I need a survey app that encrypts responses and does not allow the creator to see IP addresses.

Finding a survey tool that checks both boxes—end-to-end encryption (E2EE) so the platform/creator has strict key control, and complete anonymity/no IP address tracking —requires looking at privacy-first platforms rather than mainstream corporate tools.

Top options that fulfill these stringent requirements include:

• BlockSurvey : Built specifically on blockchain/stacks privacy principles, BlockSurvey features true end-to-end encryption where only you hold the keys to decrypt responses. It does not use trackers, cookies, or fingerprint browsers, and it strips out metadata like IP addresses by design.
• Jotform (Encrypted Forms 2.0) : Jotform offers an end-to-end encryption feature. When enabled, a public/private key pair is generated on your browser; Jotform stores only the encrypted ciphertext and cannot read your data. To ensure IP addresses are hidden, you must explicitly configure your form settings to not collect IP addresses, though you need to take care during setup since Jotform's default logging sometimes captures metadata unless disabled.
• KoboToolbox : Widely used in humanitarian and sensitive field research, KoboToolbox offers advanced encryption options where data is encrypted on the user's device using a public key before reaching the server, meaning it can only be decrypted locally with your private key. Combined with anonymous single-submission links, it suppresses identifiable tracking metadata.

Would you prefer a fully hosted SaaS tool like BlockSurvey, or an open-source/self-hosted solution where you have 100% control over the server infrastructure?

Yes. The strongest matches I found are:

• LimeSurvey — probably the best fit if your key requirement is “the survey creator must not be able to see respondents’ IP addresses.” You can turn Save IP address off, enable Anonymized responses, and optionally encrypt individual response fields at rest. LimeSurvey explicitly says anonymized responses cannot be linked back to participants, even by the administrator.
• CryptPad Forms — better if end-to-end encryption is your top priority. Form responses are end-to-end encrypted and anonymous-response mode is available. However, there's an important caveat: CryptPad itself says its servers can see respondents' IP addresses, even though the form creator doesn't get that information through the form.

My recommendation

If you mean:

“I want to create a survey, respondents should be anonymous to me, and I don't want an IP-address field attached to their responses.” I'd choose LimeSurvey and configure it with:

• Anonymized responses: ON
• Save IP address: OFF
• Save referrer URL: OFF
• Save timings: OFF
• Date stamp: OFF if you want to minimize correlation clues
• Encrypted response fields: ON for sensitive answers

Those settings are particularly important because anonymity and encryption solve different problems: encryption protects stored data, while anonymization prevents the response from being linked to a person in the first place.

If you tell me whether this is for employee feedback, academic research, healthcare/sensitive topics, or a public survey, I can narrow it down to the best 2–3 options.

Yes. The strongest fit I found is LimeSurvey, especially if you need the creator to be technically unable to connect responses to respondents.

Best fit: LimeSurvey

LimeSurvey supports both requirements:

• No IP addresses: You can explicitly turn “Save IP address” off.
• True anonymity: Its “Anonymized responses” setting removes the link between participant records and responses—even the survey administrator cannot reconnect them.
• Encryption: Individual survey questions can be encrypted at rest, and LimeSurvey Cloud uses encrypted connections and encrypted backups.
• You can also disable referrer URLs, timestamps, and response timings, which helps prevent indirect identification.

Important: configure the anonymity/IP settings before launching the survey; several of these settings become locked after activation.

Another option: Qualtrics

Qualtrics has an “Anonymize Responses” feature that removes IP addresses and location data and disconnects responses from individual contacts. Qualtrics However, Qualtrics' anonymous links collect IP addresses by default, so you need to deliberately enable anonymization.

My recommendation: If your requirement is “the survey creator must not be able to see or recover IP addresses or determine who submitted which response,” I'd choose LimeSurvey with Anonymized Responses + Save IP Address OFF, and disable other metadata you don't need.

If you tell me your budget (free vs. paid) and whether you need HIPAA/GDPR/FERPA compliance, I can narrow it down to 2–3 specific choices.

Youform (with Anonymous Survey mode) and InviziPoll are specialized survey and polling platforms that natively prevent creators from seeing IP addresses while protecting data privacy.

