Summary: Netlify Forms is detected at deploy time and only works on Netlify-hosted sites; its free allowance has historically been the classic pain point (100 submissions/month on legacy plans). Postbag is host-independent, exposes everything through an API, signs webhooks, keeps every submission as a routed row and can be self-hosted.
| Capability | Postbag | Netlify Forms |
|---|---|---|
| Free tier | 5 forms, 1,000 submissions/month, 5 destinations, 90-day retention (paid plans not yet on sale) | Legacy plans: 100 submissions/month + 10 MB uploads; credit-based plans: "Forms are free and unlimited" (Netlify docs) |
| Entry paid | Not yet on sale | Level 1 (1,000 submissions) on legacy plans; price not published in docs |
| Management API | Full /v1 API for every object (forms, schemas, streams, mappings, destinations, routes, deliveries, events), OpenAPI generated from the live routes | Netlify API can read submissions; forms are detected at deploy, no form-management API |
| Webhooks | Yes, HMAC-SHA256 signed (Postbag-Signature t=…,v1=…), retried with backoff, dead-lettered and retryable | Outgoing POST notifications; JWS-signed when a secret is set |
| Yes (Resend), Reply-To from the submission | Yes | |
| Chat destinations | Telegram today; Slack and Discord next | Slack |
| Spam | Honeypot, per-form rate limit, origin allowlist, Cloudflare Turnstile; spam is stored and reversible, never dropped | Akismet (automatic), honeypot, reCAPTCHA v2 |
| File uploads | Not yet (text fields only; 256 KB) | Yes, 8 MB per request |
| Self-hosting / source | Yes: one Docker image + Postgres, same image as the hosted product | No |
| Schemas and drift | Versioned, immutable form and stream schemas; observe / enforce / managed modes; drift detection and inference | No |
| Many sites → one destination | Projects, tags, streams (many forms → one schema → one destination), delivery windows, digests | Per site |
| Tied to a host | None | Only works on Netlify-hosted sites |
| For AI agents | llms.txt, openapi.json, GET /v1/me, POST /v1/quickstart, _test submissions with delivery ids to poll, errors with hint + docs, Idempotency-Key, if_exists: return | No forms-specific agent surface found |
Netlify Forms facts checked on against: Netlify Forms setup, Forms usage and billing, Spam filters. Prices and quotas change; verify on their pages. Tagline quoted: "serverless form handling … without extra API calls or additional JavaScript".
Choose Netlify Forms if
- Every site you run is on Netlify and you want zero extra services.
- You need uploads and Akismet with no setup.
Choose Postbag if
- Your sites live on different hosts, or might move.
- You need a management API, signed webhooks, or routing across sites.
- An agent is building the site and should wire the form itself.
- You want to self-host.
What Postbag does differently, in one paragraph
Postbag treats a submission as a database row before anything else and delivery as an outbox drained by a worker, so every attempt is recorded and retryable and nothing is dropped, including spam. It adds streams, so many forms with different field names map onto one versioned schema and go to one partner or CRM with windows and digests. Every webhook is signed. The whole product is one API described by /openapi.json and /llms.txt, so an AI agent can create, verify and route a form without a browser. And it ships as one Docker image plus Postgres, so the hosted product and a self-hosted install are the same thing.