Presend API for Developers

Free server-side endpoints for common utility tasks, plus embeddable client-side tools. No API key required. No signup.

Server-side endpoints

These run on Cloudflare's edge network and return JSON. Fair-use only — no official SLA, and heavy or automated traffic may be throttled without notice.

Python users: requests sent with the default urllib User-Agent (Python-urllib/3.x) are rejected by Cloudflare with HTTP 403 and the body error code: 1010. Set any explicit User-Agent. requests, curl and Node send one that is accepted.

import json, urllib.request
req = urllib.request.Request("https://presend.pages.dev/api/uuid", headers={"User-Agent": "my-app/1.0"})
print(json.load(urllib.request.urlopen(req)))

POST /api/hash

Returns SHA-256, SHA-1 and SHA-512 for any file up to 20MB.

curl -X POST --data-binary @file.pdf \
  https://presend.pages.dev/api/hash

# {"size_bytes":17,"hashes":{"sha256":"...","sha1":"...","sha512":"..."}}

POST /api/file-type

Detects a file's real type from its binary signature, and flags a mismatch against the claimed Content-Type — catches disguised files (e.g. an executable renamed as a photo) that slip past naive upload filters.

curl -X POST --data-binary @suspicious.jpg -H "Content-Type: image/jpeg" https://presend.pages.dev/api/file-type

POST /api/malware-check

Hashes an uploaded file (SHA-256) and checks it against MalwareBazaar (abuse.ch), a free database of known malware samples — hash plus check in one call.

curl -X POST --data-binary @file.exe https://presend.pages.dev/api/malware-check

GET /api/url-clean

Strips 60+ tracking parameters (utm_*, fbclid, gclid...) from a URL.

curl "https://presend.pages.dev/api/url-clean?url=https://example.com/?utm_source=x"

# {"clean":"https://example.com/","removed":1,"valid":true}

POST /api/url-clean

Same, batched — up to 100 URLs per request.

curl -X POST -H "Content-Type: application/json" \
  -d '{"urls":["https://a.com?fbclid=x","https://b.com?gclid=y"]}' \
  https://presend.pages.dev/api/url-clean

GET /api/ip

Returns the caller's IP with geolocation, currency, language, EU flag, and Tor exit-node detection (checked against the official Tor Project public exit list). Geolocation runs entirely at Cloudflare's edge — no third-party API call.

curl https://presend.pages.dev/api/ip

GET /api/uuid

Generates random UUIDs (v4), up to 100 per request.

curl "https://presend.pages.dev/api/uuid?count=5"

GET /api/base64

Encode or decode Base64 text.

curl "https://presend.pages.dev/api/base64?action=encode&text=hello"

GET /api/jwt-decode

Decodes a JWT's header and payload (does not verify the signature).

curl "https://presend.pages.dev/api/jwt-decode?token=eyJhbGci..."

POST /api/jwt-verify

Actually verifies a JWT's cryptographic signature (HS256/384/512, RS/PS256/384/512, ES256/384/512) via the Workers-native Web Crypto API — plus exp/nbf claim checks. Provide a "secret" for HMAC, or a "jwk"/"jwks_url" for asymmetric algorithms.

curl -X POST -H "Content-Type: application/json" -d '{"token":"...","secret":"..."}' https://presend.pages.dev/api/jwt-verify

GET /api/timestamp

Current time, or convert between Unix timestamp and ISO date.

curl "https://presend.pages.dev/api/timestamp?unix=1700000000"

GET /api/color

Convert between hex, RGB and HSL color formats.

curl "https://presend.pages.dev/api/color?hex=ff5733"

GET /api/user-agent

Parses a User-Agent string into browser, OS and device type.

curl "https://presend.pages.dev/api/user-agent"

GET /api/password

Generates a cryptographically secure password with entropy estimate.

curl "https://presend.pages.dev/api/password?length=20&symbols=1"

GET /api/email-validate

Validates email syntax and checks that the domain has an MX record. It does not probe the mailbox, so it cannot confirm the address exists; use email-verify to also detect disposable domains and role accounts.

curl "https://presend.pages.dev/api/email-validate?email=foo@example.com"

GET /api/favicon

Fetches the favicon URL for any domain.

curl "https://presend.pages.dev/api/favicon?domain=github.com"

GET/POST /api/csv-json

Converts between JSON and CSV. Nested objects are stringified, not flattened.

curl -X POST -H "Content-Type: application/json" \
  -d '{"direction":"json-to-csv","data":"[{\"a\":1}]"}' \
  https://presend.pages.dev/api/csv-json

GET /api/password-breach

Checks if a password appears in known data breaches (Have I Been Pwned). Only the first 5 characters of its SHA-1 hash are sent to HIBP (k-anonymity), and Presend does not log it. But this is a GET request, so the password travels in the URL, where browsers, proxies or server logs may record it: for real passwords, use POST /api/password-check.

curl "https://presend.pages.dev/api/password-breach?password=..."

