]" method="POST" enctype="multipart/form-data">
    <input type="file" name="cv" />
</form>

Maximum file size

For security reasons, Forma will only accept files that are less than 25 MB. Files that are larger than this will be rejected.

You can prevent files larger than 25 MB being uploaded to your form using JavaScript too:

<form action="https://useforma.app/s/[YOUR_FORM_ID]" method="POST" enctype="multipart/form-data">
    <input type="file" id="cv" name="cv" />
</form>

<script>
    const cv = document.getElementById('cv')
    
    cv.addEventListener('change', () => {
        // Don't do anything if no files have been uploaded.
        if (cv.files.length <= 0) {
            return;
        }

        Array.from(cv.files).forEach(file => {
            // Convert the file's size from bytes to megabytes.
            const size = file.size / 1024 / 1024;

            // Don't do anything if the file is less than 25 MB.
            if (size < 25) {
                return;
            }

            // Reset the input's value to remove uploaded files.
            cv.value = null

            alert('Please choose a file that is less than 25 MB.');
        })
    })
</script>

Security

Any files uploaded by the user will not be stored on Forma's server. All files are stored on a remote server provided by Digital Ocean.

These files are not publicly accessible, meaning it's impossible for somebody to gain access to a file without Forma generating the URL on the server.

URLs provided by Forma are signed for 1 hour. If you try to use a link 1 hour after it's original generation time, it will no longer work. You will need to refresh the form's "Submissions" page and get a fresh link.