---
id: flask-wtf
version: "1.3.0"
license: Copyright 2010 WTForms Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code… (full text in the JSON record)
license_treatment: permissive
maintenance: active
---

# Flask-WTF — Form rendering, validation, and CSRF protection for Flask with WTForms.

License: permissive · Maintenance: active · Downloads: 20.2M/mo

## What it is and what it does

Flask-WTF is a Flask extension that bridges Flask and WTForms to simplify form handling in web applications. It provides built-in CSRF protection, form rendering, validation, and support for file uploads and reCAPTCHA integration. The package wraps WTForms functionality with Flask-specific conveniences, letting developers define form classes declaratively and validate user input with minimal boilerplate.

It depends on Flask, WTForms, and itsdangerous (for secure token handling). The package is production-stable, actively maintained, and widely used across Flask projects. It requires Python 3.10 or later and is designed to work seamlessly within Flask's application context and request lifecycle.

Use it for:

- Build login and registration forms with built-in CSRF tokens and field validation.
- Handle file uploads in forms with automatic validation and security checks.
- Protect web forms against cross-site request forgery attacks automatically.
- Integrate reCAPTCHA into forms to prevent automated abuse.
- Render and validate multi-field forms with custom validators and error messages.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Flask-WTF integrates WTForms with Flask to handle form rendering, validation, and CSRF protection in web applications.

Yes. Flask-WTF is production-stable, actively maintained, has low install friction, carries no known vulnerabilities, and is the standard form-handling solution for Flask applications. Install it if you are building forms in Flask.

## Install

pip install flask-wtf
uv add flask-wtf
poetry add flask-wtf

## Installing Flask-WTF

Before you install: Low friction install with three straightforward runtime dependencies. Active maintenance with a recent release (113 days ago) and ongoing repository activity.

License in practice: BSD license permits commercial and private use with minimal restrictions—retain the license notice and disclaimer in distributions.

Quickstart:

pip install Flask-WTF

from flask import Flask
from flask_wtf import FlaskForm
from wtforms import StringField
from wtforms.validators import DataRequired

app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'

class MyForm(FlaskForm):
    name = StringField('Name', validators=[DataRequired()])

@app.route('/', methods=['GET', 'POST'])
def index():
    form = MyForm()
    if form.validate_on_submit():
        return f"Hello {form.name.data}"
    return form.render()

Requires Python 3.10 or later and a Flask application context to function.

Verify before relying:

- Whether reCAPTCHA integration requires additional API keys or configuration beyond what Flask-WTF provides.
- File upload size limits and supported storage backends for uploaded files.

## Package facts

- License: Copyright 2010 WTForms Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code… (full text in the JSON record) (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 20.2M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask form validation, csrf protection flask, wtforms integration, flask web forms, form rendering flask, file upload flask forms, recaptcha flask, web-forms, csrf-protection, flask-extension

[View on SkillFed](https://skillfed.io/packages/flask-wtf) · [View on PyPI](https://pypi.org/project/flask-wtf/)