Forms · Glossary
What is a hidden field in a form?
A hidden field is a form field the respondent never sees or fills in. Its value is set before or during the visit, usually from a parameter added to the form link, such as the campaign that sent the person, and it is saved with the response exactly as if it had been answered.
Hidden fields answer the questions people are bad at answering about themselves, such as which email or poster brought them to the form. They are also easy to trust too much, because anything that arrives in a link can be changed by anyone who can edit a link.
Indunil Asanka · Co-founder
5 min read · Published
| Use | Typical value | Where the value comes from | Watch out for |
|---|---|---|---|
| Campaign source | newsletter, poster, partner | A source or campaign parameter on the link | Links shared onward still carry the original tag |
| Referring page | The pricing page address | The page that embeds or links to the form | Blank when the visitor typed the address or the browser withholds it |
| Customer or order reference | A reference number | A personalised invitation link | Turns an anonymous survey into an identified one |
| Test group | a or b | The link each group receives | Links forwarded between groups mix the results |
| Location | store_12 | A link or QR code printed at each site | One photographed QR code shared everywhere |
How the value gets in
On an ordinary web page the mechanism is an input element of type hidden, which MDN describes as completely invisible in the rendered page, yet still submitted with the form like any other input. Survey platforms offer the same idea under other names. One widely used platform calls it embedded data and another calls it custom variables, and both take the values as parameters on the end of the survey link. On at least one of them there is a catch worth knowing: a value only reaches the downloaded data if the field was declared in the survey setup first. In every case the principle is identical: the link carries a value, and the response keeps it.
Why teams use them
The classic reason is attribution. Asking people where they heard about a business produces vague, forgotten or flattering answers, while a tag on each link records the channel without asking anything. The second reason is joining data. A customer reference in an invitation link lets a satisfaction response be matched to the order it is about, so nobody has to type an order number from memory. The third is running comparisons: two versions of an invitation, each with its own tag, show which wording brought more completed responses. All three save the respondent effort, which is the honest argument for them, and all three depend on the link arriving intact. When a tag is missing or mangled, the response still arrives, just without the context, so the data quietly gets worse rather than failing loudly. That is why hidden fields reward a short checklist before every send: which links carry which values, who generated them, and where the list of valid values is kept.
The limits and the risks
A hidden field is hidden from the page, not from the person. MDN is blunt: do not rely on hidden inputs as a form of security, because the value can be seen and edited with any browser's developer tools, and a value in a link can be edited by anybody who can click in the address bar. So never use one to carry a price, a discount level, a permission or an identity that the receiving system trusts. The OWASP input validation guidance applies here as to any other input: validate everything on the server. There is a privacy side too. A reference number in a survey link identifies the respondent, and survey platforms warn that passing identifying information this way affects anonymity.
Designing for values that go missing
Plenty of people arrive without the parameter at all. They type the address from a poster, open a forwarded message whose link was trimmed, return from a bookmark, or copy the link without its tail. A hidden field that is blank on a noticeable share of responses is normal, and the analysis should report it as unknown rather than dropping those rows. Keep parameter names short, lower case and consistent across campaigns, since a source recorded as Newsletter in one month and newsletter in the next splits one channel into two. And test every tagged link by submitting a response through it before the campaign goes out, then checking that the value actually landed.
Hidden fields and this form builder
This form builder has no hidden field component, and a campaign tag added to the end of a form link is not recorded anywhere. The honest alternatives are visible. Ask a short dropdown question about where the person heard about you, placed late in the form so it does not delay the questions that matter. Or build a separate form for each channel, since the webhook payload names the form it came from with its id, title and slug, which a receiving system can use as the source. The lead capture example simply asks everything it needs in plain sight, including what made the person look into the offer now, which tells a sales team more than a campaign tag would.
Questions people ask
Can respondents see hidden fields?
Not on the page, but anybody who looks can find them. The value is in the page source or in the link itself, and a curious respondent can change it before submitting. Treat a hidden value as a label you applied, useful for sorting responses, and never as proof of anything the respondent could have altered.
What is a UTM parameter?
A UTM parameter is a tag added to the end of a link that names the source, medium and campaign which sent a visitor, so analytics tools can group visits by channel. When a form reads those tags into hidden fields, each response carries the same campaign information as the visit, which lets you compare channels by completed responses rather than clicks.
Do hidden fields need to be disclosed under privacy law?
If a hidden field carries information that identifies a person, such as an email address or customer number, it is personal information like any other answer and belongs in your privacy notice. A campaign name that identifies nobody is lower risk. The mistake to avoid is telling respondents a survey is anonymous while an identifier rides along in the link.
What is a honeypot field?
A honeypot is a field hidden from people but visible to automated scripts that fill in every box they find. A real visitor leaves it empty; a bot fills it, and the submission can be discarded. It catches simple spam without a puzzle for the respondent, though determined bots learn to skip it, so it works best alongside other checks.
Should a hidden field ever be required?
No. A required hidden field blocks every person who arrived without the parameter, and they cannot fix it because they cannot see the field. Give it a default such as direct or unknown instead, and treat blank values as part of the data. Requiring the value only works when the form is reached exclusively through links you generate.
Is a hidden field the same as a prefilled field?
No. A prefilled field is visible and shows a value the respondent can check and change, such as an email address carried in from an invitation. A hidden field is never shown. Prefilling is kinder for anything the respondent should confirm, because a wrong value can be corrected on the spot instead of silently saved with the response.
Make one with forms
The button opens the generator with this use case already described. Change the wording to match your own.
Create a form with OneCraftRelated questions
- What is piping in a survey?What is piping in a survey? Piping carries an earlier answer or a known value into later question text. Where it helps, where it breaks, and the workarounds.
- What is a webhook? Explained with a form submissionWhat is a webhook? An automatic request one system sends to your URL when an event happens. A form submission example, and how to receive one safely.
- Skip logic vs branching logicSkip logic vs branching: skip logic jumps a respondent past questions, branching sends groups down different paths. How display logic and piping differ.
Step by step in the builder: Automate your form with add-ons, then Every form field and when to use it.
Written and checked by the OneCraft team. Last checked .