Flask-WTF

What it is and what it does

Flask-WTF is a Flask extension that bridges Flask and WTForms to simplify form handling in web applications. It provides built-in CSRF protection, form rendering, validation, and support for file uploads and reCAPTCHA integration. The package wraps WTForms functionality with Flask-specific conveniences, letting developers define form classes declaratively and validate user input with minimal boilerplate.

It depends on Flask, WTForms, and itsdangerous (for secure token handling). The package is production-stable, actively maintained, and widely used across Flask projects. It requires Python 3.10 or later and is designed to work seamlessly within Flask's application context and request lifecycle.

Use it for:

• Build login and registration forms with built-in CSRF tokens and field validation.
• Handle file uploads in forms with automatic validation and security checks.
• Protect web forms against cross-site request forgery attacks automatically.
• Integrate reCAPTCHA into forms to prevent automated abuse.
• Render and validate multi-field forms with custom validators and error messages.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Flask-WTF integrates WTForms with Flask to handle form rendering, validation, and CSRF protection in web applications.

Yes. Flask-WTF is production-stable, actively maintained, has low install friction, carries no known vulnerabilities, and is the standard form-handling solution for Flask applications. Install it if you are building forms in Flask.

Install

flask-wtf on PyPI

pip install flask-wtf

uv add flask-wtf

poetry add flask-wtf

Installing Flask-WTF

Before you install

Low friction install with three straightforward runtime dependencies. Active maintenance with a recent release (113 days ago) and ongoing repository activity.

License in practice

BSD license permits commercial and private use with minimal restrictions—retain the license notice and disclaimer in distributions.

Quickstart

pip install Flask-WTF

from flask import Flask
from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])

@app.route('/', methods=['GET', 'POST'])
def index():
    form = MyForm()
    if form.validate_on_submit():
        return f"Hello {form.name.data}"
    return form.render()

Requires Python 3.10 or later and a Flask application context to function.

Verify before relying

• Whether reCAPTCHA integration requires additional API keys or configuration beyond what Flask-WTF provides.
• File upload size limits and supported storage backends for uploaded files.

Package facts

Evidence: flask_wtf-1.3.0-py3-none-any.whl

Tags

More Application Frameworks packages