A file upload can save a long email exchange. A customer can attach a photo of a damaged item, a job applicant can provide a résumé, and a research participant can submit a completed worksheet. But an upload field also adds work: people have to find the right file, check its format, wait for it to transfer, and trust that it reached the right place.
Good form file upload best practices reduce that extra work for both the person submitting the form and the team handling the response. The goal is not to collect every possible attachment. It is to ask for the right file, explain what will happen, and make recovery straightforward if something goes wrong.
This guide covers how to decide whether an upload belongs in your form, write useful instructions, set limits, design for phones and assistive technology, and handle files safely after submission.
First, decide whether you need an upload
Before adding a file field, ask what decision or task the file supports. If a short answer, a few structured fields, or a link would give you the same information, an upload may create unnecessary effort.
For example, a repair request may genuinely need a photo of the damaged part. A general contact form probably does not need every visitor to attach a document. A résumé is relevant to a job application, but asking for a résumé and then requiring applicants to retype the same work history can be redundant.
Consider what happens when someone cannot provide the file. Can they submit the form and send it later? Is there another way to share it? If the answer is yes, make the upload optional and explain the alternative. For a useful framework, see when to make a form field optional.
Tell people exactly what to upload
“Upload a document” leaves too much to guesswork. People may wonder which document you need, whether a scan is acceptable, or if they should include every page. Specific guidance prevents avoidable rework.
Describe the file’s purpose and contents
Use a field label that names the item, such as “Attach a photo of the damaged product” or “Upload your signed consent form.” Add a short instruction when the label alone cannot explain the request.
For a small-business warranty claim, for instance, instructions might say: “Attach one or more clear photos showing the damage and the product label. You can upload JPG, PNG, or PDF files.” That tells customers what evidence is useful without asking them to guess.
State formats and size limits before the picker opens
List the formats you accept and the maximum size near the upload control, not only in a later error message. Use familiar names such as PDF, JPG, or DOCX rather than relying on extensions alone. If you accept multiple files, say how many and whether the limit applies to each file or the combined upload.
Set limits based on the task and the capabilities of your form platform and storage system. A request for a signed one-page form rarely needs huge video files. A design review may need larger source files. There is no universal size limit that fits every use case, so check the actual limits of your setup and test with representative files.
A concise instruction could read: “PDF, JPG, or PNG; up to 10 MB per file; maximum 3 files.” Avoid saying “small files only,” which gives people no way to judge whether their file will work.
Offer a sensible alternative
Some people will have the information but not the requested file in an accepted format. Tell them what to do next: save a document as PDF, submit without the attachment and follow up by email, or provide a secure link if your process allows it. Do not ask people to share files through an informal channel unless your team has approved that method.
Make the upload control clear and accessible
Use a visible, descriptive label associated with the file input. Do not rely on placeholder text, an icon, or the browser’s default button wording to explain the task. People using screen readers need a meaningful name for the control, and sighted users benefit from the same clarity. The W3C guidance on form labels explains why controls need labels that identify their purpose.
Keep the instructions close to the upload control and make them available to assistive technology as well as visually apparent. If your form builder offers a built-in file field, check that its label, help text, keyboard operation, and error state work as expected. A visually prominent drop zone is not a substitute for a usable file input or button.
Do not make drag-and-drop the only way to attach a file. It can be convenient on a computer, but it may not be practical on a phone or with some assistive technologies. Provide a clear button or standard file picker as an alternative.
On mobile, people may choose a file from their photo library, cloud storage, or camera, depending on the device and browser. Avoid instructions that assume everyone is uploading from a desktop. For other phone-specific form checks, use this mobile form design checklist.
Show what happened after a file is selected
After selection, show the filename and, where useful, its size. If multiple files are allowed, show each one separately. Include a clear way to remove or replace a file before submission. This helps people catch the wrong attachment—for example, a draft résumé instead of the final version—without starting over.
