Validate API changelog: disposable-email detection and postal-code validation

Jonas Hämmerle — Wed, 08 Jul 2026 20:35:43 +0000

We just shipped two new endpoints on Validate, the validation/utility API — both format-only checks, no external services called, same pattern as the existing IBAN/VAT checksum endpoints.

`POST /v1/validate/disposable-email`

Flags throwaway/temp-mail addresses — Mailinator, Guerrilla Mail, 10-minute-mail, YOPmail, and 80+ other known providers, including their subdomains (so abc.mailinator.com still gets caught). Real email providers (Gmail, Outlook, your own domain, etc.) are never flagged.

curl -X POST "https://validate7.p.rapidapi.com/v1/validate/disposable-email"   -H "X-RapidAPI-Key: <your-key>"   -H "X-RapidAPI-Host: validate7.p.rapidapi.com"   -H "Content-Type: application/json"   -d '{"email": "test@mailinator.com"}'
# => {"syntaxValid":true,"domain":"mailinator.com","disposable":true,"errors":[]}

Useful paired with the existing /v1/validate/email endpoint (syntax + MX check) to reject fake signups without blocking real users.

`POST /v1/validate/postal-code`

Format validation for 50+ countries — US, CA, GB, DE, FR, and most of the EU/APAC/LatAm. Same idea as the IBAN mod-97 checksum: structure-only, no claim that the code is currently assigned by the postal service.

curl -X POST "https://validate7.p.rapidapi.com/v1/validate/postal-code"   -H "X-RapidAPI-Key: <your-key>"   -H "X-RapidAPI-Host: validate7.p.rapidapi.com"   -H "Content-Type: application/json"   -d '{"countryCode": "US", "postalCode": "94103"}'
# => {"valid":true,"countryCode":"US","postalCode":"94103","supported":true,"errors":[]}

There's also GET /v1/validate/postal-code/countries if you need the full list of supported country codes.

Both are live now on the same free tier as everything else. If there's a specific validation check you keep re-implementing that isn't covered yet, I'd genuinely like to hear about it — that's exactly how these two got picked.

Entropy-based password strength scoring (and why 'has a symbol' rules are theater)

Jonas Hämmerle — Wed, 08 Jul 2026 13:42:01 +0000

"Must contain one uppercase, one number, one symbol" rules produce passwords like Password1! — technically compliant, trivially guessable. Entropy-based scoring is a better signal.

The idea: estimate the search space an attacker would need to brute-force, based on character variety and length, then flag patterns that reduce real entropy below what the raw math suggests (dictionary words, keyboard walks, repeated characters).

Rough approach:

function estimateEntropyBits(password) {
  let poolSize = 0;
  if (/[a-z]/.test(password)) poolSize += 26;
  if (/[A-Z]/.test(password)) poolSize += 26;
  if (/[0-9]/.test(password)) poolSize += 10;
  if (/[^a-zA-Z0-9]/.test(password)) poolSize += 32;
  return Math.log2(poolSize) * password.length;
}

That's the naive version — it overestimates for anything with patterns. A real implementation should also penalize repeated substrings and common dictionary words before trusting the raw bits figure.

I built a fuller version of this (plus the breach-check endpoint from k-anonymity) as part of Validate if you want the batteries-included version.

DEV Community: Jonas Hämmerle

Validate API changelog: disposable-email detection and postal-code validation

POST /v1/validate/disposable-email

POST /v1/validate/postal-code

Entropy-based password strength scoring (and why 'has a symbol' rules are theater)

`POST /v1/validate/disposable-email`

`POST /v1/validate/postal-code`