Form Field Types

WTForms provides many field types.

Here are the most common ones you’ll use in Flask apps.

Text inputs

• StringField
• TextAreaField
• PasswordField

Numeric/date

• IntegerField
• DecimalField
• DateField

Email

• EmailField (WTForms) or StringField + Email() validator

Choices

• SelectField
• RadioField
• SelectMultipleField

Example:

python

from wtforms import SelectField
 
role = SelectField(
    "Role",
    choices=[("user", "User"), ("admin", "Admin")],
)

Checkboxes

• BooleanField

File uploads

• FileField

File uploads require enctype="multipart/form-data" in the HTML form.

Submit buttons

• SubmitField

Tip: keep only one submit field per form unless you really need multiple actions.

Each field type decides the HTML and the Python type

Measured — the exact HTML each field renders, and what field.data holds after a valid submission:

field	rendered HTML	raw submitted	.data
StringField	<input type="text">	'ada'	'ada' (str)
IntegerField	<input type="number">	'42'	42 (int)
PasswordField	<input type="password">	's3cret'	's3cret' (str)
BooleanField	<input type="checkbox" value="y">	'y'	True (bool)
SelectField	<select><option>...	'a'	'a' (str)
TextAreaField	<textarea>	text	str

diagram Diagram mermaid

  flowchart LR
  B["browser sends
everything as a STRING"] --> F["the field coerces it"]
  F --> S["StringField -> str"]
  F --> I["IntegerField -> int, or None if it will not parse"]
  F --> C["BooleanField -> True if present, False if absent"]

The whole point of the field type is that HTTP has no types. Every value arrives as a string, and the field is what turns '42' into 42 — and what reports 'Not a valid integer value.' when it cannot.

An unchecked box sends nothing at all

A BooleanField renders <input type="checkbox" value="y">. When the user leaves it unchecked the browser omits the field entirely, so .data is False. This is why a BooleanField with DataRequired() can never be submitted as unchecked-but-valid — and why “I agree” checkboxes use DataRequired() deliberately.

Validators become HTML attributes

attrs.py

name = StringField("Your name", validators=[DataRequired(), Length(min=2)])

renders, measured:

output

<input id="name" minlength="2" name="name" required type="text" value="">

DataRequired() produced required and Length(min=2) produced minlength="2". The browser will now enforce both before the request is sent.

Client-side validation is a convenience, never a control

Those attributes only help honest users. Anyone can strip them, or send the POST with curl. The server-side validators are the real check — the HTML attributes are generated from them, not instead of them.

Passing extra attributes at render time

render.py

form.name(class_="input", placeholder="Ada")

measured

<input class="input" id="name" minlength="2" name="name"
       placeholder="Ada" required type="text" value="">

class_ has the trailing underscore because class is a Python keyword — the same convention for_ uses on labels.

See it move

sketch From HTML control to Python value p5.js Pause Restart

Every value arrives as a string. The field type decides both the control rendered and the type the value is coerced to.

Check yourself

pch.quizTag pch.quizDefaultTitle

1. A user leaves a BooleanField checkbox unchecked and submits. What does field.data hold?

   A None, since nothing was sent B False, because an unchecked box is omitted from the request entirely C an empty string D True, the default
   pch.quizShowAnswer

   B — False, because an unchecked box is omitted from the request entirely — The browser sends nothing for an unchecked box, and BooleanField maps absence to False. That is also why DataRequired on a checkbox forces the user to tick it.

2. StringField with DataRequired() and Length(min=2) renders required and minlength=2 in the HTML. What does that mean for security?

   A the server no longer needs to validate that field B nothing changes on the server; those attributes are generated from the validators and can be stripped or bypassed by any client C the browser signs the field so it cannot be altered D validation moves entirely to the browser
   pch.quizShowAnswer

   B — nothing changes on the server; those attributes are generated from the validators and can be stripped or bypassed by any client — The attributes are a convenience for honest users. A POST from curl ignores them completely, so the server-side validators remain the only real check.

3. Why is the render-time keyword class_ spelled with a trailing underscore?

   A to distinguish CSS classes from Python classes in the output B because class is a reserved Python keyword and cannot be used as an argument name C wtforms strips the underscore for all attributes D it marks the attribute as optional
   pch.quizShowAnswer

   B — because class is a reserved Python keyword and cannot be used as an argument name — class is one of the 35 reserved keywords, so the trailing-underscore convention is used, exactly as for_ on labels. It renders as class in the HTML.