Security & Auth APIs
Free security APIs: breach and password checks, malware and URL scanning, authentication and authorization services, plus email and data validation endpoints.
29 tested APIs with full docs · 29 need no key · 104 more listed
Tested, with full documentation
We called each of these before publishing. Every page carries a working curl command, the real JSON response it returned, parameters and common errors.
AlienVault OTX
Free AlienVault Open Threat Exchange API: look up domains, IPs, URLs and file hashes against community threat intelligence, malware and passive DNS. Tested.
Cert Spotter
Free SSLMate Cert Spotter API with no key: search certificate transparency logs for every TLS certificate issued for a domain, with issuer, SANs and validity dates.
CIRCL CVE Search
Free CIRCL CVE Search API with no key: query vulnerabilities by id, vendor or product, and pull the latest published CVEs. CORS enabled. Tested example.
CIRCL hashlookup
Free CIRCL hashlookup API with no key: check MD5, SHA-1 or SHA-256 file hashes against NSRL and other known-good datasets to filter out legitimate system files.
CISA Known Exploited Vulnerabilities
Free CISA Known Exploited Vulnerabilities catalogue as JSON, no key: every CVE with confirmed in-the-wild exploitation, with required remediation actions and due dates.
Cloudflare DNS-over-HTTPS
Free Cloudflare 1.1.1.1 DNS-over-HTTPS API with no key: resolve any record type as JSON with a documented no-logging privacy policy. Tested example.
CVE Program (CVE Services)
Free CVE Program API with no key: fetch the authoritative CVE Record for any CVE ID in JSON 5.1 format, straight from the CVE Services registry. Tested example included.
Disify
Free disposable email checker API with no key: detect temporary and throwaway email domains, validate format and check DNS. CORS enabled. Tested example.
EPSS (FIRST.org)
Free EPSS API from FIRST.org with no key: daily exploitation probability and percentile for every published CVE. Prioritise patching by likelihood, not just severity.
FilterLists
Free FilterLists API with no key: a catalogued directory of thousands of adblock, DNS and firewall filter lists with syntax, licence, language and maintainer metadata. Tested example included.
FishFish
Free FishFish API with no key: a community-curated list of phishing and scam domains targeting gaming and chat platforms, updated continuously. Plain JSON array of domains.
Google Public DNS
Free Google DNS-over-HTTPS API with no key: resolve any DNS record type as JSON, with DNSSEC validation. Query DNS from the browser. Tested example.
Hashify
Free hashing API with no key: generate MD5, SHA-1, SHA-256 and other digests over HTTP in hex or base64. Tested curl example and security guidance.
Have I Been Pwned Breaches
Free Have I Been Pwned breach list API with no key: every catalogued data breach with date, affected accounts and compromised data types. Tested curl example.
SANS Internet Storm Center
Free SANS Internet Storm Center DShield API with no key: most-targeted ports, attacking source counts, IP reputation and daily internet threat data from a global sensor network.
Kickbox Disposable
Free Kickbox open API with no key: check whether an email domain is disposable. Returns a single boolean, extremely fast and simple. Tested curl example.
MITRE ATT&CK TAXII
Free MITRE ATT&CK TAXII 2.1 server with no key: fetch the Enterprise, Mobile and ICS knowledge bases as STIX 2.1 objects — techniques, tactics, groups, software and mitigations.
MDN HTTP Observatory
Free MDN HTTP Observatory API with no key: scan any site's security headers — CSP, HSTS, X-Frame-Options — and get a graded score with fixes. Tested.
Microsoft Security Response Center
Free Microsoft Security Response Center API with no key: monthly security update summaries and full CVRF documents with CVEs, affected products, KB articles and severities.
NVD CVE
Free NIST National Vulnerability Database API: search CVEs by id, keyword, severity, CVSS score and date with full descriptions and references. Tested example.
OpenPhish Community Feed
Free OpenPhish community feed with no key: a live plain-text list of active phishing URLs, refreshed continuously. One URL per line, ready for blocklists and enrichment.
OpenSSF Scorecard
Free OpenSSF Scorecard API with no key: automated supply-chain security scores for open source repositories across 18 checks, with reasons and evidence for each.
Pwned Passwords
Free Have I Been Pwned password API with no key. Check if a password appears in known breaches using k-anonymity — the password never leaves your server. Tested.
Ransomware.live
Free Ransomware.live API with no key: recent ransomware victims claimed on leak sites, group profiles, negotiation data and infostealer context. Passive OSINT, no scanning.
Shodan InternetDB
Free Shodan InternetDB API with no key: open ports, hostnames, CVEs and technology tags for any IPv4 address. Fast, cached attack-surface data. Tested example included.
SSL Labs
Free Qualys SSL Labs API with no key: deep TLS/SSL analysis of any HTTPS host, grading certificates, protocols and cipher suites. Tested curl example.
Stop Forum Spam
Free Stop Forum Spam API with no key: check an IP address, email or username against a community database of forum spam reports, with confidence score and Tor exit flag.
