Security APIs provide authentication, encryption, and access control services. Implement robust security features in your applications including password hashing, token management, and permission systems.
Last verified: November 12, 2026
| Name | Description | Auth | HTTPS | CORS | Uptime (30 days) |
|---|---|---|---|---|---|
| Agent Verifier | Self-check for AI agents: verifies Web Bot Auth signatures and shows how a request looks | none | Yes | no | 100% (5 checks) |
| Application Environment Verification | Android library and API to verify the safety of user devices, detect rooted devices and other risks | apikey | Yes | yes | 100% (5 checks) |
| ArkForge Trust Layer | Cryptographic proof API for HTTP exchanges — Ed25519, RFC 3161, and Sigstore Rekor attestation | apikey | Yes | yes | 100% (5 checks) |
| BitWarden | Best open-source password manager | oauth | Yes | unknown | 100% (5 checks) |
| Botd | Botd is a browser library for JavaScript bot detection | apikey | Yes | yes | 100% (5 checks) |
| Bugcrowd | Bugcrowd API for interacting and tracking the reported issues programmatically | apikey | Yes | unknown | 100% (5 checks) |
| Censys | Search engine for Internet connected host and devices | apikey | Yes | no | 100% (5 checks) |
| CISA Known Exploited Vulnerabilities | CISA KEV catalog of actively exploited CVEs as JSON, filterable by vendor, with CWE and due dates | apikey | Yes | unknown | 100% (5 checks) |
| Complete Criminal Checks | Provides data of offenders from all U.S. States and Pureto Rico | apikey | Yes | yes | 100% (5 checks) |
| CompliAPI | Screen crypto addresses, emails, websites, IDs and countries against OFAC, EU, UK sanctions lists | apikey | Yes | yes | 100% (5 checks) |
| CSR.plus | Generate certificate signing requests and private keys without OpenSSL | none | Yes | yes | 100% (5 checks) |
| dead-drop | Ephemeral zero-knowledge encrypted data sharing | none | Yes | yes | 100% (5 checks) |
| DefenceLevel Index | Daily cyber threat level (DEFCON 5 to 1) with open method, history in JSON/CSV and a badge | none | Yes | yes | 100% (4 checks) |
| Domain Intelligence | DNS, WHOIS/RDAP, SSL, subdomain enumeration, and email security in one parallel call | apikey | Yes | no | 100% (5 checks) |
| EmailRep | Email address threat and risk prediction | none | Yes | unknown | 100% (5 checks) |
| Escape | An API for escaping different kind of queries | none | Yes | no | 100% (5 checks) |
| FFraud | FFraud is a free IP and email intelligence API. Check any IP address for a fraud score, abuse history and VPN, proxy, Tor or data center use, or check an email address for throwaway and invalid domains. Auth: none for the public lookups (a free API key for the /v1 endpoints). Rate limits: no daily or monthly caps, a fair-use burst limit. HTTPS and CORS. Example: curl https://api.ffraud.com/public/ip/8.8.8.8 | none | Yes | yes | 100% (3 checks) |
| Fidro | Fraud detection API returning a weighted risk score from VPN, proxy, Tor and datacenter IP detection, email validation and Stripe payment signals | apikey | Yes | yes | 100% (5 checks) |
| FilterLists | Lists of filters for adblockers and firewalls | none | Yes | unknown | 100% (5 checks) |
| FingerprintJS Pro | Fraud detection API offering highly accurate browser fingerprinting | apikey | Yes | yes | 100% (5 checks) |
| FOFA | Search engine for Internet connected assets and devices | apikey | Yes | unknown | 100% (5 checks) |
| FraudLabs Pro | Screen order information using AI to detect frauds | apikey | Yes | unknown | 100% (5 checks) |
| FullHunt | Searchable attack surface database of the entire internet | apikey | Yes | unknown | 100% (5 checks) |
| GitGuardian | Scan files for secrets (API Keys, database credentials) | apikey | Yes | no | 80.0% (5 checks) |
| GreyNoise | Query IPs in the GreyNoise dataset and retrieve a subset of the full IP context data | apikey | Yes | unknown | 80.0% (5 checks) |
| HackerOne | The industry’s first hacker API that helps increase productivity towards creative bug bounty hunting | apikey | Yes | unknown | 100% (5 checks) |
| HaveIBeenPwned | Passwords which have previously been exposed in data breaches | apikey | Yes | unknown | 100% (5 checks) |
| Hybrid Analysis | File and URL malware analysis powered by Falcon Sandbox | apikey | Yes | unknown | 100% (5 checks) |
| Intelligence X | Perform OSINT via Intelligence X | apikey | Yes | unknown | 100% (5 checks) |
| IPASIS | Bot detection and fraud prevention API with IP reputation and email validation | apikey | Yes | yes | 100% (5 checks) |
| IPGuardian | Check IP addresses against 140+ public threat intelligence blocklists | none | Yes | yes | 100% (5 checks) |
| IPLogs | Free VPN, proxy, Tor and datacenter IP detection. 13 sources, active probing. | none | Yes | yes | 100% (5 checks) |
| IPScanner | IP network class (residential, mobile, hosting, VPN, residential proxy, Tor) with a confidence score | apikey | Yes | yes | 100% (5 checks) |
| isMalicious | Reputation of IPs, domains, URLs and file hashes from aggregated threat feeds, plus CVE lookups | apikey | Yes | no | 100% (5 checks) |
| LoginRadius | Managed User Authentication Service | apikey | Yes | yes | 100% (5 checks) |
| Maskbreak | Detect VPNs, proxies, Tor, bots and antidetect browsers at signup, login and checkout | apikey | Yes | yes | 100% (5 checks) |
| Microsoft Security Response Center (MSRC) | Programmatic interfaces to engage with the Microsoft Security Response Center (MSRC) | none | Yes | unknown | 100% (5 checks) |
