I built 18 free, no-signup APIs because I was tired of hunting for the same tools scattered across a dozen different services

Presendapp — Wed, 26 Aug 2026 15:51:57 +0000

Every project seems to need the same handful of utilities: hash a file, validate an email, generate a UUID, check if a password's been breached, strip tracking params from a URL. Individually these aren't hard to build, but collecting them means either writing the same boilerplate for the tenth time or signing up for five different services, each wanting an API key, a credit card on file "just in case," or a rate limit that resets on their schedule, not yours.

So I built Presend — it started as a set of privacy-first browser tools (strip EXIF data, compress a PDF, clean a URL, all client-side, nothing uploaded), and I've spent the last few days turning the useful parts into a proper API layer sitting on top of it. No signup, no key, no dashboard to configure. You just call the endpoint.

What's in it

18 endpoints, roughly grouped like this:

Security & crypto

POST /api/hash — SHA-256/1/512 of a file
GET /api/password — generate a secure password with an entropy estimate
GET /api/password-breach — check a password against Have I Been Pwned using k-anonymity (only 5 hash characters ever leave your server, the password itself never does)
GET /api/jwt-decode — decode a JWT's header and payload (no signature verification, by design — no secret needed, no risk)

Validation

GET /api/email-validate — syntax check and a real MX record lookup, so you know the domain can actually receive mail
GET /api/email-disposable — flags throwaway addresses (Mailinator, Guerrilla Mail, etc.) against a list of 576+ known domains

Cybersecurity

GET /api/security-headers — audits a site's HTTP security headers (CSP, HSTS, X-Frame-Options...) and returns a letter grade, like securityheaders.com but as JSON you can drop into a CI pipeline
GET /api/url-reputation — checks a URL against URLhaus's public malware/phishing database
GET /api/subdomains — passive subdomain discovery via Certificate Transparency logs, for auditing your own attack surface

Everyday dev utilities

GET /api/uuid, GET /api/base64, GET /api/timestamp, GET /api/color, GET /api/user-agent, GET/POST /api/csv-json, GET /api/favicon
GET/POST /api/url-clean — strips 60+ tracking parameters, single URL or batch up to 100
GET /api/ip — geolocation, currency, language, EU/VPN flags for the caller's IP

Everything runs on Cloudflare's edge network, so latency is generally low no matter where you're calling from.

A quick example
curl -X POST --data-binary @file.pdf https://presend.pages.dev/api/hash → returns SHA-256, SHA-1 and SHA-512 as JSON
curl "https://presend.pages.dev/api/email-validate?email=foo@example.com" → checks syntax and does a real MX record lookup
curl "https://presend.pages.dev/api/security-headers?url=https://example.com" → returns a letter grade and a per-header breakdown

There's also a zero-dependency npm client (npm install presend-api) if you'd rather not hand-roll the fetch calls. It currently wraps 15 of the 18 endpoints — the three newest cybersecurity ones aren't wrapped yet, so you'd hit those with plain fetch() for now. I'll catch the package up soon.

Full docs (with runnable curl examples for every endpoint) and an OpenAPI spec are at presend.pages.dev/api.

The honest limitations
No SLA. This is a free, fair-use service running on Cloudflare's free tier. Endpoints are rate-limited (typically 20-60 req/min per IP) and I make no uptime promises. If you need guaranteed availability for something critical, this isn't that.
/api/subdomains depends on crt.sh, a third-party Certificate Transparency search service that's known to have occasional downtime outside of my control. When it's down, that one endpoint returns an error — the rest are unaffected.
/api/csv-json doesn't flatten nested objects. If your JSON has objects nested inside objects, they get stringified rather than split into columns. Flat JSON converts cleanly.

I'd rather list what doesn't work than have you find out the hard way.

Why free, no catch

The site's original purpose (client-side file tools) doesn't cost me anything to run at scale — the browser does the work. The API layer is a natural extension: most of these endpoints are cheap to serve, and I'd rather have people actually using and linking to the thing than gate it behind a signup form that kills 90% of casual visitors before they ever try it.

If you build something with it, or find a bug, I'm around in the comments. And if there's a specific free-but-annoying-to-integrate service you keep needing in projects, tell me — that's basically how the last five endpoints got added.

Links:

Site & docs: https://presend.pages.dev/api
npm: https://www.npmjs.com/package/presend-api
Source: https://github.com/presendapp/presend

DEV Community: Presendapp

I built 18 free, no-signup APIs because I was tired of hunting for the same tools scattered across a dozen different services