Tor Exit Node List
Free official Tor Project exit node list with no key: every current Tor exit IP as plain text, updated continuously. Essential for abuse filtering. Tested.
urlscan.io
Free urlscan.io search API with no key: search millions of website scans for domains, IPs and page content to investigate phishing and malicious sites. Tested.
Choosing between these Security & Auth APIs
This category spans four related jobs: checking whether credentials have been exposed, scanning URLs and files for malware, handling authentication flows, and validating user-supplied data before it reaches your database.
Security APIs are the one category where you should read the privacy terms before sending anything. Never send raw passwords or personal data to a third-party endpoint — well-designed services such as breach checkers use k-anonymity so you never transmit the full secret.
More Security & Auth APIs in the directory
104 further APIs in this category, of which 29 need no API key. These are catalogued from the public-API lists and link straight to each provider's own documentation — we have not tested them yet, so treat the auth and CORS flags as the upstream list's claim rather than ours. They are promoted to a full tested page as we work through them.
| API | What it does | Auth |
|---|---|---|
| AbuseIPDB | IP/domain/URL reputation | Key |
| AlienVault Open Threat Exchange (OTX) | IP/domain/URL reputation | Key |
| API Adresse | Official French address validation service | None |
| Application Environment Verification | Android library and API to verify the safety of user devices, detect rooted devices and other risks | KeyCORS |
| ArkForge Trust Layer | Cryptographic proof API for HTTP exchanges — Ed25519, RFC 3161, and Sigstore Rekor attestation | KeyCORS |
| Attestwire | Validate EN 16931 e-invoices: XRechnung, ZUGFeRD, Factur-X, Peppol BIS | KeyCORS |
| Auth0 | Easy to implement, adaptable authentication and authorization platform | KeyCORS |
| BinaryEdge | Provide access to BinaryEdge 40fy scanning platform | KeyCORS |
| BitWarden | Best open-source password manager | OAuth |
| Botd | Botd is a browser library for JavaScript bot detection | KeyCORS |
| Brevo Suit | Connection for brevo CRM suite | KeyCORS |
| Bugcrowd | Bugcrowd API for interacting and tracking the reported issues programmatically | Key |
| CAPEsandbox | Malware execution and analysis | Key |
| Censys | Search engine for Internet connected host and devices | Key |
| ChronoVerify | Image capture time and provenance verification: C2PA Content Credentials, EXIF, pixel forensics | None |
| Classify | Encrypting & decrypting text messages | NoneCORS |
| Classify | Encrypting & decrypting text messages | NoneCORS |
| ClawSearch | Security-first search engine API for AI agent skills with Trust Score | NoneCORS |
| Clerk | Drop-in React components for authentication and authorization | KeyCORS |
| Complete Criminal Checks | Provides data of offenders from all U.S. States and Pureto Rico | KeyCORS |
| Corbado | Passkey-first authentication | KeyCORS |
| CRXcavator | Chrome extension risk scoring | Key |
| CSR.plus | Generate certificate signing requests and private keys without OpenSSL | NoneCORS |
| dead-drop | Ephemeral zero-knowledge encrypted data sharing | NoneCORS |
| Defend Network | Free no-auth JSON feed of exploited CVEs with CVSS, EPSS and CISA KEV status | NoneCORS |
| Dehash.lt | Hash decryption MD5, SHA1, SHA3, SHA256, SHA384, SHA512 | None |
| Domain Intelligence | DNS, WHOIS/RDAP, SSL, subdomain enumeration, and email security in one parallel call | Key |
| DomScan | Domain, DNS, WHOIS/RDAP, TLS, email, brand and web intelligence | KeyCORS |
| Dymo API | Fraud & reputation detection | KeyCORS |
| EmailRep | Email address threat and risk prediction | None |
| Escape | An API for escaping different kind of queries | None |
| FingerprintJS Pro | Fraud detection API offering highly accurate browser fingerprinting | KeyCORS |
| FOFA | Search engine for Internet connected assets and devices | Key |
| FraudLabs Pro | Screen order information using AI to detect frauds | Key |
| FullHunt | Searchable attack surface database of the entire internet | Key |
| GetOTP | Implement OTP flow quickly | Key |
| GitGuardian | Scan files for secrets (API Keys, database credentials) | Key |
| Google Safe Browsing | Google Link/Domain Flagging | Key |
| GreyNoise | Query IPs in the GreyNoise dataset and retrieve a subset of the full IP context data | Key |
| HackerOne | The industry’s first hacker API that helps increase productivity towards creative bug bounty hunting | Key |
| Hashable | A REST API to access high level cryptographic functions and methods | NoneCORS |
| HaveIBeenPwned | Passwords which have previously been exposed in data breaches | Key |
| Hybrid Analysis | File and URL malware analysis powered by Falcon Sandbox | Key |
| Intelligence X | Perform OSINT via Intelligence X | Key |
| IPASIS | Bot detection and fraud prevention API with IP reputation and email validation | KeyCORS |
