Blooms
Security
Distribute keys once for serverless applications
No keyCORSHTTPS
Free Security APIs
Threat intelligence, breach lookup, vulnerability feeds and scanning.
71 listed · 24 need no key · 13 work in the browser
dead-drop
Security
Ephemeral zero-knowledge encrypted data sharing
No keyCORSHTTPS
FishFish
Security
FishFish is an automated service designed to quickly detect and mitigate phishing threats before they can be exploited for malicious purposes. It provides a streamlined solution for identifying harmful resources efficiently.
No keyCORSHTTPS
Hashable
Security
A REST API to access high level cryptographic functions and methods
No keyCORSHTTPS
Microsoft Security Response Center (MSRC)
Security
Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC)
No keyCORSHTTPS
National Vulnerability Database
Security
U.S. National Vulnerability Database
No keyCORSHTTPS
Presend
Security
Security and developer utility API -- malware, vulnerability, and domain checks, no signup
No keyCORSHTTPS
Virushee
Security
Virushee file/data scanning
No keyCORSHTTPS
Classify
Security
Encrypting & decrypting text messages
No keyHTTPS
CSR.plus
Security
Generate certificate signing requests and private keys without OpenSSL
No keyHTTPS
CVE.report
Security
CVE records with NVD KEV and EPSS enrichment
No keyHTTPS
Dehash.lt
Security
Hash decryption MD5, SHA1, SHA3, SHA256, SHA384, SHA512
No keyHTTPS
EmailRep
Security
Email address threat and risk prediction
No keyHTTPS
Escape
Security
An API for escaping different kind of queries
No keyHTTPS
FilterLists
Security
Lists of filters for adblockers and firewalls
No keyHTTPS
IPLogs
Security
Free VPN, proxy, Tor and datacenter IP detection. 13 sources, active probing
No keyHTTPS
Mozilla http scanner
Security
Mozilla observatory http scanner
No keyHTTPS
Mozilla tls scanner
Security
Mozilla observatory tls scanner
No keyHTTPS
Passwordinator
Security
Generate random passwords of varying complexities
No keyHTTPS
PhishStats
Security
Phishing database
No keyHTTPS
Portscan
Security
Scans the requesting client's IP for open TCP ports with fast or deep modes on IPv4/IPv6
No keyHTTPS
SSL Labs
Security
Deep SSL/TLS server analysis with A+ to F grading
No keyHTTPS
UK Police
Security
UK Police data
No keyHTTPS
URLhaus
Security
Database of malicious URLs used for malware distribution
No keyHTTPS
All 71 Security APIs
- Blooms
- dead-drop
- FishFish
- Hashable
- Microsoft Security Response Center (MSRC)
- National Vulnerability Database
- Presend
- Virushee
- Classify
- CSR.plus
- CVE.report
- Dehash.lt
- EmailRep
- Escape
- FilterLists
- IPLogs
- Mozilla http scanner
- Mozilla tls scanner
- Passwordinator
- PhishStats
- Portscan
- SSL Labs
- UK Police
- URLhaus
- BluTV Authentication API
- InternetDB API
- LoginRadius
- temp mail api by boomlify
- Whoisfreaks
- Application Environment Verification
- BinaryEdge
- BitWarden
- Botd
- Bugcrowd
- Catchdoms Security API
- Censys
- ClassiFinder
- Complete Criminal Checks
- CompliAPI
- Credit Card Validation API
- CRXcavator
- Developer Toolbox API
- Domain Intelligence
- Domain WHOIS API
- FingerprintJS Pro
- FOFA
- FraudLabs Pro
- FullHunt
- GitGuardian
- GreyNoise
- HackerOne
- HaveIBeenPwned
- Hybrid Analysis
- INNOCYBER Authentication
- Intelligence X
- Kiprio SSL Inspector
- Kmail API
- Multifon Client API
- Neetix Liveliness
- Peremen API
- Privacy.com
- Pulsedive
- SecurityTrails
- SecurityTrails
- Shodan
- Spyse
- SSL Domain Health Check
- SXP VPN API
- Threat Jammer
- VulDB
- WhoisJSONApi
Free Security APIs — common questions
Counts and timings below come from our own scheduled checks of this category.
How many free security APIs are there?
We track 71 in this category, of which 50 responded at our last check. 24 of them need no API key.
Which security APIs work without an API key?
24 of the 71 entries here need no credential. Filter this page by "no key" to see them, or browse the no-key collection for every keyless API across all categories.
Can I use these security APIs in a browser app?
8 entries in this category need no key and return CORS headers, which is the combination that lets you call them straight from client-side JavaScript. The rest need a server or a proxy in between.
Which is the fastest free security API?
Of the keyless options that responded at our last check, CVE.report was quickest at a median 332 ms. Speed is only one factor — coverage and licensing usually matter more — but it is measured here rather than claimed.
How do you know these APIs still work?
We call every listing on a schedule and record the status code, response time and whether CORS headers came back. Those results drive the badges on this page. Across the whole catalogue, 487 of 2,712 entries were not responding at the last full run, which is the sort of thing an unchecked list never tells you.