Passwords, sign-in and one response per person
Put a password on a form, require respondents to sign in, and limit each person to one response by account or by device.
Password
On the Settings tab, the Password card asks for a password before the form opens. Respondents see a screen headed "This form is locked" with a field for it. Share the password with respondents separately from the link.
- The password is 6 to 200 characters and only the form's owner can set, change or remove it.
- It is stored as a hash, so nobody, including you, can read it back.
- After a correct password, the respondent's browser remembers it for 12 hours.
- Changing the password locks out everyone who had entered the old one.
- Too many wrong guesses pause further attempts for ten minutes.
- To remove it, choose Remove password; the form is then open to anyone with the link.
A password stops casual visitors. It is one shared secret, so it says nothing about who is filling the form in.
Require sign-in
Require sign-in on the Respondents card sends visitors to the Formwork sign-in page before they see the questions, and back to the form afterwards. They need a Formwork account, which they can create from that page. The response is linked to that account.
Pick this when you need to know who answered, for instance for an internal survey. Do not pick it for a public survey that should be easy to fill in: many people will not create an account to answer a form.
One response per person
The One response per person menu has three options.
| Option | How it works | Weak point |
|---|---|---|
| No limit | Anyone can respond as often as they like | None |
| Once per account | Turns on sign-in, and a second attempt by the same account is refused | An account holder can register another account |
| Once per device | A cookie in the browser marks the device as done | Clearing cookies, or using another browser, allows another response |
A refused visitor sees "You have already responded to this form."
Once per account is the reliable option. Once per device is a convenience that deters accidental repeats, not a security measure, and it can stop working inside an embed where cookies may be blocked. Turning off Require sign-in while Once per account is chosen is not allowed; change the second setting first.
These rules interact with the ending screen: when a form is limited to one response per person, the "Submit another response" link is not shown.
What respondents see
Every blocked state has its own friendly page, in the form's own theme: "This form is closed", "Not open yet", "This form is full", "This form is locked" and "You have already responded". The message under the heading is either a fixed sentence or, for closed forms, your closed message.
Plans
Passwords, sign-in rules and one-response rules are access controls, a plan feature. If your plan does not include it, the settings are refused with an upgrade prompt. Removing a password is always allowed.
Related settings
Time limits and response caps are in Opening, closing and limits. Save and continue later, and collecting an email address, are in Respondent experience settings.
Updated Sep 30, 2026