For larger uploads, show that the transfer is in progress and avoid implying that it is complete before it has finished. If the form cannot be submitted until the upload completes, make that state clear. If a connection drops or the file fails, tell the person what they can try next instead of silently removing the attachment.
File names can be helpful, but do not expose more information than needed. If the name itself may contain sensitive details, consider displaying a shortened version while keeping a way to identify the file. The exact behavior depends on your platform.
Write errors that explain the fix
“Upload failed” is not enough. Identify the problem and give a specific next step: “This file is 14 MB. Choose a file under 10 MB,” or “This file type isn’t supported. Upload a PDF, JPG, or PNG.” If the file appears to have a network or temporary transfer issue, say that and offer a retry.
Keep the error next to the upload control and make sure it is announced to people using assistive technology. Preserve any other completed fields when an upload fails, so the person does not have to rebuild the form. For broader guidance on writing actionable form errors, see how to write form error messages that help people fix mistakes.
Test errors intentionally: choose a file that is too large, use an unsupported format, interrupt a transfer if you can, and try submitting without a required attachment. Check both the message and what happens to the rest of the form.
Plan for privacy and secure file handling
Attachments can contain personal or confidential information. Ask only for what the team needs, explain who will use the file and for what purpose, and avoid collecting sensitive material through a general-purpose form unless you have confirmed that the form and storage process are appropriate.
On the receiving side, restrict access to people who need the files, define how long they should be retained, and remove them when they are no longer needed under your organization’s policies. Treat uploaded files as untrusted input: file extensions alone do not prove that a file is safe. The OWASP File Upload Cheat Sheet outlines security measures such as validating allowed types and limiting file sizes. Your form provider or technical team should confirm which protections are available and who is responsible for them.
Be careful with automatic email notifications. A message saying “A new file was uploaded” may be safer than attaching a potentially sensitive document to an email sent to a broad distribution list. Check where files are stored, who can access them, and whether links expire or require sign-in.
Test the whole path, not just the field
An upload field is only useful if the file reaches the right person in a usable state. Submit a test form from a phone and a computer. Try each accepted format, a file near the size limit, and an invalid file. Then verify that the file appears in the destination your team actually uses, such as a shared workspace or case record.
Check the notification and follow-up process too. Can staff tell which submission the attachment belongs to? Are files named or organized clearly? Does a failed upload show up as an incomplete response or disappear without notice? Assign someone to own these checks when form settings, storage, or integrations change.
A short pre-launch checklist:
- The request explains what file is needed and why.
- Accepted formats, per-file size limits, and file-count limits are stated up front.
- The field is optional when the process can continue without the file.
- A keyboard- and screen-reader-accessible file picker is available; drag-and-drop is not the only option.
- Selected files can be reviewed, removed, or replaced before submission.
- Errors explain how to fix the problem without wiping other answers.
- The team knows where uploads go, who can access them, and when they should be deleted.
FAQ
Should a file upload field be required?
Require an upload only when you cannot complete the task without it and there is no practical alternative. If people can submit now and provide the file later, make the field optional and explain the follow-up route.
What file types should a form accept?
Accept the smallest set of formats that covers the task. A photo request may need JPG and PNG; a signed document may need PDF. State the accepted types clearly and test them in the form and the destination system.
What is a reasonable maximum file size?
There is no single right limit. Choose one that fits the files people need to provide and the limits of your form platform, storage, and workflow. Tell users the limit before they select a file and test a file close to it.
Should I allow multiple file uploads?
Allow multiple files when the task naturally requires them, such as photos of several damaged items. State the maximum number and whether each file has its own size limit. If one combined PDF would work just as well, explain that option.
Is it safe to email uploaded files to my team?
It depends on the sensitivity of the files and your organization’s security rules. Avoid sending sensitive attachments to broad email lists by default. Check access controls, storage, retention, and whether staff can use a secure notification or workspace instead.