Handle form submissions
without the backend
Point your HTML form at PostTo, or POST JSON from your server — delivery, spam filtering, and rate limiting are handled either way. No SPF, DKIM, or email infrastructure to configure. Built for your own site or the client sites you maintain — no DNS access needed on their domain. Every submission lands in whatever inbox you verify and choose, plus a full, searchable dashboard.
Free plan, no credit card required.
<!-- Your form. That's it. -->
<form action="https://postto.dev/api/v1/send/token"
method="POST">
<input type="text" name="name" placeholder="Name">
<input type="email" name="email" placeholder="Email">
<textarea name="message"></textarea>
<button type="submit">Send</button>
</form>const crypto = require('crypto');
const ts = Math.floor(Date.now() / 1000).toString();
const body = JSON.stringify({
name: 'Alice',
email: '[email protected]',
message: 'Hello',
});
const sig = crypto.createHmac('sha256', SECRET_KEY)
.update(`${ts}.${body}`).digest('hex');
await fetch('https://postto.dev/api/v1/send/token', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Accept': 'application/json',
'X-PostTo-Timestamp': ts,
'X-PostTo-Signature': sig,
},
body, // exact bytes that were signed
});- Submission data encrypted at rest
- Hosted in Europe
- GDPR-ready
- Free plan, no credit card
Vibe-coded a form? Works with those too
Up and running in minutes
No server setup. No email configuration. Works with HTML forms and server-side APIs.
Create an endpoint
Name it, set a destination email — your own inbox or a client's. Done in 30 seconds from the dashboard.
Integrate your form or backend
HTML form — set the action=""
attribute. No JavaScript needed.
Server-side API — POST JSON from your backend, signed with HMAC-SHA256 for replay protection.
Submissions arrive
Delivered to your inbox and logged to a full, searchable dashboard.
Every submission stored, searchable, and secure
Search, inspect, and manage every submission from a single dashboard. Release held messages, export to CSV, or purge personal data on demand.
Spam filtering, webhooks, signed API — all built in
Built for developers who want form handling done right.
Spam filtering
Baseline honeypot and heuristic checks run on every submission — fully first-party, included on all plans. Starter+ plans can add their own blocked phrases and sender domains on top of the built-in lists. AI-powered classification is optional and off by default: turn it on per endpoint (included on Pro/Scale, $5/mo add-on on Starter). Only borderline submissions are sent on, and if the AI check fails the submission is still delivered.
Full submission dashboard
Every submission is stored and searchable. Inspect what arrived, release anything the spam filter held back, or export everything as CSV.
Own your form HTML
No iframes, no vendor widgets injected into your page. Your form, your design, your field names — PostTo adapts to your markup, not the other way around, even on client sites you don't control the backend of.
No email infrastructure
We handle SPF, DKIM, sender reputation, and bounce processing through Lettermint, a fully European email provider. You just receive emails — zero deliverability headaches.
Autoresponders
Automatically send a confirmation email to the person who submitted your form. Customise the subject and message — one less thing to build yourself.
Rate limiting
Per-endpoint rate limits and smart per-IP bucketing keep abuse in check — no gaming the limits. Your monthly quota only counts emails actually delivered, not submissions received, so bot spam never eats into your allowance.
Signed API mode
Server-side integrations can sign each request with HMAC-SHA256. PostTo verifies the timestamp and signature — blocking replay attacks and forged requests. Use from any language, no SDK needed.
Webhook fan-out
Forward every submission to your app, CRM, or Slack via a signed webhook. Each outbound request is HMAC-SHA256 signed so your server can verify it came from PostTo.
Privacy & GDPR-ready
Submission content is encrypted at rest. Set a retention period per endpoint — personal data is purged automatically on schedule. Need it gone sooner? Purge any submission manually from the dashboard.
Notifications in 10 languages
Building for a client or audience that doesn't read English? Set the notification email's language per endpoint — Norwegian, Swedish, Danish, German, French, Spanish, Italian, Portuguese, Greek, or English.
One-line migration
The Formspree and Netlify Forms alternative built for developers
Switching is a single change to your form's action=""
attribute. PostTo adds the things others don't offer.
Hosted in Europe
GDPR-native from day one. Submission data stays within European borders. No transatlantic transfers for baseline operation — unlike Formspree, Basin, and Netlify Forms.
Encryption at rest, always
Every submission field — names, messages, emails — is AES-256 encrypted at rest on every plan, including Free. Not an enterprise add-on.
HMAC-signed API mode
Server-side integrations can sign every request with HMAC-SHA256 — timestamp + body — blocking replay attacks and forged payloads. No other form backend offers this natively.
Nothing silently dropped
Spam-flagged submissions are held in your dashboard for review — never silently discarded. Release any message for delivery with one click.
Autoresponders included
Automatically send a personalised confirmation email to whoever submitted your form. Configure subject and body once per endpoint — PostTo handles delivery.
Free plan, no credit card
Start for free with no credit card required — not a trial, a real free tier. Every paid plan includes metered overage so you're never hard-blocked mid-month.
Already using Formspree, Basin, or Netlify Forms?
Update your form's action=""
to your PostTo endpoint URL. That's the entire migration.
Simple, transparent pricing
Start free. Upgrade when you need more.
