To secure an online form, protect two things. First, control access to the links people use: a form passcode or invitation password for the form, a save-for-later passcode for drafts, and a shared URL passcode for shared submissions. Then protect the account that reads submissions with passkeys, two-factor authentication or single sign-on.
Quick Navigation
What you’ll learn
Why form security matters
Forms collect names, addresses, ID numbers, health details and signatures. According to Statista, reported losses from cybercrime in the US exceeded $10.3 billion in 2022.
An online form workflow has four access points to consider:
- The form link: anyone with a public link can open and fill in the form. That does not show them other people’s submissions, but it does let anyone submit.
- Saved drafts: a save-for-later link opens that person’s partly completed answers.
- Shared submission links: the links you share from the Submissions page open a submission, its PDF or its attachments.
- Your account: anyone who signs in can read the submissions that account is allowed to see.
Passcodes and invitation passwords protect the first three. The way your team signs in protects the last one. If your forms collect personal or confidential information, for business, healthcare, HR or legal work, protect all four.
4 ways to protect forms, drafts and shared links
PlatoForms offers four types of access protection. Each one covers a different part of the form’s life:
| Protection type | What it protects | Best for |
|---|---|---|
| Form Passcode | The form itself | Internal forms and restricted audiences |
| Shared URL Passcode | Shared submission links: edit, PDF download, attachments | Sending a submission or its PDF to someone |
| Save-for-Later Passcode | A draft that someone saved to finish later | Long applications filled in over several sessions |
| Invitation Password | One recipient’s invitation link | Forms sent to specific people |
🔐 Want a visual comparison? Check our FAQ on passcodes vs. passwords.
Step-by-step: set up each protection
You can turn on one or several of these. For the three passcodes, PlatoForms generates the code when you turn the option on, and you can change it later.
✅ Method 1: Form Passcode
Purpose: Restrict access to the whole form with one passcode.
Best for: Internal team forms, employee surveys, restricted audiences.
Setup: Go to Form Settings and turn on Form is passcode protected.
✅ Method 2: Shared URL Passcode
Purpose: Protect the submission links you share from the Submissions page.
Best for: Sharing a submission, its PDF or its attachments with someone else.
Setup: Go to Form Settings and turn on Shared URLs are passcode protected.
Once it is on, the shared links for editing a submission, downloading its PDF or opening its attachments all ask for the passcode. You find these links under Submissions > Actions > Share > Submission Sharing.
✅ Method 3: Save-for-Later Passcode
Purpose: Protect a partly completed form that someone saved to finish later.
Best for: Long application forms and questionnaires filled in over several sessions.
Setup: Go to Form Settings, turn on Enable “Save for Later”, then turn on Save-for-later URL is passcode protected.
✅ Method 4: Invitation Password
Purpose: Restrict a form to the specific people you invite.
Best for: Confidential surveys, client onboarding, forms with health or financial details.
Setup:
- Publish your form.
- Open the Invitation panel.
- Turn on Tracking Invitation.
- Check Invitation is password protected.
Each recipient gets an invitation email with an automatically generated password. Because the invitation is tracked, you can also see whether each recipient opened and submitted the form. See Set invitation password.
Video guide: Set up passwords and passcodes
Want to see it in action? Watch our tutorial on securing forms with passwords and passcodes:
Which protection fits your needs?
| Use case | Recommended method | Keep in mind |
|---|---|---|
| Internal staff surveys | Form Passcode | Everyone uses the same passcode, so share it only with the people who need it |
| Sending a submission or its PDF to a client | Shared URL Passcode | Applies to all shared submission links of the form |
| Long, multi-session applications | Save-for-Later Passcode | Turn on Save for Later first |
| Confidential forms for named recipients | Invitation Password | Requires Tracking Invitation |
| Medical forms with protected health information | Invitation Password and HIPAA compliance | HIPAA compliance is available on the Silver or Gold plan |
Secure the account that reads submissions
Passcodes and invitation passwords protect forms, drafts and shared links. Anyone who signs in to an account can read the submissions that account is allowed to see, so the way your team signs in matters just as much.
| Method | How you sign in | What it adds |
|---|---|---|
| Password only | Email and password | A password can be guessed, reused on other sites or typed into a fake login page |
| Password + two-factor authentication | Password, then a 6-digit code from an authenticator app | A stolen password is not enough to sign in. The Team Admin can require it for every member |
| Passkey | Fingerprint, face or device PIN | A passkey only works on the real PlatoForms site, so a fake login page cannot capture it |
| Single sign-on | Your work account at your identity provider | Your identity provider applies your organization’s password and multi-factor rules. Gold plan and above |
A few details worth knowing:
- Passkeys and two-factor authentication work together. A PlatoForms passkey sign-in uses the passkey on your device together with your fingerprint, face or PIN, so PlatoForms does not ask for an authenticator code. Signing in with your password still asks for it.
- To add a passkey, open Account Settings > Passkeys and click Add a passkey. You can keep up to 10, and PlatoForms emails you whenever one is added or removed.
- On HIPAA teams, the page locks after 15 minutes without activity, and the account is logged out after 30 minutes without activity or when the browser closes. With a passkey, you can unlock without typing your password.
- Control access inside the team: manage permissions so only the right members can view or edit each form.
Form security checklist: 10 steps
Who can open your forms
- Protect internal forms with a form passcode
- Send confidential forms by invitation with Invitation is password protected on
- Turn on the shared URL passcode before sharing submission links
- Turn on the save-for-later passcode on long forms
Who can sign in to your account
- Every member adds a passkey on the devices they use, unless the team requires single sign-on
- The Team Admin requires two-factor authentication for all members
- Teams with an identity provider consider requiring single sign-on (passkeys are then not available)
- Give each member only the form permissions they need
How long data is kept
- Set a data retention policy
- For protected health information, enable HIPAA compliance to get the BAA, automatic lock and logout, and the team audit log
Frequently asked questions
How do I password-protect an online form?
In PlatoForms, open Form Settings and turn on Form is passcode protected. A passcode is generated for you, and you can change it later. Only people who enter the passcode can open the form. To give each recipient their own password instead, send the form by invitation with Invitation is password protected turned on.
Can I put a password on a Google Form?
No. Google Forms has no built-in password or passcode setting. Access is controlled through sharing: anyone with the link, people in your organization or a group, or specific people, and some settings require a Google sign-in. If respondents need a code or a personal password, use a form builder that offers one.
How do I restrict access to a Google Form?
Use the form’s sharing settings: give access to anyone with the link, restrict it to your domain or a group of users, or add specific people. Turning on Limit to 1 response also requires respondents to sign in to a Google account.
How can I secure my Google Forms?
Restrict who can respond in the form’s sharing settings, and turn on Limit to 1 response if respondents must sign in with a Google account. Add collaborators only when needed, because a collaborator may also have access to the form’s linked response spreadsheet.
All-in-one form security with PlatoForms
PlatoForms is a form builder and a workspace for the information you collect, with:
- Passcode and invitation password protection
- Passkeys, two-factor authentication and single sign-on
- HIPAA compliance for Silver and Gold teams, with a signed BAA
- Invitation tracking
- AI-powered PDF to online fillable form conversion
Read more: What are the HIPAA-Compliant PDF Form Tools You Can Try For Your Organization?
