rapidform / Documentation

File Uploads

The File Upload field type lets respondents attach files to their form submissions.

Available on Pro and Business plans.

Adding a File Upload Field

  1. Open the form builder.
  2. Click File Upload in the field type list.
  3. Configure the field label and required status.
  4. Save the form.

If you're on the free plan, the File Upload field type is disabled in the builder.

Allowed File Types

Respondents can upload files with the following extensions:

Category Extensions
Images jpg, jpeg, png, gif, webp
Documents pdf, doc, docx
Spreadsheets xls, xlsx, csv
Other txt, zip

Files with other extensions are rejected with a validation error.

File Size Limit

The maximum file size is 10 MB per file. Files exceeding this limit are rejected with a validation error.

Drag-and-Drop Interface

The file upload field displays a drop zone where respondents can:

  • Click to open the file picker.
  • Drag and drop a file directly onto the zone.

After selecting a file, the file name is displayed in the drop zone so the respondent can confirm their selection.

File Storage

Uploaded files are stored securely in cloud storage (R2/S3-compatible). Files are organized by form slug under a submissions/ prefix.

Accessing Uploaded Files

In Submissions

When viewing a submission that includes file uploads, the file field shows:

  • File name
  • File size
  • MIME type

Files are accessible via signed download URLs. These URLs are time-limited and cannot be guessed, ensuring only authorized users can download uploaded files.

In CSV Exports

When exporting submissions to CSV, file upload fields contain signed download URLs rather than the file content itself.

Security

  • Files are validated on the server for type and size before storage.
  • Uploaded files are not publicly accessible. All access goes through signed URLs.
  • File names are preserved for display but storage paths use secure, unique identifiers.
  • File content is not scanned for viruses — if this is a concern, consider adding your own post-processing via webhooks.
← Previous Spam Protection