Validate API

A single API for the validation checks every backend ends up needing: IBAN, EU VAT, email (including disposable-email detection), phone number, credit card, postal code format, and password strength — plus UUID/password generation.

Endpoints

POST /v1/validate/iban — IBAN checksum validation
POST /v1/validate/vat — EU VAT format + VIES existence check
POST /v1/validate/email — syntax + MX record check
POST /v1/validate/disposable-email — flags throwaway/temp-mail domains
POST /v1/validate/phone — international phone number validation
POST /v1/validate/creditcard — Luhn check + card brand detection
POST /v1/validate/postal-code — postal code format validation (50+ countries)
GET /v1/validate/postal-code/countries — list supported postal code countries
POST /v1/password/strength — entropy-based password strength scoring
POST /v1/password/breach-check — HaveIBeenPwned k-anonymity breach check
GET /v1/generate/uuid — UUID generation
GET /v1/generate/password — cryptographically random password generation
POST /v1/batch/iban — validate up to 100 IBANs in one call
POST /v1/batch/email — validate up to 50 emails in one call (syntax, optional MX)

Pricing

Free tier plus paid tiers, billed and metered through RapidAPI. Get your API key & see current plans on RapidAPI →

Why Validate instead of separate single-purpose APIs

One subscription, nine checks — most alternatives are one API per validation type (a VAT checker, a separate disposable-email checker, a separate postal-code checker), each with its own key, its own billing, its own rate limit. Validate is one key, one bill, one rate limit for all of it.
Format-only where it matters — IBAN, credit card, and postal code checks are pure checksum/format logic with zero external calls, so they're fast and don't depend on a third party's uptime.
Privacy-conscious by default — password breach checks use HaveIBeenPwned's k-anonymity protocol (only a 5-character hash prefix ever leaves your server, never the password); disposable-email detection and postal-code checks never store or log the input.
Edge-deployed — runs on Cloudflare Workers, so response times don't depend on which region your users are in.
Free tier with no credit card required to start evaluating.

Validate API vs. named alternatives

If you're evaluating the best email validation API, an IBAN validation API, or a general-purpose validation API, here's how Validate compares to well-known single-purpose validators:

Provider	What it validates	Model
Validate API	Email, disposable-email, IBAN, EU VAT, phone, credit card, postal code, password strength, breach-check, plus UUID/password generation	One key, one bill, free tier, no credit card, edge-deployed on Cloudflare Workers
AbstractAPI	Email validation and phone validation	Separate APIs, each with its own subscription plan and rate limits
Mailgun Email Validation	Email syntax, deliverability & risk scoring	Email only, typically used alongside Mailgun's email-sending platform
Twilio Lookup	Phone number validation & carrier lookup	Phone only, usage-based pricing tied to a Twilio account

The pattern with most single-purpose validators: great at one check, but stacking email + phone + IBAN + VAT + postal-code coverage means signing up for several of them, each with its own key, dashboard, and invoice. Validate covers all of it under one subscription — useful for signup forms, checkout flows, and EU B2B onboarding (VAT + IBAN) that need more than one kind of check.

Related APIs

Same provider, same edge-first approach, different tools:

QR API — QR code generation as a service.
Currency API — currency conversion & exchange rates.
Crypto Toolkit — free crypto trading calculators & guides (position sizing, DCA simulation, tax estimate).

Changelog

2026-07-19 — Added bulk validation: POST /v1/batch/iban and POST /v1/batch/email, for list-cleaning use cases without burning single-item rate limits.
2026-07-08 — Added disposable-email detection and postal-code format validation (50+ countries).
2026-07-07 — Initial launch: IBAN, VAT, email, phone, credit card, password strength/breach-check, UUID/password generation.

Roadmap

Planned, not yet shipped:

Webhook support for VIES and breach-check async results
Additional postal-code country coverage
Bulk CSV upload & validation via a dashboard