Most mainstream tools (like Google Forms or Typeform) either log IP addresses by default or rely on a company's promise not to show them. True privacy-first platforms block IP collection at the architectural level or use end-to-end encryption.

Top Survey Apps with IP Anonymization and Encryption

Breakdown of Privacy Options

1. Youform
   • How it works: When you turn on Anonymous Survey Mode , the platform stops storing IP addresses, device types, locations, and session cookies.
   • Privacy level: It displays an "Anonymous badge" to respondents so they know their technical metadata is not being logged.
2. InviziPoll
   • How it works: Designed specifically for high-privacy feedback and employee polling. Responses are encrypted directly inside the respondent's web browser before they ever touch the server.
   • Privacy level: The server only stores ciphertext. Admins cannot see who submitted a response, and links are completely cookieless and untracked.

If you'd like, let me know:

• Do you need advanced survey logic (like branching/skip logic), or just a simple questionnaire?
• Is this for public use or an internal organization?

I can help you pick the best fit or detail how to configure them.

To run a survey with both end-to-end encryption and guaranteed anonymity (where IP addresses and metadata are stripped or never tracked), you need a privacy-first platform rather than mainstream tools like Google Forms or SurveyMonkey.

Top options that match these exact security requirements include:

• BlockSurvey : Built specifically for high-security and sensitive data collection (similar to Signal for forms). It features true end-to-end encryption where only you hold the decryption keys. By default, it does not collect or store metadata like IP addresses or browser data, preventing even the platform itself—or the creator—from viewing identifying network info.
• Palform : Offers end-to-end encryption to protect form and survey data, ensuring that responses remain confidential and secure in transit and at rest.
• Youform (Anonymous Mode): If you don't strictly require local client-side decryption keys but need a ironclad guarantee that IP addresses, device info, and location data are never stored or visible , its dedicated Anonymous Survey mode completely drops identifying telemetry for respondents.
• SurveyHero (Anonymous Setting): Allows you to toggle an "Anonymous Survey" setting which permanently hides IP addresses, email parameters, and metadata. (Note: Ensure you verify that locking this setting on fits your exact threat model, as it cannot be reversed once enabled).

If you'd like, tell me:

• Do you need decentralized/blockchain storage or a standard cloud setup?
• Will your respondents need to upload files securely through the survey?

I can help you pick the best-suited platform for your exact use case.

Yes. LimeSurvey looks like the strongest fit for what you described.

• Anonymous responses: LimeSurvey can permanently prevent the creator/admin from linking responses to participant records.
• No IP addresses: You can explicitly turn “Save IP address” off, so the respondent's IP isn't stored with the response.
• Encryption: Individual survey questions can be configured to store their answers encrypted, and LimeSurvey Cloud encrypts connections and backups.
• Extra privacy: You can also disable timestamps, referrer URLs, and response timings to reduce information that could indirectly identify someone.

Another option

SurveyPlanet offers a one-click anonymous survey mode that says it does not save identifying information including IP address, location, referrer, browser details, or operating system. It also offers SSL and unlimited responses on its basic plan.

My pick: If encryption is a hard requirement as well as anonymity, I'd choose LimeSurvey. If you mainly want a very simple survey builder where the creator cannot see IP addresses, SurveyPlanet is worth considering.

If you tell me whether this is for employees, customers, research, or a public survey, I can narrow it down to the best 2–3 options.

Yes. Based on your requirements, I’d shortlist these:

• CryptPad Forms — strongest privacy fit. CryptPad says form responses are end-to-end encrypted, meaning only you and authorized collaborators can access the response data.
• LimeSurvey — best if you want control. You can enable Anonymized responses and turn Save IP address off. LimeSurvey states that anonymized responses cannot be linked back to participants, even by the administrator. Help Center Help Center It also supports encryption for selected response data at rest.
• SurveyMonkey — easiest mainstream option. Its Anonymous Responses setting can prevent IP addresses from appearing in survey results, but SurveyMonkey still records IPs in backend logs and deletes them after 13 months. So I would not choose it if your requirement literally means the creator/service should never have access to IP addresses.