POST /api/password-check

Combines strength/entropy scoring with an optional breach check in one call — the password travels in the POST body, never in a URL. Same k-anonymity guarantee as password-breach.

curl -X POST -H "Content-Type: application/json" -d '{"password":"..."}' https://presend.pages.dev/api/password-check

GET /api/email-disposable

Detects disposable/throwaway email providers from a list of 576+ known domains.

curl "https://presend.pages.dev/api/email-disposable?email=foo@mailinator.com"

GET /api/email-verify

Combines syntax, MX lookup, disposable-domain detection and role-account detection (info@, admin@...) in one call, free and without a key. It does not probe the mailbox.

curl "https://presend.pages.dev/api/email-verify?email=foo@example.com"

GET /api/phone-verify

Validates and formats a phone number (E.164, international, national) via libphonenumber-js. If no country is given for a number without a "+" prefix, the caller's IP-derived country is used automatically.

curl "https://presend.pages.dev/api/phone-verify?number=%2B14155552671"

GET /api/email-security

Checks a domain's anti-spoofing email setup: SPF strength, DMARC policy, and a best-effort DKIM lookup against common selectors.

curl "https://presend.pages.dev/api/email-security?domain=example.com"

GET /api/security-scan

Combines security-headers + url-reputation + subdomains into one report with an overall score and verdict — one call instead of three.

curl "https://presend.pages.dev/api/security-scan?url=https://example.com"

POST /api/qr-scan

Decodes a QR code from an uploaded image, and if it links to a URL, checks it against URLhaus for malware/phishing indicators — decode plus reputation check in one call. QR-code phishing ("quishing") is one of the fastest-growing phishing vectors.

curl -X POST -F "file=@qrcode.png" https://presend.pages.dev/api/qr-scan

GET /api/security-headers

Audits HTTP security headers (CSP, HSTS, X-Frame-Options...) and gives a letter grade.

curl "https://presend.pages.dev/api/security-headers?url=https://example.com"

GET /api/url-reputation

Checks a URL against URLhaus, a public malware/phishing database.

curl "https://presend.pages.dev/api/url-reputation?url=https://example.com"

GET /api/subdomains

Passive subdomain discovery via Certificate Transparency logs (crt.sh) — for auditing your own attack surface. Note: depends on crt.sh, which has occasional downtime outside our control.

curl "https://presend.pages.dev/api/subdomains?domain=example.com"

GET /api/ai-crawler-check

Fetches robots.txt and reports which known AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot, etc.) are allowed or blocked. Free, no signup required.

curl "https://presend.pages.dev/api/ai-crawler-check?domain=example.com"

GET /api/ip-reputation

Checks an IPv4 or IPv6 address against a curated list of netblocks known to be hijacked or controlled by spam/cyber-crime operations. One specific list, not a full reputation score. The copy is refreshed at most once a day; the response includes the list date, attribution, and a stale flag if the upstream source has been unreachable long enough for the copy to be over 48 hours old. For a check on every request in your own middleware, loading the list locally is usually the better design.

curl "https://presend.pages.dev/api/ip-reputation?ip=1.2.3.4"

GET /api/dns-lookup

A, AAAA, CNAME, MX, TXT and NS records in one call via Cloudflare's DNS-over-HTTPS resolver, or a single type with type=.

curl "https://presend.pages.dev/api/dns-lookup?domain=example.com"

GET /api/whois-lookup

Registrar, creation and expiration dates, domain age and nameservers via RDAP, the HTTPS-based successor to legacy WHOIS.

curl "https://presend.pages.dev/api/whois-lookup?domain=example.com"

GET /api/redirect-trace

Follows a URL's full redirect chain (up to 15 hops) and records each hop's status code and destination, not just the final URL.

curl "https://presend.pages.dev/api/redirect-trace?url=http://github.com"

Supply-chain security

Dependency risk checks. typosquat-check and maintainer-change-check are heuristics: signals for triage, not verdicts.