Free
- 50 emails / month
- 1 endpoint
- 7-day submission history
- Full submission dashboard
- AI spam
- Webhooks
Starter
- 1,000 emails / month
- Up to 50 overage emails/mo (max $0.45)
- 3 endpoints
- 30-day submission history
- Full submission dashboard
- Custom field mapping
- Custom spam blocklist
- AI spam ($5/mo add-on)
- Webhooks
Pro
- 5,000 emails / month
- Up to 250 overage emails/mo (max $1.50)
- 25 endpoints
- 90-day submission history
- Full submission dashboard
- Custom field mapping
- Custom spam blocklist
- AI spam filtering included (opt-in)
- Custom sender name
- Autoresponders
- 3 webhooks per endpoint
Scale
- 25,000 emails / month
- Up to 1,250 overage emails/mo (max $5.00)
- Unlimited endpoints
- 365-day submission history
- Full submission dashboard
- Custom field mapping
- Custom spam blocklist
- AI spam filtering included (opt-in)
- Custom sender name
- Autoresponders
- Unlimited webhooks per endpoint
All plans include baseline spam filtering, CORS handling, and email delivery via Lettermint — fully European email infrastructure. See the full plan comparison →
Questions & answers
Everything you need to know about PostTo.
Questions & answers
Everything you need to know about PostTo.
Set your form's action
attribute to your PostTo endpoint URL and method="POST".
That's it — no JavaScript, no SDK, no changes to your form's markup or design.
POST JSON to your endpoint URL from your backend and sign the request with HMAC-SHA256. PostTo verifies the timestamp and signature on every request, blocking replay attacks and forged submissions. Code examples for Node.js, PHP, Python, and Laravel are available in the endpoint dashboard.
It's held, never deleted. Every submission — including spam-flagged ones — is retained in your dashboard so you can review and release it for delivery at any time. Nothing is silently dropped.
Yes. Add a webhook URL to your endpoint and PostTo will POST a signed JSON payload to it on every successful delivery. Each payload is signed with HMAC-SHA256 so your server can verify it came from PostTo.
Submission content is encrypted at rest. You set a retention period per endpoint and PostTo automatically purges personal data when it expires. You can also purge any individual submission manually from the dashboard at any time to fulfil data-subject erasure requests.
Only if you turn it on. Baseline spam filtering — honeypot and heuristics — runs entirely on our own European infrastructure and is always on; no submission data leaves PostTo. AI classification is optional and off by default, even on Pro and Scale: you enable it per endpoint and consent to Anthropic as a sub-processor (covered by a DPA) before any data is sent. Even then, only borderline submissions our baseline can't decide are classified — and if that call fails, the submission is delivered anyway, never dropped.
No — and that includes client domains you don't control. PostTo handles delivery through Lettermint, a fully European email provider, so there's nothing to configure on your domain or a client's. You just receive the emails at whatever address you verify.
Yes — many developers and agencies run PostTo across every client site they maintain: one endpoint per site, each with its own destination inbox, and no DNS access needed on the client's domain. See the client website contact forms guide for the full walkthrough.
No. PostTo accepts any field names your form uses. Field mapping lets you tell PostTo which of your fields corresponds to the subject, message, reply-to email, and sender name — so you don't have to rename anything in your markup.
Yes. PostTo is commonly used as an alternative to
Formspree, Basin, and Netlify Forms. The main differences: PostTo is hosted in Europe (GDPR-native), every submission
is
stored and searchable in a full dashboard with encryption at rest, server-side integrations can use HMAC-SHA256 signed
mode, and AI-powered spam filtering is included on the Pro and Scale plans (a $5/mo add-on on Starter). Switching
is a one-line change — just update
your
form's action
attribute.
PostTo is hosted in Europe and operated by a European company. Submission content is encrypted at rest, and personal data is automatically purged after the retention period you configure per endpoint. This makes PostTo a GDPR-native choice for European projects and any project that needs to keep data within European borders.
An autoresponder sends an automatic confirmation email to the person who submitted your form. You write the subject and body once in the dashboard — PostTo sends it on every submission that includes a valid email address.
No. New accounts land directly on the Free plan — 50 emails a month with full dashboard and API access, no trial period and no card required. Upgrade whenever you actually need more volume.
Paid plans don't hard-block you mid-month. Once you cross your quota, PostTo keeps delivering and meters a limited amount of overage, billed at the end of the period — so a traffic spike doesn't take your forms down. The Free plan has no overage; submissions are rejected once the 50/mo limit is reached until the next cycle. Either way, only emails actually delivered count toward your quota — spam and bot traffic that gets filtered out never touches it.
By default, PostTo shows a simple success page.
You can customize the redirect URL, page title, message, and back-button text per endpoint — or override it
per-request with a hidden _next
field in the form itself.
Yes — set a domain allowlist per endpoint to control which origins are allowed via CORS in the browser. Keep in mind this is a soft control: it stops accidental cross-site use from a browser, but a non-browser client can forge the Origin header, so it isn't a substitute for the token (and HMAC signature in signed mode), which is the real authentication.
Get in touch
Question, bug, or feature request? This form is a live PostTo integration — signed server-side with HMAC-SHA256, the same signed API mode you'd use from your own backend.
Your first endpoint is live
in under a minute
Free plan, no credit card required.
Create your free account