An open-source, self-hostable alternative to Typeform: one-question-at-a-time forms served from your own server.
Build
- 20 block types - short/long text, email, phone, choices, picture choice, ranking, opinion scale, NPS, rating, date, file upload, and more
- Branching logic, answer recall ("Hi {{name}}"), hidden fields, multiple endings with redirects
- 6 built-in themes with a WCAG contrast guard, fonts bundled (zero CDN), 8 ready-made templates
Collect & share
- One-question-at-a-time runtime with full keyboard navigation and screen-reader announcements
- Share links, QR codes, workspace subdomains, and five embed modes (inline, popup, slider, popover, side tab) via a 3 KB dependency-free script
- Drop-off analytics per question, response limits, close dates, per-form retention
Own your data
- Single Docker compose stack: app + Postgres + Caddy (automatic HTTPS) - no Redis, no object store, no phone-home
- Zero external runtime dependencies: after
docker compose pull, Formbit serves every page, font, icon and script from itself; an air-gapped instance is fully functional - Security: scrypt passwords, TOTP 2FA with recovery codes, append-only audit log, SSRF-guarded webhooks, signed payloads, RBAC - see
SECURITY.mdand the SOC 2 mapping
You need: a VPS (1 vCPU / 1 GB RAM / 10 GB disk is plenty), a domain, and 10 minutes.
1. Point your domain at the server (do this first; DNS propagates while you work):
create an A record forms.example.com → your.server.ip.
(Optional, for workspace subdomains later: also *.forms.example.com → your.server.ip.)
2. Install Docker (skip if installed):
curl -fsSL https://get.docker.com | sh3. Get Formbit:
git clone https://github.com/Bytte-cloud/Formbit.git /opt/formbit && cd /opt/formbit
cp .env.example .env4. Configure - two generated secrets, three edits:
sed -i "s|^APP_SECRET=$|APP_SECRET=$(openssl rand -hex 32)|" .env
sed -i "s|^POSTGRES_PASSWORD=$|POSTGRES_PASSWORD=$(openssl rand -hex 16)|" .env
nano .env # set APP_URL, ROOT_DOMAIN and ACME_EMAIL to your domain/email5. Launch:
docker compose up -d6. Open https://forms.example.com. The first account you create becomes the instance owner - there are no seed scripts and no default admin password.
(Caddy obtains and renews your TLS certificate automatically. First start takes ~30 s: database init, migrations, certificate issuance.)
If something's wrong: docker compose logs app - Formbit refuses to start with a plain-English explanation of any misconfiguration. Common gotchas: ports 80/443 blocked by your provider's firewall; DNS not propagated yet (dig forms.example.com should return your server IP); a bind-mounted uploads dir not owned by uid 1001.
| Guide | What's in it |
|---|---|
| Self-hosting | Full walkthrough: DNS, compose, TLS (single domain, wildcard subdomains, on-demand), SMTP + SPF/DKIM/DMARC, other reverse proxies, troubleshooting |
| Configuration | The complete environment-variable registry - every var, type, default |
| Backup & restore | scripts/backup.sh, the APP_SECRET escrow warning, restore runbook, DR drills |
| Upgrading | Pull-and-up upgrades, auto-migrations, rollback caveats |
| REST API | /api/v1 reference: auth, pagination, rate limits, webhook signature verification |
| Embedding | Five embed modes, snippets, the iframe resize protocol, embedDomains |
| Architecture | The monolith at a glance: tables, form versioning, delivery queue |
| Compliance | SOC 2 CC mapping, hardening checklist, data map |
Development setup, PR rules and code conventions live in CONTRIBUTING.md. The binding technical contract for all contributions is docs/spec/CONTRACT.md.
Found a security issue? Please follow SECURITY.md - coordinated disclosure, 90-day window.
MIT © 2026 Formbit contributors