GET /api/typosquat-check

Flags package names that are a near-miss of a curated list of well-known npm and PyPI packages (1 edit for 4-7 character names, 2 for 8+; names of 3 characters or fewer are not fuzzy-matched). PyPI names are normalized (PEP 503); reviewed legitimate look-alikes are marked known_legitimate.

curl "https://presend.pages.dev/api/typosquat-check?ecosystem=npm&package=lodahs"

POST /api/typosquat-check

Batch mode: up to 100 names in one request, counted as a single request for rate limiting. An invalid entry returns an error for that entry without failing the batch.

curl -X POST -H "Content-Type: application/json" -d '{"ecosystem":"npm","packages":["lodahs","expres","react"]}' https://presend.pages.dev/api/typosquat-check

GET /api/maintainer-change-check

npm and PyPI. On npm, flags a previously unseen human publisher taking over a package after 180+ days of inactivity, within the last 365 days: the pattern behind the event-stream compromise (2018). Handoffs to a publisher who already maintains another package with 100,000+ weekly downloads, and transitions to npm trusted publishing, are reported separately without raising the flag. It does not detect a hijacked existing maintainer account or a malicious release by the original maintainer, since the publisher identity does not change. On PyPI, it reports existence and age only: PyPI does not expose who published each release, so the publisher analysis returns maintainer_analysis: "npm_only". On both registries, first_published and package_age_days give the package age, and new_package is true for a package first published less than 30 days ago. On PyPI, the age is that of the oldest file still on PyPI: deleted releases make a project look younger. On npm, latest_deprecated is true when the latest version is marked deprecated by its maintainer (with latest_deprecation_message).

curl "https://presend.pages.dev/api/maintainer-change-check?ecosystem=npm&package=lodash"

POST /api/maintainer-change-check

Batch mode: up to 20 packages from one registry (npm or PyPI) in one request, counted as a single request for rate limiting. A missing package or registry failure is reported per entry without failing the batch.

curl -X POST -H "Content-Type: application/json" -d '{"ecosystem":"npm","packages":["lodash","express"]}' https://presend.pages.dev/api/maintainer-change-check

GET /api/vulnerability-check

Checks a package version against OSV.dev: npm, PyPI, Go, crates.io, Maven, RubyGems, Packagist, NuGet. To look up a CVE or GHSA identifier directly, use cve-lookup. Without a version, advisories affecting any version are counted (scope). For npm and PyPI, a name that does not exist returns found: false and vulnerable: null, never a clean result.

curl "https://presend.pages.dev/api/vulnerability-check?ecosystem=npm&package=lodash&version=4.17.15"

GET /api/repo-health-check

Stars, forks, open issues, license, archived status and days since last push for a GitHub repository, via the GitHub REST API.

curl "https://presend.pages.dev/api/repo-health-check?repo=lodash/lodash"

GET /api/supply-chain-check

Combines maintainer-change-check (publisher analysis, npm only), vulnerability-check, typosquat-check and repo-health-check (repository resolved from registry metadata when possible) into one call with an overall verdict. A version marked deprecated on npm, or yanked on PyPI, is flagged deprecated or yanked (with deprecation_message). A package first published less than 30 days ago is flagged new_package, and the verdict is then at least review_recommended. Vulnerabilities are checked for the optional version parameter, or else for the latest published version (version_checked, version_source).

curl "https://presend.pages.dev/api/supply-chain-check?ecosystem=npm&package=lodash"

Blockchain

Free tools for the Cosmos and EVM ecosystems. No signup, no API key.

GET /api/address-risk

Checks a crypto address against every OFAC Specially Designated Nationals (SDN) digital currency address list. EVM (0x...) and Bitcoin (bc1..., 1..., 3...) addresses are fully covered; addresses of other chains are flagged when listed. Cosmos SDK (bech32) addresses return sanctioned: null when not listed, since OFAC has published no entries for Cosmos SDK chains.

curl "https://presend.pages.dev/api/address-risk?address=0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"

GET /api/tx-decode

Decodes a raw, signed Cosmos SDK transaction (protobuf TxRaw bytes, base64) into readable JSON -- messages, fee, gas, signer info, signatures. No external dependency, decodes common bank/staking/gov/authz message types including nested MsgExec.

curl "https://presend.pages.dev/api/tx-decode?tx=CpwBCpEBChwvY29zbW9zLmJhbmsudjFiZXRhMS5Nc2dTZW5kEnEK..."

GET /api/rpc-check

Audits a public CometBFT RPC endpoint for a Cosmos SDK chain: node status, health, peer connectivity, and whether unsafe administrative methods (dial_seeds, dial_peers, unsafe_flush_mempool) appear to be exposed. Read-only -- never invokes any unsafe method itself.

curl "https://presend.pages.dev/api/rpc-check?url=https://cosmos-rpc.publicnode.com"

Utilities

Small, focused tools with no external dependency wherever possible.

