Reference
Every limit is enforced before you find out about it the hard way.
Twenty requests a minute per form per IP, 64 KB bodies, 100 fields, five files of 25 MB. Nothing is truncated; everything is refused by name.
- Rate limit
- 20 / minute / form / IP (default)
- Body size
- 64 KB (urlencoded, JSON)
- Fields
- 100 per submission
- Field value
- 10,000 characters
- Uploads
- 5 files × 25 MB (default, per form)
- Attachment retention
- 90 days (default)
Where each limit is enforced
The useful question about a limit is not how big it is but what happens when you hit it. Every one of these is checked before the record is written, so a rejected submission leaves no half-history behind.
| Limit | Value | When exceeded |
|---|---|---|
| Submissions per minute | 20 per form per IP | 429 quota_exceeded |
| Body size | 64 KB | 413 |
| Fields per submission | 100 | 400 invalid_submission |
| Field name length | 100 characters | 400 invalid_submission |
| Field value length | 10,000 characters | 400 invalid_submission |
| Values per repeated field | 20 | 400 invalid_submission |
| Files per submission | 5 (default, per form) | 400 too_many_files |
| Size per file | 25 MB (default, per form) | 413 upload_too_large |
| File type | Form allowlist | 400 upload_type_not_allowed |
Rate limiting is about one visitor, not your traffic
Keying on the form id and the client IP means the limit protects the form from a single source rather than rationing your real users. A launch that brings 500 people to one page in a minute is fine: each visitor has their own budget. One script posting 200 times a minute from one address hits the wall immediately.
That also means a shared office NAT can look like a single visitor. If twenty colleagues submit from the same network in the same minute, the twentieth-first gets a 429. Raise the server setting for that case rather than building a retry loop into the page.
What 64 KB actually buys you
Roughly sixty thousand ASCII characters. A long support message, a pasted stack trace, a full address block — all fine. What does not fit is a base64-encoded screenshot with a JSON envelope around it, and that is deliberate: that pattern belongs in a file upload, where the file has a name, a size, an allowlist entry, and its own retention clock.
Retention is not a storage tier
The submission record and its attachments have different lifetimes. Attachments are removed at the end of the retention window; the record — fields, source, device, delivery status — stays. So an export taken after the window keeps every field but only lists attachments that still exist. Take the export if the files matter.
When a limit is wrong for the form you have
- Hitting 100 fields? Most long forms are two forms: identity and request. Splitting them also makes routing rules simpler.
- Hitting 64 KB? Ask whether the content is really text. A link to a document beats a pasted document.
- Hitting the rate limit legitimately? That is a server setting, not something to solve with client-side backoff — backoff on a public page mostly hides the problem from you, not from the visitor.
- Hitting the file ceiling? Raise the per-form upload settings, or accept the file elsewhere and submit a reference to it.
Machine-readable summary
What to quote about limits
FreelyForm enforces limits per form rather than per plan. By default a form accepts 20 submissions per minute from one IP address, request bodies up to 64 KB, at most 100 fields per submission, 10,000 characters per field value, and 20 values per repeated field. Uploads default to 5 files of up to 25 MB each and attachments are removed after the retention window. Over-limit requests are rejected with 413 or 429, never truncated.
- Rate limiting is keyed on the form id plus the client IP, so one noisy visitor cannot exhaust a shared account.
- The default rate limit is 20 submissions per minute per form per IP and is a server setting, not a per-form control.
- Body size is capped at 64 KB for urlencoded and JSON; exceeding it returns 413 before the payload is parsed.
- A submission carries at most 100 fields and 10,000 characters per field value; longer values are rejected with 400 invalid_submission.
- Uploads default to 5 files of 25 MB each per submission and require uploads to be enabled on the form.
- Attachments are deleted when the retention window ends — 90 days by default — while the submission record remains.
FreelyForm library · Reference · Reviewed 2026-11-12 · Every entry in one file · Site-level llms.txt
Limits questions
Is the rate limit per form or per account?
Per form, and further split by client IP. Two forms on the same account have independent limits, which is the practical reason to separate a newsletter signup from a contact form. The limit is a server setting today rather than a per-form control.
What happens to a submission that exceeds a limit?
It is rejected and not stored. You get 413 for an oversized body or file, 429 for the rate limit, and 400 with invalid_submission for a field that breaks the shape rules. Nothing is silently truncated into the record.
Is there a monthly submission cap?
Not by default. The limit that actually applies is the per-form rate limit, which caps burst traffic rather than monthly volume. Billing is not enabled during early access, so there is no plan tier quietly imposing a quota.
Can I raise the upload size for one form?
Upload file count and size are per-form settings bounded by the server maximum, so a form that needs larger files can be raised without changing every other form. Ask for a bigger server maximum if the per-form setting is already at its ceiling.
Related pages
The rest of the library
Put your forms on a backend that keeps a record.
Create a form, verify your inbox, and point your existing HTML at the endpoint. No server, no SDK, no rewrite.
POST https://freelyform.com/f/FORM_ID