# Web3Forms alternative: Ikiform vs Web3Forms

> Ikiform vs Web3Forms compared honestly: email-first forwarding versus a stored, validated backend, with a migration guide for access_key forms.

Checked 2026-10-24 · https://ikiform.com/alternatives/web3forms

Web3Forms started as a way to get form submissions into your inbox with nothing but an access key in a hidden input. Its free plan is generous, its setup is a copy-paste, and its paid plans add webhooks, attachments, domain restriction and a submissions API.

Ikiform is built the other way around. Every submission is stored first, then delivered by signed webhook and email. If the inbox is the destination, Web3Forms is simpler. If your app or your team's tools are the destination, Ikiform's delivery and validation matter more.

> Checked on October 24, 2026 against Web3Forms's public pricing pages and docs. Ikiform makes this comparison; every Ikiform fact comes from our own docs. Prices and limits change, so the sources are listed at the end.

## At a glance

| Feature | Ikiform | Web3Forms |
| --- | --- | --- |
| Free plan | None. Every plan is paid | 250 submissions a month, unlimited forms and domains |
| Paid plans | Pro from $6/mo for 500 submissions, up to $399/mo for 1,000,000. Every feature on every tier. Yearly is 10 months' price for 12 | Starter, Pro and Agency. Current prices are on their pricing page |
| How a form is identified | A form id in the endpoint URL | A public `access_key` sent as a hidden field |
| File uploads | Not supported yet. A post with a file gets `422 files_not_supported` | Paid plans. Single files up to 5 MB, or the advanced uploader for more |
| Webhooks | 3 endpoints per workspace, signed with HMAC-SHA256, 9 attempts over about 3 d 6 h, with delivery logs | Paid plans. JSON over HTTPS with automatic retries. The docs don't describe a signature |
| Spam protection | Honeypot (`_gotcha`), content scoring, per-form rate limits, allowed domains and an optional Cloudflare Turnstile check, with no keys needed | Server-side spam checks and free hCaptcha. reCAPTCHA, Turnstile and domain restriction are paid. The `botcheck` honeypot is deprecated in their docs |
| Autoresponder and CC | No. Ikiform only emails you, not the person who filled in the form | Paid plans |
| API | REST API with scoped secret keys, plus the `@ikiform/sdk` TypeScript package | Submissions API on paid plans |
| Data location | Cloudflare, with the database in Asia-Pacific. EU Standard Contractual Clauses in the DPA | Servers in the United States, US-East region, per their FAQ |

## Where Web3Forms is the better choice

- You want a contact form that emails you, for free. 250 submissions a month at no cost is hard to argue with.
- You want the person who filled in the form to get an automatic reply, or a CC to a colleague. Both exist on Web3Forms paid plans; Ikiform has neither.
- Your form needs attachments. Web3Forms accepts files on paid plans; Ikiform doesn't yet.
- You'd rather not create a form in a dashboard first. An access key is all the form needs.

## Where Ikiform is the better choice

- You need to prove a webhook came from your form backend. Ikiform signs every delivery with HMAC-SHA256; Web3Forms' webhook docs list HTTPS and retries but no signature.
- You want submissions kept and searchable, with spam stored separately for review, instead of relying on what reached your inbox.
- You want invisible spam protection without a paid plan's captcha: Ikiform's scoring, rate limits and Turnstile check run on every tier.
- You want the server to reject a bad email address or a missing required field, and return errors your form can show next to each input.
- You post from code. Ikiform answers JSON requests with JSON and a submission id, and the TypeScript SDK and REST API come with every tier.

## Who should pick which

Pick Web3Forms if the job ends in your inbox and you want it free. It is the shortest path from a static page to an email.

Pick Ikiform if submissions need to reach your own systems, be verified on arrival, and be validated before they're stored.

## Migrating from Web3Forms

Web3Forms reads plain field names like `subject` and `redirect` and identifies the form by `access_key`. Ikiform uses the URL to identify the form and `_`-prefixed names for instructions, so a few renames do most of the work.

### Field mapping

| Web3Forms | Ikiform | Notes |
| --- | --- | --- |
| `action="https://api.web3forms.com/submit"` | `action="https://ikiform.com/f/frm_..."` | One endpoint per form, copied from the dashboard. |
| `access_key` | Remove it | Not needed. Left in, it would be stored as an ordinary field. |
| `subject` | `_subject` | A plain `subject` is stored as an answer. Rename it to set the notification subject. |
| `redirect` | `_redirect` | Must be `https:` on an allowed domain, or set **Redirect after submit** in the dashboard. |
| `replyto` | `_replyto` or an `email` field | Notification emails already reply to a field named `email`. |
| `from_name` | None | Ikiform sends notifications from its own address. Drop the field. |
| `ccemail` | None | Add recipients in the form's notification settings, up to 10. |
| `botcheck` | Honeypot field setting | Set **Honeypot field** to `botcheck` and keep the input, or rename it to `_gotcha`. |
| hCaptcha div and `client/script.js` | Spam check: Ikiform | Remove both. For HTML form posts, Ikiform's human check runs Turnstile with no script on your page. `fetch` posts need a token from the SDK's `challenge` function. |
| `webhook` hidden field | Webhook endpoint in the dashboard | Webhook URLs live in your workspace, not in the page, so visitors can't see or change them. |
| `attachment` file input | None | Not supported yet. |

