Form Validation with Flask-WTF & WTForms

WTForms is a Python library that declares web forms as classes with typed fields and validators, automatically checking submitted data and collecting error messages for you.

Learn Form Validation with Flask-WTF & WTForms in our free Flask course — a beginner-friendly interactive lesson with worked examples, a practice exercise…

Part of the free Flask course at LearnCodingFast — hands-on lessons with examples you run in your browser, plus practice exercises and a quick quiz.

In this lesson you'll declare a form, attach validators like DataRequired and Length , run validation against submitted data, read the errors, and see how Flask-WTF adds CSRF protection.

In WTForms, a form is a class . Each attribute is a field — StringField , PasswordField , IntegerField , and so on — and you pass each field a list of validators . Validators are small rules: DataRequired() means the field cannot be empty, Length(min=3) enforces a minimum length.

To validate real input you feed the form a MultiDict (the dictionary-like type Flask's request.form actually is). The runnable example builds a registration form and validates a good submission, then reads back the cleaned data.

Output: valid? True and a data dict with the username, email, and password — the cleaned values you would persist to the database.

When a submission breaks the rules, validate() returns False and fills form.errors — a dictionary keyed by field name, where each value is a list of human-readable messages. This is exactly what you loop over in a template to show users what went wrong.

The example sends a too-short username, a malformed email, and a short password, then prints the collected errors.

Output: valid? False , then one line per field — username reports the length rule, email reports the pattern, and password reports the minimum length.

In a real app you do not pass request.form yourself. Flask-WTF gives you FlaskForm , which reads the request automatically, and validate_on_submit() , which returns True only on a POST whose data passes validation. It also injects a hidden, signed CSRF token so forged cross-site submissions are rejected.

Here is the production view and template. It is read-only because it needs the flask_wtf package, but the form class is the same one you ran above.

Complete the login form. Replace each ___ so the username is required and the password must be at least 6 characters.

Your template did not render form.hidden_tag() , or app.secret_key is unset. Add both — the token cannot be signed without a secret key.

❌ Install 'email_validator' for email validation support

The Email() validator needs an extra package: pip install email_validator . Until then, use a Regexp rule as a stand-in.

With Flask-WTF use validate_on_submit() , not validate() . It returns False on a GET so you can show the empty form instead of a wall of errors.

Build and validate a contact form with three rules.

Lesson complete — your forms validate themselves!

You can declare a form as a class, attach validators, run validate() , read form.errors , and you understand how Flask-WTF layers on FlaskForm and CSRF protection.

🚀 Up next: SQLAlchemy Relationships — model how your data connects with one-to-many and many-to-many links.

Practice quiz

• Browse all free courses
• Cheat sheets & quizzes
• Coding dictionary