| Mozilla http scanner | Mozilla observatory http scanner | none | Yes | unknown | 100% (5 checks) |
| Mozilla tls scanner | Mozilla observatory tls scanner | none | Yes | unknown | 100% (5 checks) |
| National Vulnerability Database | U.S. National Vulnerability Database | none | Yes | unknown | 100% (5 checks) |
| Neetix Liveliness | Face liveness, presentation-attack detection and 1:1 face match for identity verification | apikey | Yes | no | 100% (5 checks) |
| NetAPI | Domain data API: compromised domain/IP checks, TLD stats, Top 1M ranks, new-domain search and domain lists for 1,500+ TLDs | none | Yes | yes | 100% (5 checks) |
| Offendersearch | Search sex-offender records across all 58 US state, territory and tribal registries in one query; REST API plus open data | apikey | Yes | yes | 100% (5 checks) |
| openshield | Image and text moderation API (accept, review or reject) and fraud scoring for sign-ups, logins and payments, EU-hosted, free monthly tier | apikey | Yes | no | 100% (4 checks) |
| OSV | Open source vulnerability database and distributed triage infrastructure | none | Yes | yes | 100% (5 checks) |
| OWASP ZAP | Automated security testing API for web apps | none | Yes | unknown | 100% (5 checks) |
| Passwordinator | Generate random passwords of varying complexities | none | Yes | yes | 100% (5 checks) |
| Patronus Protect | Detect prompt injection in text, public webpages and documents for AI agents and RAG pipelines | apikey | Yes | no | 100% (5 checks) |
| Presend | Security and developer utility API -- malware, vulnerability, and domain checks, no signup | none | Yes | yes | 100% (5 checks) |
| Privacy.com | Generate merchant-specific and one-time use credit card numbers that link back to your bank | apikey | Yes | unknown | 100% (5 checks) |
| Pulsedive | Scan, search and collect threat intelligence data in real-time | apikey | Yes | unknown | 100% (5 checks) |
| RealBots | Verify whether requests claiming to be GPTBot, ClaudeBot & other AI crawlers are real | apikey | Yes | no | 100% (5 checks) |
| Sealed Rose | AI media forensics and synthetic content verification for video, audio, image, and text | apikey | Yes | yes | 100% (5 checks) |
| SecurityTrails | Domain and IP related information such as current and historical WHOIS and DNS records | apikey | Yes | unknown | 100% (5 checks) |
| Shodan | Search engine for Internet connected devices | apikey | Yes | unknown | 100% (5 checks) |
| Spyse | Access data on all Internet assets and build powerful attack surface management applications | apikey | Yes | unknown | 100% (5 checks) |
| SSL Domain Health Check | SSL certificate validity, domain WHOIS status, and DNS record checks for any domain | apikey | Yes | unknown | 100% (5 checks) |
| SSL Labs | Deep SSL/TLS server analysis with A+ to F grading | none | Yes | unknown | 100% (5 checks) |
| ThreatCluster | Threat intelligence: incident clusters, validated IOCs, CVEs, ransomware leak-site victims | apikey | Yes | no | 100% (5 checks) |
| UK Police | UK Police data | none | Yes | unknown | 100% (5 checks) |
| Virus and Malware Scan API by attachmentAV | Scan files for viruses, worms, trojans, ransomware, and other kinds of malware by sending them to the attachmentAV API powered by Sophos | apikey | Yes | no | 100% (5 checks) |
| VPNDetection | Check whether an IPv4 or IPv6 address belongs to VPN infrastructure, no key needed | none | Yes | yes | 100% (5 checks) |
| VulDB | VulDB API allows to initiate queries for one or more items along with transactional bots | apikey | Yes | unknown | 100% (5 checks) |
| Website Security Scanner | Passive website security audit: TLS, security headers, exposed files and a 0-100 score | apikey | Yes | unknown | 100% (4 checks) |
22 of these APIs require no authentication — you can start making requests immediately without signing up for an account. Just pick one from the table above, check its documentation, and send your first request.
41 APIs in this category require a free API key. This usually means creating a free account on the provider's website and copying your key from the dashboard. The process typically takes less than a minute.
Not sure where to start? Check the uptime column: it shows how often each API's documentation responded to our daily checks over the last 30 days, and the dot shows whether it responded at the latest check. For browser-based projects, check that the API supports CORS.
Yes, all APIs listed on API Bouncer have a free tier. Some are completely open (no sign-up needed), while others require a free account to get an API key. Free tiers typically have rate limits — check each API's documentation for specifics.
It depends on your needs. Consider: Do you need authentication or prefer no-auth? Does your project need CORS support for browser access? How many requests will you make? Start with a no-auth API to prototype quickly, then switch to a more feature-rich option if needed.
We run periodic health checks on all listed APIs. The "Status" column shows whether each API was responding at our last check. APIs marked as "alive" were recently verified. You can also test any API yourself using curl or our guides on testing APIs.
Most free APIs allow commercial use, but terms vary by provider. Always check the specific API's terms of service. Some APIs have separate free and commercial tiers with different rate limits.
Buy me a coffee