| IPLogs | Free VPN, proxy, Tor and datacenter IP detection. 13 sources, active probing | NoneCORS |
| IPWhois.net Blacklist | Community IP blacklist to check and report abusive IP addresses | None |
| Kinde | Authentication for modern applications. Integrates in minutes and free up to 7,500 MAU | OAuth |
| LeakInsight | Find leaked or exposed credentials by email, username, phone, domain, hash, or breach origin | Key |
| Lob.com | US Address Verification | Key |
| LoginRadius | Managed User Authentication Service | KeyCORS |
| MalDatabase | Provide malware datasets and threat intelligence feeds | Key |
| MalShare | Malware Archive / file sourcing | Key |
| MalwareBazaar | Collect and share malware samples | Key |
| Metacert | Metacert Link Flagging | Key |
| Micro User Service | User management and authentication | Key |
| Microsoft Security Response Center (MSRC) | Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC) | None |
| MojoAuth | Secure and modern passwordless authentication platform | KeyCORS |
| Mozilla http scanner | Mozilla observatory http scanner | None |
| Mozilla tls scanner | Mozilla observatory tls scanner | None |
| National Vulnerability Database | U.S. National Vulnerability Database | None |
| Nonprofit Check Plus | Verify charities via EIN using IRS, PUB78, BMF & OFAC data for compliance and legitimacy | Key |
| NoPhishy | Check links to see if they're known phishing attempts | KeyCORS |
| OWASP ZAP | Automated security testing API for web apps | None |
| Passwordinator | Generate random passwords of varying complexities | NoneCORS |
| Phisherman | IP/domain/URL reputation | Key |
| PhishStats | Phishing database | None |
| Portscan | Scans the requesting client's IP for open TCP ports with fast or deep modes on IPv4/IPv6 | NoneCORS |
| Postman Echo | Test api server to receive and return value from HTTP method | None |
| Privacy.com | Generate merchant-specific and one-time use credit card numbers that link back to your bank | Key |
| Pulsedive | Scan, search and collect threat intelligence data in real-time | Key |
| PurgoMalum | Content validator against profanity & obscenity | None |
| SAWO Labs | Simplify login and improve user experience by integrating passwordless authentication in your app | KeyCORS |
| Scanii | Simple REST API that can scan submitted documents/files for the presence of threats | KeyCORS |
| ScanMalware | Scan URLs in a sandboxed browser and search past scans by domain, IP, ASN, JARM or favicon hash | NoneCORS |
| SchemaShield | Read-only preflight for breaking schema changes and downstream query impact | Key |
| SecurityTrails | Domain and IP related information such as current and historical WHOIS and DNS records | Key |
| Shodan | Search engine for Internet connected devices | Key |
| SniffCat | IP abuse lookup, reporting and threat intelligence | KeyCORS |
| Spyse | Access data on all Internet assets and build powerful attack surface management applications | Key |
| SSL Domain Health Check | SSL certificate validity, domain WHOIS status, and DNS record checks for any domain | Key |
| Stytch | User infrastructure for modern applications | Key |
| Temsor | Validates Turkish national ID, tax number, IBAN, phone, plate and parses addresses | KeyCORS |
| Threat Jammer | Risk scoring service from curated threat intelligence data | Key |
| UK Police | UK Police data | None |
| URLhaus | Bulk queries and Download Malware Samples | NoneCORS |
| URLhaus | Database of malicious URLs used for malware distribution | None |
| US Autocomplete | Enter address data quickly with real-time address suggestions | KeyCORS |
| US Extract | Extract postal addresses from any text including emails | KeyCORS |
| US Street Address | Validate and append data for any US postal address | KeyCORS |
| Validate UK Postcodes | This API validates postal codes within UK | KeyCORS |
| VatcheckAPI | VAT Number Validation & Lookup REST API | KeyCORS |
| VATlayer | VAT number validation | Key |
| VerifyEd | Verify academic credentials — search 912K+ schools, detect diploma mills worldwide | KeyCORS |
| Verisys Antivirus API | Antivirus as a service - REST API that scans provided files for malware and NSFW content | KeyCORS |
| Virus and Malware Scan API by attachmentAV | Scan files for viruses, worms, trojans, ransomware, and other kinds of malware by sending them to the attachmentAV API powered by Sophos | Key |
| Virushee | Virushee file/data scanning | NoneCORS |
| VirusTotal | VirusTotal File/URL Analysis | Key |
| VirusTotal | VirusTotal File/URL Analysis | Key |
| VulDB | VulDB API allows to initiate queries for one or more items along with transactional bots | Key |
| Warrant | APIs for authorization and access control | KeyCORS |
| Warrant | APIs for authorization and access control | KeyCORS |
| Web of Trust | IP/domain/URL reputation | Key |
| Whoisfreaks | Domain and DNS related information that will equip organizaion with comprehensive threat intelligence and attack surface analysis capabilities for enhanced security | Key |