Free privacy & security API

What the API does

The API gives you programmatic access to five of PrivacyTestLab's diagnostic tools, so you can run the same checks the free browser tools do, but from your own code instead of a browser tab:

• IP geolocation — country, region, city, ISP, and organization for any public IP address.
• DNS lookup — A, AAAA, MX, TXT, NS, CNAME, and SOA records for any domain.
• WHOIS / RDAP — registrar, nameservers, status, and registration dates for a domain.
• Phishing check — blocklists, domain age, brand spoofing, homograph, and TLS signals for a URL.
• Proxy / VPN detection — ASN type, DNSBL blacklists, reverse DNS, and Tor exit-node membership for an IP.

How to get access

Getting a working key takes three steps.

First, create an account — with an email and password, or by continuing with Google or GitHub. An email/password account needs a quick email verification before it can generate a key; signing in with Google or GitHub skips that step, since the provider has already verified your address for us.

Second, once you're signed in, generate a key from your dashboard. It's shown to you once — copy it somewhere safe, since we only ever store a one-way hash of it and can't show it to you again after that.

Third, send that key as an X-Api-Key header on any GET request to one of the endpoints below, and you're making live calls.

Authentication

X-Api-Key is the simpler, always-reliable option — some hosts strip the Authorization header before it reaches PHP, so use it if a Bearer request unexpectedly fails.

# header option 1
curl -H "X-Api-Key: ptl_live_your_key_here" \
  "https://privacytestlab.com/api/v1/ip-geolocation"

# header option 2
curl -H "Authorization: Bearer ptl_live_your_key_here" \
  "https://privacytestlab.com/api/v1/ip-geolocation"

We don't support ?api_key= query params — query strings end up in server access logs, browser history, and proxy logs, exactly the kind of exposure a privacy-focused API shouldn't create.

Endpoint reference

Every endpoint below is a read-only GET request and returns the same JSON envelope, whether it succeeds or fails.

{
  "success": true,
  "data": {
    "ip": "8.8.8.8",
    "country": "United States",
    "city": "Mountain View",
    "isp": "Google LLC",
    "as": "AS15169 Google LLC"
  }
}

{
  "success": true,
  "data": {
    "domain": "example.com",
    "type": "MX",
    "records": [
      { "host": "example.com", "target": "mail.example.com" }
    ]
  }
}

{
  "success": true,
  "data": {
    "registrar": "Example Registrar, Inc.",
    "status": ["client transfer prohibited"],
    "nameservers": ["a.iana-servers.net"]
  }
}

{
  "success": true,
  "data": {
    "signals": {
      "blocklist": { "status": "clean" },
      "domain_age": { "status": "clean" }
    }
  }
}

{
  "success": true,
  "data": {
    "geo": { "country_name": "Germany" },
    "signals": {
      "tor": { "detected": true }
    }
  }
}

What's intentionally left out

The IP, DNS, WebRTC, and IPv6 leak tests measure the browser making the request — they run entirely in JavaScript against your own connection. A server-side version of "check my leak" would only ever report the PrivacyTestLab server's own connection, which would be misleading, so those stay browser-only tools. Password generation and strength checking are also excluded: sending a real password over any network, even to a privacy tool, is a step backward for the exact users this site serves.

Errors & rate limits

Every error response follows the same shape:

{ "success": false, "error": { "code": "invalid_key", "message": "..." } }

Error codes

Rate-limit headers

Every successful response also carries these headers:

Pricing

The API is free: 100 requests a day, per account, no credit card, no trial period, no expiration date. Need a higher limit for a production use case? Get in touch.

FAQ