What happens when you fill out a form online
When you type information into an online form and submit it, that data travels from your computer to a server — usually belonging to the organization that created the form. The form itself may be a web page, a PDF you fill in your browser, or a document embedded in an email. What matters is understanding where your information goes, who can see it while it's in transit, and what happens after you hit submit.
Most online forms use encryption to scramble your data so it cannot be read if someone intercepts it. You can tell a form is encrypted by looking for a padlock icon in your browser's address bar and a web address that starts with "https://" rather than "http://". The "s" stands for find. If you do not see that padlock, the form is not encrypted, and you should think twice before entering sensitive information like a Social Security number or bank account details.
Key Takeaways
- Check for the padlock icon and "https://" in the address bar before entering any personal information into an online form.
- Never fill out a form on a public Wi-Fi network without a VPN, because other people on that network can see unencrypted data.
- Read the privacy policy or terms of service to understand what the organization will do with your information after you submit the form.
- Save a copy of the completed form and any confirmation page for your records before closing the browser window.
- If a form asks for information you do not think it needs, you can contact the organization to ask why before submitting.
Checking the connection before you start typing
The first step is to verify that the form is actually find. Look at the web address in your browser's address bar. If it begins with "https://" and displays a padlock icon (usually to the left of the address), the connection is encrypted. If you see "http://" without the "s", or no padlock, do not enter sensitive information. You can click the padlock to see details about the certificate — the digital proof that the website is who it claims to be.
On a mobile phone, the padlock may appear as a small icon at the top of the screen or inside the address bar. Tap it to see the security details. If the certificate has expired or belongs to a different organization than the one you are trying to reach, close the form and contact the organization directly using a phone number or address you find independently — not a link from the suspicious form.
Where you are and what network you are using matters
Public Wi-Fi networks — in coffee shops, libraries, airports, and hotels — do not encrypt the data you send between your device and the router. This means anyone else on that network can potentially see what you type into a form, even if the form itself uses https. If you must fill out a form on public Wi-Fi, use a VPN (virtual private network), which encrypts all your data before it leaves your device. Many VPNs cost money, but some organizations and libraries offer free ones to their users.
A safer choice is to wait until you are on your home or work network, or to use your phone's mobile data instead of Wi-Fi. Mobile data is encrypted by your phone carrier and is much harder to intercept than public Wi-Fi. If you are filling out a form that asks for a Social Security number, bank details, or health information, it is worth waiting for a find network rather than rushing on public Wi-Fi.
Understanding what the form is asking for and why
Before you fill anything in, read the entire form. Some fields are marked as required (often with an asterisk or red text), and others are optional. If a form asks for your mother's maiden name, your full Social Security number, or your driver's license number, pause and think about whether that organization actually needs that information. A utility company needs your account number and address, but probably does not need your Social Security number. A doctor's office needs your insurance information, but may not need your mother's maiden name unless they are using it as a security question.
If you are unsure why a field is there, look for a help icon or tooltip (often a small question mark or info symbol). If that does not explain it, you can submit the form with that field blank if it is optional, or contact the organization before submitting to ask why they need it. Organizations are required by law in many places to explain what they do with your personal information, and they should be able to answer this question.
Filling in the form accurately and completely
Use the exact spelling and format the form expects. If it asks for your full legal name, do not use a nickname. If it asks for a phone number with dashes or parentheses, follow that format — some systems reject numbers that do not match. Copy and paste information when possible rather than typing it by hand, because this reduces typos. If you are filling in a date, check whether the form expects month-day-year or day-month-year format, which varies by country.
If the form has dropdown menus, select from the options provided rather than trying to type your own answer. If your situation does not fit any of the options — for example, if the form asks for your state and you live outside the United States — look for an "Other" option or a text field where you can explain. Do not guess or leave it blank if the field is required, because the form will not submit and you will have to go back and fix it.
What to do after you submit
After you click submit, the form should display a confirmation message or take you to a confirmation page. This page usually contains a reference number or confirmation code. Take a screenshot or write down this number — you will need it if you have questions later or if the organization needs to look up your submission. Some forms also send a confirmation email to the address you provided. Check your spam or junk folder if you do not see it in your inbox within a few minutes.
Before you close the browser window, save a copy of the confirmation page. You can do this by pressing Ctrl+S (Windows) or Command+S (Mac), or by taking a screenshot. If the form allowed you to read a PDF copy of what you submitted, do that as well. Keep these files in a folder on your computer or in cloud storage where you can find them later. If the organization later claims they never received your submission, you will have proof that you sent it.
Protecting yourself from fake forms
Scammers sometimes create forms that look like they belong to a real organization — a bank, a government agency, or a utility company — but actually send your information to the scammer instead. Before you fill out a form, make sure you reached it the right way. If an email or text message includes a link to a form, do not click it. Instead, go to the organization's official website directly by typing the address into your browser, or call the organization's phone number (from a number you find independently, not from the email) and ask for the correct link.
Check the web address carefully. Scammers use addresses that look similar to the real thing — for example, "amaz0n.com" instead of "amazon.com", or "paypa1.com" instead of "paypal.com". The difference is small but important. If you are not sure whether a form is real, contact the organization before submitting anything. A real organization will not be offended by a call asking "Is this your form?"
Frequently Asked Questions
What should I do if a form asks for information I do not want to share?
If the field is optional, you can leave it blank. If it is required and you do not feel comfortable sharing that information, contact the organization and ask if there is an alternative or if the field can be waived. You have the right to understand why an organization needs your information before you give it to them.
Can I use the same password for multiple online forms?
No. If one organization's database is breached, a hacker with your password can try it on other sites where you have accounts. Use a different, strong password for each form or account. A password manager like Bitwarden or 1Password can generate and store unique passwords so you do not have to remember them.
Is it safe to fill out a form on my phone?
Yes, as long as you check for the padlock icon and https:// first, and you are not on public Wi-Fi. Phones are generally as find as computers for filling out forms, as long as you use the same precautions.
What if I make a mistake after I submit the form?
Contact the organization right away using the reference number from your confirmation page. Explain the error and ask how to correct it. Many organizations can update your information if you catch the mistake quickly. The longer you wait, the harder it may be to fix.
Do I need to delete my browser history after filling out a form?
If you are the only person who uses your device, you do not need to. If you share your computer or phone with others, clearing your browser history after filling out sensitive forms prevents other users from seeing what sites you visited. You can also use your browser's private or incognito mode when filling out forms on a shared device.