# Free Security APIs

Page: https://free-web-services.com/web-services/web-development/security/

Security APIs check links, files, domains, passwords and certificates: whether a URL or file is malicious, whether a password has leaked, who owns a domain and how well a site's HTTPS is set up. Use them to protect your users and watch your own sites.

## Services

| Service | API key | Formats | Free use |
|---|---|---|---|
| [crt.sh certificate search](https://free-web-services.com/web-services/web-development/security/crt-sh-certificate-search.md) | Not needed | JSON | Free, no key needed; avoid very heavy automated use. |
| [Google Safe Browsing API](https://free-web-services.com/web-services/web-development/security/google-safe-browsing-api.md) | Needed, free | JSON | Free for non-commercial use with a free API key; commercial use needs Google's Web Risk API. |
| [MDN HTTP Observatory API](https://free-web-services.com/web-services/web-development/security/mdn-http-observatory-api.md) | Not needed | JSON | Free, no key needed. |
| [OSV API](https://free-web-services.com/web-services/web-development/security/osv-api.md) | Not needed | JSON | Free, no key needed. |
| [Pwned Passwords API](https://free-web-services.com/web-services/web-development/security/pwned-passwords-api.md) | Not needed | - | Free, no key needed. |
| [RDAP (WHOIS)](https://free-web-services.com/web-services/web-development/security/rdap-whois.md) | Not needed | JSON | Free, no key needed. |
| [Shodan InternetDB](https://free-web-services.com/web-services/web-development/security/shodan-internetdb.md) | Not needed | JSON | Free for non-commercial use, no key needed; commercial use needs a Shodan enterprise license. |
| [SSL Labs API](https://free-web-services.com/web-services/web-development/security/ssl-labs-api.md) | Needed, free | JSON | Free, but version 4 needs registration with an organisation e-mail address, and commercial use needs permission from Qualys. |
| [urlscan.io API](https://free-web-services.com/web-services/web-development/security/urlscan-io-api.md) | Needed, free | JSON | Free with a free API key and daily limits; paid plans for private scans and more volume. |
| [VirusTotal API](https://free-web-services.com/web-services/web-development/security/virustotal-api.md) | Needed, free | JSON | The free public API needs a free key, has a limit of a few requests per minute and a daily cap, and may not be used in commercial products. |

## Questions

**Which free security APIs work without an API key?**  
crt.sh certificate search, MDN HTTP Observatory API, OSV API, Pwned Passwords API, RDAP (WHOIS) and Shodan InternetDB work without a key, according to their documentation. Most keyless services ask you to keep the number of requests reasonable, and some ask for a User-Agent that names your app.

**Are these security APIs really free?**  
The services here can be used without paying, at least on a free plan or free tier, often with limits such as a number of requests per day or non-commercial use only. The table above quotes what each service says about its free use; check the provider's own terms before you rely on it.

**How up to date is this list?**  
The address of every service is checked about once a week, and services that stop working or stop being free are removed. This list last changed on November 12th, 2026.