Open Source Form Builder
A form is the front door to your data, and every response inherits wherever the builder decided to store it - a fact respondents never see when they hand over an address, a phone number, or a medical detail. The tools here answer different jobs behind one label: quick surveys, operational forms with logic and file uploads, forms that exist mainly to feed an API, and conversational flows that ask one question at a time. Open source lets the submissions land in a database you run, so the personal data people trust you with never has to live on infrastructure you do not control, and the form definition stays in a format you can export.
Formbricks
Open source experience data hub for in-app, website, link, and email surveys
Typebot
Fair Source chatbot builder for websites and apps, with visual flows, embeds, and real-time results
HeyForm
Open-source form builder for surveys, quizzes, polls, and conversational forms
ONLYOFFICE Docs
Collaborative online office suite for documents, spreadsheets, presentations, forms, PDFs, and diagrams
OpnForm
Open-source form builder for unlimited forms, submissions, and data you control
Form.io
Self-hosted form and API platform for building serverless data collection apps
Keila
Open source email newsletter tool for campaigns, sign-up forms, and self-hosted sending
TDuck
Privatizable survey and form system with drag and drop design, analysis, and webhook sync
Nextcloud Forms
Self-hosted surveys and questionnaires for Nextcloud with CSV export and private responses
Our picks
Pick by the kind of form you run - survey, operational form, API, or conversation.
Best general-purpose form builder: OpnForm OpnForm is a no-code builder for unlimited forms and submissions that runs self-hosted or as a managed cloud service. It supports logic, file uploads, embedding, captcha protection, and analytics, and notifies through Slack, webhooks, and Discord. The AGPL core keeps your submissions on infrastructure you control.
Best for in-product surveys: Formbricks Formbricks is a privacy-first survey platform that gathers feedback across in-app, website, link, and email surveys, and can target specific user groups without changing application code. A no-code editor and templates cover common research patterns, and it self-hosts with Docker so response data stays on your own servers. It fits product research more than operational forms.
Best form-as-API for developers: Form.io Form.io pairs a drag-and-drop builder with an API engine, so every form is automatically backed by a REST API and submissions become structured data. Forms embed directly into Angular and React apps through a custom element, and it self-hosts on Docker or Node.js with MongoDB. It suits teams building data collection into an application rather than standalone surveys.
Best for conversational forms: Typebot Typebot builds chatbot-style forms as visual flows that ask one question at a time, with branching, inputs, scripting, and A/B testing across many building blocks. It embeds as a container, popup, or chat bubble, collects results in real time with CSV export, and self-hosts on your own server. Conversational forms often convert better than a long static form.
Where submissions land, and how the schema holds up
Two questions decide most of this: what kind of form you are running and where its answers end up. A quick survey has modest needs - Nextcloud Forms keeps responses inside an existing Nextcloud instance and exports clean CSV, which is plenty for questionnaires. Operational forms are a different animal: inspections, applications, and intake need conditional logic, repeatable sections, file uploads, and stable field identifiers. HeyForm and OpnForm cover logic and uploads with a no-code builder, while TDuck adds subforms, cascades, and submission limits by IP and device for higher-stakes data entry.
Where submissions live is the decision that ages worst if you get it wrong. Some builders own the database; others are really a front end posting to webhooks, email, or storage. Form.io is explicit about this - every form is backed by a REST API, so the submission model is the API itself, which suits developers embedding forms in Angular or React apps. For public forms, weigh spam controls, rate limits, and file upload handling as heavily as input types, and confirm whether personally identifiable answers can be kept out of plain-text email notifications by default.
The runtime surface deserves as much attention as the editor. If forms embed in a marketing site or product, test the markup, theming, accessibility, and localization; if a team manages them, check that editing, viewing submissions, and exporting are separate permissions. Typebot is worth a look when a conversational, one-question-at-a-time flow will convert better than a wall of fields.
Related categories
Frequently asked questions
Where do form submissions actually go?+
It depends on the architecture, and it is the first thing to confirm. Nextcloud Forms keeps responses inside your Nextcloud instance; OpnForm and HeyForm store submissions in their own database and can also fire webhooks and email; Form.io turns every form into a REST API where the API is the store. Before committing, pin down the source of truth, the export format, where attachments live, and whether field IDs stay stable across edits.
Which of these handle conditional logic and multi-step forms well?+
Several do, with different depth. HeyForm and OpnForm support conditional logic and redirects in a no-code builder, and TDuck adds conditional display rules, subforms, and cascades for more complex data entry. Typebot handles branching as part of its conversational flow. Test the edge case that breaks logic most often: changing an earlier answer after later steps are already filled in, and confirm validation works per step rather than only at the end.
What happens to old submissions when I change a form?+
This is the quiet risk in every form builder. Renaming a field, changing a required rule, or splitting one question into three should not make earlier records unreadable or corrupt exports. Tools that store the form definition as portable JSON and keep stable field identifiers hold up best; exports built only on display labels get fragile after edits. Test a schema change against existing submissions before you rely on the tool for anything important.
How should I evaluate file uploads?+
File uploads bring storage, security, and compliance obligations, so check them specifically. HeyForm, OpnForm, TDuck, and Form.io all support file inputs, but the details differ - maximum size, allowed types, where files are stored, and who can access them. TDuck, for example, can store attachments on S3-compatible backends, Aliyun, or local disk. Also test export behavior, since some tools export only metadata while the actual files stay in object storage.
Which of these fit simple surveys versus operational forms?+
Match the tool to the stakes. For straightforward surveys and questionnaires, Nextcloud Forms and Formbricks are clean and quick, with Formbricks adding in-app, website, and email targeting for product feedback. For operational forms - applications, inspections, internal approvals - favor OpnForm, HeyForm, or TDuck, which handle logic, uploads, and stable schemas. Using a heavyweight operational builder for a two-question poll is as awkward as the reverse.
Can I build a conversational, chatbot-style form?+
Yes. Typebot is designed for exactly that, with a visual canvas of building blocks that ask one question at a time and support branching, inputs, scripting, and A/B testing. It embeds as a container, popup, or chat bubble and collects results in real time with CSV export. Conversational flows often complete better than a long static form, so it is worth testing when drop-off is a problem.
What security features matter for public-facing forms?+
Public forms need more than TLS. Look for spam protection and rate limiting, input validation, file upload restrictions, and safe error messages. OpnForm includes captcha protection, and TDuck can limit submissions by IP, device, and attempt count. For sensitive answers, check encryption at rest, audit logs, permission boundaries, and retention controls, and make sure email notifications do not expose the submitted data in plain text by default.