Validate API

A single API for the validation checks every backend ends up needing: IBAN, EU VAT, email (including disposable-email detection), phone number, credit card, postal code format, and password strength — plus UUID/password generation.

Endpoints

• POST /v1/validate/iban — IBAN checksum validation
• POST /v1/validate/vat — EU VAT format + VIES existence check
• POST /v1/validate/email — syntax + MX record check
• POST /v1/validate/disposable-email — flags throwaway/temp-mail domains
• POST /v1/validate/phone — international phone number validation
• POST /v1/validate/creditcard — Luhn check + card brand detection
• POST /v1/validate/postal-code — postal code format validation (50+ countries)
• GET /v1/validate/postal-code/countries — list supported postal code countries
• POST /v1/password/strength — entropy-based password strength scoring
• POST /v1/password/breach-check — HaveIBeenPwned k-anonymity breach check
• GET /v1/generate/uuid — UUID generation
• GET /v1/generate/password — cryptographically random password generation

Pricing

Free tier plus paid tiers, billed and metered through RapidAPI. Get your API key & see current plans on RapidAPI →

Why Validate instead of separate single-purpose APIs

• One subscription, nine checks — most alternatives are one API per validation type (a VAT checker, a separate disposable-email checker, a separate postal-code checker), each with its own key, its own billing, its own rate limit. Validate is one key, one bill, one rate limit for all of it.
• Format-only where it matters — IBAN, credit card, and postal code checks are pure checksum/format logic with zero external calls, so they're fast and don't depend on a third party's uptime.
• Privacy-conscious by default — password breach checks use HaveIBeenPwned's k-anonymity protocol (only a 5-character hash prefix ever leaves your server, never the password); disposable-email detection and postal-code checks never store or log the input.
• Edge-deployed — runs on Cloudflare Workers, so response times don't depend on which region your users are in.
• Free tier with no credit card required to start evaluating.

Changelog

• 2026-07-08 — Added disposable-email detection and postal-code format validation (50+ countries).
• 2026-07-07 — Initial launch: IBAN, VAT, email, phone, credit card, password strength/breach-check, UUID/password generation.

Get updates