Hidden field defined.
A hidden field is an <input type="hidden">, a form input that submits its name and value along with the rest of the form but never renders on the page, used to pass data the visitor doesn't need to see or edit.
How a hidden field works
When a form is submitted, the browser sends every named input, visible or not. A hidden field rides along in that payload without appearing in the UI: configuration for the endpoint, an ID tying the submission to a record, context like which page the form was on. One caveat governs all of it: hidden means invisible, not secret. The value sits in your page source where anyone can read it, so a hidden field carries identifiers and settings, never credentials.
FormWire's integration is built on exactly this. A hidden access_key input tells the endpoint which account the submission belongs to, public by design, since delivery is locked to email addresses you've verified, so exposing it gives a stranger no way to redirect your mail. Reserved underscore-prefixed fields ride the same way: a hidden _redirect names the page to send the visitor to after a successful submit, and _cc adds extra verified recipients. Configuration travels inside the form itself, with no code around it.
The jobs hidden fields do.
Identify
An access key or record ID tells the endpoint which account the submission belongs to and where it should land.
Configure
Reserved fields like _redirect and _cc set per-form behavior. The form carries its own settings in its markup.
Add context
Which page, which campaign, which product. Quiet metadata that makes the submission actionable when it arrives.
Related questions
Yes, it's a public identifier, not a password. It routes the submission to your account, and delivery only ever goes to recipients you've verified, so someone copying the key from your source can't read your data or reroute your mail.
How a form backend routes submissions →Functionally yes, technically no. Bots have learned to skip input type="hidden", so a honeypot uses an ordinary text input hidden with CSS instead, invisible to people, still tempting to bots. Type-hidden fields carry data; CSS-hidden traps catch bots.
How a honeypot field traps bots →Anyone can edit them in dev tools before submitting, which is why the endpoint validates rather than trusts. FormWire checks _redirect URLs against your per-form allowlist and _cc addresses against your verified recipients, so an edited value can't turn your form into an open redirector or a spam cannon.
Why hidden tokens defend against CSRF →Names starting with an underscore. _redirect and _cc are live; _subject, _from_name and _reply_to are reserved for upcoming per-request overrides, so don't invent your own underscore-prefixed names for ordinary data.
Special fields: _redirect, _cc and friends →Want to see it working?
Read the docsOne hidden field connects your form.
Free tier forever. No credit card required.