PhylaxNet API

Security tools. One key.

29 APIs built and run by PhylaxNet: DNS, SSL, website headers, firewall detection, email spoofing checks, file forensics, generators and more. Clean JSON, every time.

Quick start

1

Get a key

Buy a 1 month or 1 year key. It appears on your dashboard under API keys.

2

Call any API

Add your key as ?key= or send it in the X-API-Key header (safer: it stays out of logs).

3

Read the JSON

Every answer has ok, the result (or an error), and your usage. Add &pretty=1 to make it easy to read.

Request
curl -H "X-API-Key: XXXXX-XXXXX-XXXXX-XXXXX" \
  "https://phylaxnet.com/?tool=dnsresolver&host=example.com"
Response
{
    "ok": true,
    "api": "dnsresolver",
    "result": {
        "host": "example.com",
        "ip": "93.184.215.14",
        "ipv4": [
            "93.184.215.14"
        ],
        "ipv6": [
            "2606:2800:21f:cb07:6820:80da:af6b:8b2c"
        ]
    },
    "usage": {
        "used_this_month": 1204,
        "monthly_limit": 150000,
        "remaining": 148796,
        "resets_at": "2026-11-01T00:00:00Z",
        "key_expires_at": "2027-10-26T00:00:00Z"
    },
    "ms": 38
}
Errors and limits

Failed calls return {"ok": false, "error": "…"} with an HTTP status: 400 bad or missing parameter · 401 missing or wrong key · 402 key expired · 403 blocked by your key's IP or User-Agent rules, or a private address · 404 unknown API · 429 monthly limit or too many requests · 502/504 the site you asked about didn't answer.

Each key has 150,000 requests per calendar month. Tools that contact other servers only ever reach public websites on ports 80 and 443. Keep your key secret: use it from your server, not in web pages people can see.

Forensics APIs take a file instead: upload it with -F "file=@name" (up to 20 MB), send it as base64 in a POST body, or pass a public url (up to 20 MB). Files are read in memory and never stored. Extra statuses: 413 file too large · 422 not the right kind of file, or damaged · 501 not available on this server.

All APIs (29)

API
Endpoint
Docs

Host to IP

Gets the IPv4 and IPv6 addresses a host name points to.

GET/?tool=dnsresolver
key=<key>host=example.com

IP to Host

Reverse DNS: finds the host name an IP address belongs to.

GET/?tool=gethostname
key=<key>host=1.1.1.1

Advanced DNS Checker

Looks up DNS records for a domain: A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV or all of them.

GET/?tool=dnschecker
key=<key>domain=example.com

IP Validator

Checks whether a string is a valid IPv4 or IPv6 address and what kind it is (public, private, loopback…).

GET/?tool=ipvalidator
key=<key>ip=8.8.8.8

Subnet Calculator

Works out the network, broadcast, netmask, host range and size of a subnet (IPv4 and IPv6).

GET/?tool=subnetcalculator
key=<key>cidr=192.168.1.0/24

What Is My IP

Returns the IP address, reverse host name and User-Agent your request came from.

GET/?tool=myip
key=<key>

Website Up or Down

Checks whether a website is online, with its status code and response time.

GET/?tool=upordown
key=<key>host=example.com

Website Headers

Fetches the HTTP response headers a website sends back.

GET/?tool=getheaders
key=<key>host=example.com

Firewall (WAF) Detector

Detects whether a website sits behind a known web application firewall or protective CDN (Cloudflare, Sucuri, Akamai, Imperva and more).

GET/?tool=firewalldetector
key=<key>url=sucuri.net

SSL Certificate Checker

Inspects a site’s TLS certificate: who issued it, when it expires, whether it is trusted and matches the name.

GET/?tool=sslchecker
key=<key>host=example.com

Security Headers Grade

Grades a website A+ to F on the protective HTTP headers it sends (HSTS, CSP, frame and sniffing protection…).

GET/?tool=securityheaders
key=<key>url=example.com

Email Validator

Checks an email address’s format and that its domain is set up to receive mail; flags disposable, role and typo addresses.

GET/?tool=emailvalidator
key=<key>email=someone@outlook.com

Disposable Mail Check

Tells you whether an email address or domain belongs to a throwaway (temporary) email service.

GET/?tool=disposablemailchecker
key=<key>email=someone@yopmail.com

Email Spoofing Check

Grades a domain’s protection against fake email in its name: SPF, DMARC, DKIM, MTA-STS, TLS-RPT and BIMI.

GET/?tool=emailsecurity
key=<key>domain=example.com

Password Generator

Generates strong random passwords with your own rules.

GET/?tool=passwordgenerator
key=<key>length=16include=numbers,letters,chars

Random Number

Cryptographically secure random numbers: a number of a given length, or between two values.

GET/?tool=randomnumber
key=<key>length=10

License Key Generator

Generates license keys from a template: ? = letter or number, # = number (write it as %23 in a URL), @ = letter.

GET/?tool=licensekeygenerator
key=<key>template=?????-?????-?????-?????amount=1

UUID Generator

Generates random version-4 UUIDs.

GET/?tool=uuid
key=<key>

QR Code Generator

Turns text or a link into a QR code (SVG). Add &output=svg to get the image itself.

GET/?tool=qrgenerator
key=<key>string=Hello Worldsize=150

Password Strength

Scores a password 0–4 and estimates how long it would take to crack. Send it in a POST body so it never sits in a URL.

GET/?tool=passwordstrength
key=<key>password=Summer2024!

Hash Generator

Hashes text with MD5, SHA-1, SHA-2, SHA-3, CRC32 and more.

GET/?tool=hash
key=<key>text=hello

Base64 Encode / Decode

Encodes text to Base64 or decodes it back (standard or URL-safe).

GET/?tool=base64
key=<key>text=Hello Worldaction=encode

JWT Decoder

Decodes a JSON Web Token’s header and payload and tells you if it has expired (the signature is not checked).

GET/?tool=jwtdecode
key=<key>token=eyJhbGciOi…

File Type Detector

Finds out what a file really is from its contents (90+ formats) and flags files whose extension lies, like a program renamed to .pdf.

POST/?tool=filetype
key=<key>file=@invoice.pdf

File Entropy

Measures how random a file’s bytes are (0–8 bits per byte) and flags content that looks encrypted, with an optional block-by-block profile.

POST/?tool=entropy
key=<key>file=@secret.bin

File Hash

MD5, SHA-1, SHA-256, SHA-512, SHA3-256 and CRC32 of a file in one call, and checks it against a hash you expect.

POST/?tool=filehash
key=<key>file=@setup.exe

Browser History Reader

Reads a Chrome, Edge, Brave, Opera, Firefox or Safari history database: visits, downloads, searches or bookmarks, newest first.

POST/?tool=browserhistory
key=<key>file=@History

Registry Hive Reader

Reads a Windows registry hive file (NTUSER.DAT, SOFTWARE, SYSTEM…): keys, values and last-written times, and recovers deleted keys and values.

POST/?tool=registry
key=<key>file=@NTUSER.DAT

Event Log Reader

Reads a Windows event log (.evtx) into JSON: event IDs, times, users, computers and event data, with filters by event ID and source.

POST/?tool=evtx
key=<key>file=@Security.evtx
Need an API we don't have yet? Tell us what you'd use it for: support@phylaxnet.com. Key holders get beta access to new APIs first.