GET /api/iban-validate

Validates an IBAN via the ISO 7064 mod-97 checksum, with country-specific length checks. Pure algorithm -- no external data source.

curl "https://presend.pages.dev/api/iban-validate?iban=DE89370400440532013000"

GET /api/vat-validate

Validates an EU VAT number in real time via the official European Commission VIES service -- returns the registered company name and address when valid.

curl "https://presend.pages.dev/api/vat-validate?country=IE&vat=6388047V"

GET /api/link-metadata

Extracts Open Graph, Twitter Card, and basic <head> metadata from a URL -- the same data used to render a link preview card in a chat app. Also returns the favicon and, after following redirects (each one checked), the final URL.

curl "https://presend.pages.dev/api/link-metadata?url=https://github.com/presendapp/presend-source"

GET /api/cve-lookup

Direct CVE/GHSA lookup by identifier via OSV.dev. Complements vulnerability-check (which needs package+ecosystem+version) for when you already have an identifier from a scanner report.

curl "https://presend.pages.dev/api/cve-lookup?id=CVE-2021-44228"

Chained workflows

These endpoints process files or text server-side in a single call. Processing is stateless: nothing is written to disk, nothing is logged, and the input is discarded as soon as the response is sent.

POST /api/merge-and-compress-pdf

Merges 2+ PDF files into one document, then compresses the result and strips metadata (title, author, producer) — in one request instead of two.

curl -X POST -F "files=@a.pdf" -F "files=@b.pdf" https://presend.pages.dev/api/merge-and-compress-pdf -o merged.pdf

POST /api/clean-image

Strips EXIF/GPS from JPEG and text metadata from PNG via direct binary parsing — pixel data is never re-encoded, so there's zero quality loss (unlike canvas-based approaches, which always recompress).

curl -X POST --data-binary @photo.jpg -H "Content-Type: image/jpeg" https://presend.pages.dev/api/clean-image -o clean.jpg

POST /api/image-similarity

Perceptual hash (dHash) for 1 or 2 JPEG/PNG images. Unlike a cryptographic hash, this survives re-compression and minor edits — send 2 images to compare them directly with a similarity score and verdict.

curl -X POST -F "files=@a.jpg" -F "files=@b.png" https://presend.pages.dev/api/image-similarity

POST /api/text-similarity

SimHash for 1 or 2 texts — the text equivalent of image-similarity. Detects paraphrased or lightly-edited near-duplicate content, unlike a cryptographic hash. Unrelated texts typically score ~50% by chance, not 0%.

curl -X POST -H "Content-Type: application/json" -d '{"texts":["text a","text b"]}' https://presend.pages.dev/api/text-similarity

Client-side tools (embed)

Most file-processing tools (EXIF removal, PDF compression, etc.) also run entirely in the browser as standalone widgets — nothing is uploaded. Use these instead of the API above when you want a drop-in UI rather than a server call. Embed them directly:

<iframe 
  src="https://presend.pages.dev/tools/exif-remover?embed=1" 
  width="100%" 
  height="600" 
  frameborder="0"
></iframe>

Available Tools

npm Package

A zero-dependency JS client wrapping every endpoint above.

npm install presend-api

const presend = require('presend-api');
const { uuids } = await presend.generateUuid(3);

View on npm

Embeddable Widget

Drop a working tool into your own site — no iframe, powered by our API directly. Supports: url-cleaner, uuid, color.

<div data-presend-tool="url-cleaner"></div>
<script src="https://presend.pages.dev/widget.js" async></script>

Add data-badge="false" to hide the "Powered by Presend" credit link.

OpenAPI Spec

Machine-readable spec for all server-side endpoints: openapi.json

RapidAPI

Also listed on RapidAPI, split by focus area if you only need one part of the catalog:

• Presend API -- the full catalog (Cybersecurity)
• Presend Blockchain & Crypto Compliance API -- OFAC checks, Cosmos SDK tx decoding, RPC auditing (Finance)
• Presend Email & Phone Verification API -- email and phone verification (Email)
• Presend Developer Tools API -- UUID, Base64, timestamp, IP geolocation, PDF/image tools (Tools)

Status

Live uptime, monitored independently from 4 regions (EU, US, Asia, Australia), checked every 3 minutes.

presend.betteruptime.com

Postman Collection

Ready-to-import collection covering all 48 endpoints, generated from the OpenAPI spec above.

Or download the raw file: postman_collection.json.

Open Source

All tools are open source. Contribute on GitHub or fork for your own projects. github.com/presendapp/presend-source