Security related services
Encryption and coding services
Security APIs check links, files, domains, passwords and certificates: whether a URL or file is malicious, whether a password has leaked, who owns a domain and how well a site's HTTPS is set up. Use them to protect your users and watch your own sites.
crt.sh certificate search
crt.sh searches Certificate Transparency logs: all publicly issued TLS certificates for a domain, including its subdomains (use %.example.com). Add output=json to get the results as JSON, with issuer, names and validity dates. ...
Google Safe Browsing API
The Google Safe Browsing API checks URLs against Google's constantly updated lists of unsafe web resources: malware, phishing (social engineering), unwanted software and harmful apps. Use the Lookup API for simple checks or the ...
MDN HTTP Observatory API
The MDN HTTP Observatory, run by Mozilla, checks how well a website uses security headers and settings such as Content-Security-Policy, HSTS, cookies, redirects and subresource integrity. Send a POST request with a host name and ...
OSV API
OSV.dev is Google's open database of security vulnerabilities in open source packages, covering ecosystems such as npm, PyPI, Maven, Go and crates.io. Its API tells you whether a package version or commit is affected: POST to ...
Pwned Passwords API
Pwned Passwords from Have I Been Pwned lets you check whether a password appears in known data breaches, without ever sending the password. Hash the password with SHA-1, send only the first five characters of the hash, and ...
RDAP (WHOIS)
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns registration data for domain names, IP addresses and AS numbers as structured JSON: registrar, registration and expiry dates, status and ...
Shodan InternetDB
Shodan InternetDB gives a quick summary of what Shodan has seen on an IP address: open ports, known vulnerabilities (CVEs), CPEs, hostnames and tags. Use it to check your own servers or flag risky addresses in logs. Call GET ...
SSL Labs API
The Qualys SSL Labs API runs the well-known SSL Server Test on any public website and returns its grade (A+ to F) with details about certificates, protocols, cipher suites and known vulnerabilities. Start a scan, poll until it is ...
urlscan.io API
urlscan.io visits a URL like a real browser and records everything it does: requested domains and IPs, redirects, cookies, technologies, a screenshot and a verdict on whether it looks malicious. The API lets you submit URLs for ...
VirusTotal API
VirusTotal checks files, URLs, domains and IP addresses with dozens of antivirus engines and URL scanners. The API lets you look up the report for a file hash, URL or domain, and submit new files and URLs for analysis. Responses ...
Compare the security APIs
| Service | API key | Formats | Free use |
|---|---|---|---|
| crt.sh certificate search | Not needed | JSON | Free, no key needed; avoid very heavy automated use. |
| Google Safe Browsing API | Needed, free | JSON | Free for non-commercial use with a free API key; commercial use needs Google's Web Risk API. |
| MDN HTTP Observatory API | Not needed | JSON | Free, no key needed. |
| OSV API | Not needed | JSON | Free, no key needed. |
| Pwned Passwords API | Not needed | – | Free, no key needed. |
| RDAP (WHOIS) | Not needed | JSON | Free, no key needed. |
| Shodan InternetDB | Not needed | JSON | Free for non-commercial use, no key needed; commercial use needs a Shodan enterprise license. |
| SSL Labs API | Needed, free | JSON | Free, but version 4 needs registration with an organisation e-mail address, and commercial use needs permission from Qualys. |
| urlscan.io API | Needed, free | JSON | Free with a free API key and daily limits; paid plans for private scans and more volume. |
| VirusTotal API | Needed, free | JSON | The free public API needs a free key, has a limit of a few requests per minute and a daily cap, and may not be used in commercial products. |
Questions
Which free security APIs work without an API key?
crt.sh certificate search, MDN HTTP Observatory API, OSV API, Pwned Passwords API, RDAP (WHOIS) and Shodan InternetDB work without a key, according to their documentation. Most keyless services ask you to keep the number of requests reasonable, and some ask for a User-Agent that names your app.
Are these security APIs really free?
The services here can be used without paying, at least on a free plan or free tier, often with limits such as a number of requests per day or non-commercial use only. The table above quotes what each service says about its free use; check the provider's own terms before you rely on it.
How up to date is this list?
The address of every service is checked about once a week, and services that stop working or stop being free are removed. This list last changed on November 12th, 2026.