# Build brief — a focused alternative to Formasty

> **Verdict:** Partly, if you narrow it · **Buildability:** 54/100 · **Category:** Forms
> **Source:** https://www.canitbevibecoded.com/formasty
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from Formasty. Verify current pricing and capabilities before acting.

## Context

**Formasty** — Hosted no-code form builder for building forms, embedding them, and collecting responses. It currently costs $29/mo.

A form builder is one of the most one-shottable categories there is: a schema, a renderer, a responses table, a CSV export. An agent will get you a working multi-step form with conditional fields and an embed snippet in a single session, and for a personal signup form or client intake that is genuinely enough. The gaps are the boring parts nobody thinks about until they bite: email that actually lands in inboxes, spam that gets past a honeypot, file uploads you have to back up, and the dozen integrations that turn a response into a row in someone else's tool. You also inherit uptime, because a form that is down is a lead you never knew existed. Build it if the form is yours and the volume is low; pay if the form is a business process.

This brief describes a focused, single-operator replacement for the part of Formasty that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

Define a form as a JSON schema in an admin UI, render it publicly as a multi-step page or embeddable iframe, and store every submission in SQLite with email notification and CSV export.

- Create forms, validate submissions, store responses, and export the results.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- A small VPS or always-on box to host it.
- Disk space and a backup habit for uploads and the SQLite file.
- Your own domain if you want the embed to look credible.

### Data and integrations

- SMTP credentials for notification email.

Each of these needs a real account, credential, or quota. Set them up before writing feature code.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build a single-user, self-hosted form builder and response collector. Stack: Next.js 15 App Router, TypeScript, Tailwind, SQLite via better-sqlite3. No other hosted services.
Data model: forms(id, slug, title, schema JSON, theme JSON, createdAt), responses(id, formId, payload JSON, meta JSON, createdAt), deliveries(id, responseId, url, status, attempts).
Admin builder at /admin/forms/[id]: add, reorder, duplicate and delete fields. Field types: short text, long text, email, number, single select, multi select, dropdown, date, rating 1 to 5, file upload, consent checkbox, hidden field.
Per field: label, help text, required flag, placeholder, and simple conditional visibility (show this field when field X equals value Y).
Multi-step forms: fields grouped into steps, one step per screen, progress bar, back button, answers held in client state until final submit.
Public form at /f/[slug]: server-rendered, mobile-first, keyboard navigable, and revalidated on the server so client validation is never the only check.
Persist in-progress answers to localStorage keyed by form slug so a refresh does not wipe the form.
File uploads write to ./uploads with a size cap and mime allowlist defined in the schema; store the relative path in the response payload.
Spam control: hidden honeypot field, reject submissions completed in under 2 seconds, and a per-IP rate limit table in SQLite. No captcha, no third party.
Notifications: on submit, send a plain text digest of the response over SMTP with nodemailer using SMTP_HOST, SMTP_USER, SMTP_PASS, NOTIFY_TO from .env. If those are unset, log and continue instead of erroring.
Optional per-form webhook URL: POST the response JSON, 3 retries with backoff, log every attempt in deliveries.
Responses view at /admin/forms/[id]/responses: table with one column per field, text search, date range filter, detail drawer, delete, and CSV export of the current filter.
Embedding: an /embed/[slug] route plus a small public/embed.js that injects an iframe and auto-resizes it via postMessage.
Theming per form: accent color, one of three system font stacks, light or dark, optional cover image, custom thank-you message, optional redirect URL.
Auth: a single ADMIN_PASSWORD from .env and a signed httpOnly cookie session for all /admin routes. No user accounts, no OAuth, no analytics, no telemetry.
Seed script creating two demo forms: a three-step onboarding survey with conditional fields, and a one-page contact form.
Out of scope: payments, e-signatures, team accounts, template marketplace, A/B testing, AI form generation.
Deliver a README with setup steps, a .env.example, a note on backing up form.db plus ./uploads, and a Dockerfile listening on port 3000.
Ship working code, not scaffolding: npm install, npm run seed, npm run dev must yield a fillable form at /f/contact and a visible row in the responses table.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- Deliverability: their notification email is warmed and authenticated, your SMTP box is not.
- The integration shelf: Sheets, Slack, Notion, CRM, Zapier style webhooks with retries and mapping UI.
- Template library and builder polish, which is most of what you are paying for in a form tool.
- Payment fields, e-signature, and anything that needs a compliance story like a signed DPA.
- Uptime and CDN edge delivery, so a form on a busy page fails silently when your box does.

## What you still own after launch

- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.

## Risk

**Operational risk.** The code is achievable; dependable data, integrations, and ongoing operations are the real cost.

Editorial confidence in this assessment: low. No reviewed project implementation is linked yet.

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/formasty