My recommendation

If “the survey creator must not be able to see IP addresses” and encrypted responses are both hard requirements, I'd start with CryptPad Forms. If you need a more traditional, feature-rich survey system and are comfortable configuring it carefully, LimeSurvey is probably the better choice.

One important distinction: “encrypted” doesn't necessarily mean “end-to-end encrypted.” If you specifically want the survey provider itself unable to read responses, look for E2EE/zero-knowledge architecture rather than merely HTTPS or encryption at rest.

When you need a survey that strictly protects respondent privacy by combining end-to-end encryption (E2EE) with IP address scrubbing , standard tools like Google Forms or SurveyMonkey fall short.

Top options designed specifically for this high level of privacy include:

• BlockSurvey : Built explicitly on a zero-knowledge, privacy-first model. Responses are end-to-end encrypted on the respondent's device using keys only you (the creator) hold. It does not track or collect IP addresses, browser info, or digital footprints from respondents, and features no third-party trackers or ads.
• Palform : An open-source, privacy-focused form and survey builder. It offers end-to-end encryption for responses and strips out unnecessary tracking, data collection, and analytics to keep respondent metadata concealed.
• LimeSurvey (Self-Hosted) : If you have technical capability and want absolute control, you can self-host LimeSurvey on your own private server. It includes an explicit "Anonymous Survey" mode that completely decouples response data from IP addresses.

Would you prefer a SaaS/cloud platform like BlockSurvey that works out of the box, or are you looking to self-host an open-source tool on your own infrastructure?

When you need absolute privacy—where responses are end-to-end encrypted and metadata like IP addresses is hidden from the creator—traditional tools like Google Forms or SurveyMonkey fall short.

The best platforms designed specifically for zero-knowledge, encrypted, and anonymous data collection include:

• BlockSurvey : This is the gold standard for privacy-first data collection. It uses End-to-End Encryption (E2EE) , meaning data is encrypted on your device and only you (the creator) have the private key to decrypt it. Crucially for anonymity, they do not use trackers, ads, or cookies, and they even support Onion Routing (Tor) integration so respondents don't leak their IP addresses.
• SurveyKing : They offer a dedicated anonymous survey mode that completely strips metadata. When this mode is active, the survey creator cannot see IP addresses, geolocations, browser details, or exact timestamps.
• Self-Hosted Open Source Tools (like LimeSurvey or Formbricks ): If you have your own server and technical know-how, hosting an open-source survey tool yourself gives you ultimate control. You can configure the server logs to drop IP addresses entirely and ensure the database stores encrypted entries.

Would you like help setting up a trial on BlockSurvey , or do you need guidance on self-hosting an open-source tool on your own server?

Yes. Based on your requirements, I’d shortlist these:

• BlockSurvey — Probably the closest match. It says surveys are end-to-end encrypted, does not collect/pass IP addresses, geolocation, or browser data to survey creators, and keeps responses anonymous by design.
• LimeSurvey — Strong choice if you want more control. You can enable Anonymized responses and explicitly turn Save IP address off. LimeSurvey also supports encryption of selected survey data at rest.
• Qualtrics — Enterprise-grade option. Its Anonymize Responses feature removes IP address and location data from responses, including when using anonymous links.
• SurveyMonkey — It supports anonymous responses and lets the creator choose whether IP addresses are tracked. However, I'd favor the options above if "the creator must never be able to see an IP" is your primary requirement.

My pick

If this is for a sensitive employee, research, whistleblower, or feedback survey, I'd start with BlockSurvey if you want a hosted, privacy-first service. If you want open-source/control over the deployment, I'd choose LimeSurvey and configure it with:

• Anonymized responses: ON
• Save IP address: OFF
• Save referrer URL: OFF
• Save timings: OFF
• Date stamp: OFF, if you don't need it

LimeSurvey specifically says that with anonymized responses there is no way for even the administrator to connect responses to participant records.

One important distinction: HTTPS encryption is not the same as end-to-end encryption. If you tell me your use case (e.g. employee feedback, academic research, customer survey, or highly sensitive anonymous reporting) and whether you need free / paid / self-hosted, I can narrow this to the best 2–3 options.