### Before and after

**Web3Forms** (`contact.html`)

```html
<form action="https://api.web3forms.com/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY_HERE" />
  <input type="hidden" name="subject" value="New contact message" />
  <input type="hidden" name="from_name" value="Example site" />
  <input type="hidden" name="redirect" value="https://example.com/thanks" />
  <input type="checkbox" name="botcheck" style="display: none" />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  <div class="h-captcha" data-captcha="true"></div>
  <button type="submit">Send</button>
</form>
<script src="https://web3forms.com/client/script.js" async defer></script>
```

**Ikiform** (`contact.html`)

```html
<form action="https://ikiform.com/f/frm_xxxxxxxxxxxxxxxx" method="post">
  <input type="hidden" name="_subject" value="New contact message" />
  <input type="hidden" name="_redirect" value="https://example.com/thanks" />
  <input type="checkbox" name="botcheck" tabindex="-1" autocomplete="off" hidden />
  <input type="email" name="email" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>
```

### Steps

1. Create an Ikiform form and copy the endpoint.
2. Add your notification recipients and your site's domains in the form settings.
3. Set **Honeypot field** to `botcheck`, or rename the input to `_gotcha`.
4. Remove `access_key`, `from_name`, `ccemail`, the hCaptcha div and the Web3Forms script.
5. Rename `subject` to `_subject` and `redirect` to `_redirect`.
6. If you posted with `fetch` and JSON, keep the call, change the URL and make the same changes in the body: drop `access_key` and `from_name`, rename `subject` to `_subject`, and drop `redirect`, since JSON posts get a JSON answer instead of a redirect. Navigate in your own code when the answer is `ok`.
7. Send a test, check it in the dashboard, then delete the old access key in Web3Forms.

### What doesn't carry over

- Autoresponders, CC emails and file attachments have no Ikiform equivalent.
- There is no free tier to move to.

## FAQ

### Is the Web3Forms access key a secret?

No, and Web3Forms says so: it works like an email alias. Ikiform's form id is public in the same way. The difference is that Ikiform also lets you limit posts to your own domains on every tier.

### Why rename `subject` to `_subject`?

Ikiform treats every name without a leading underscore as an answer to store. Names starting with `_` are instructions, so `_subject` sets the email subject and isn't saved as data.

### Does Ikiform store my submissions?

Yes. Received submissions are kept until you delete them, and spam is kept for 30 days so you can rescue false positives. You can export them as CSV or read them with the API.

### Can I keep hCaptcha?

Not directly. Ikiform supports Cloudflare Turnstile, either run by Ikiform with no keys or with your own keys. Remove the hCaptcha widget when you switch.

## Related docs

- [Reserved fields](https://ikiform.com/docs/html.md#reserved-fields)
- [Human check with Turnstile](https://ikiform.com/docs/spam.md#human-check)
- [Fields and validation](https://ikiform.com/docs/fields.md)
- [Posting JSON with fetch](https://ikiform.com/docs/frameworks.md)
- [Exporting submissions](https://ikiform.com/docs/guides/export.md)

## Sources

Checked on October 24, 2026.

- [Web3Forms pricing](https://web3forms.com/pricing)
- [Web3Forms pro features](https://docs.web3forms.com/getting-started/pro-features)
- [Web3Forms all options example](https://docs.web3forms.com/getting-started/examples/advanced-all-options)
- [Web3Forms webhooks](https://docs.web3forms.com/getting-started/pro-features/webhooks)
- [Web3Forms file attachments](https://docs.web3forms.com/getting-started/pro-features/file-attachments)
- [Web3Forms FAQ (GDPR and servers)](https://docs.web3forms.com/getting-started/faq)

## Trademarks and accuracy

Web3Forms and the other product names on this page are trademarks of their owners. Ikiform isn't affiliated with, endorsed by or sponsored by any of them. What this page says about Web3Forms comes from its public pricing pages and docs as of October 24, 2026, linked under Sources. If anything here is wrong or out of date, email [hello@ikiform.com](mailto:hello@ikiform.com) and we'll correct it.