QuickToolz API

A free HTTP API over the same helpers the tool pages use — for scripts, CI steps, and docs examples. No key, CORS-open, 60 requests per minute per IP. Plain text by default; add ?format=json for JSON.

curl https://quicktoolz.dev/api/uuid
curl "https://quicktoolz.dev/api/password?len=24&symbols=1"
curl "https://quicktoolz.dev/api/hash?text=hello&algo=sha256"

GET /api/uuid?n=1

One or more RFC 4122 version-4 UUIDs, newline-separated.

https://quicktoolz.dev/api/uuid?n=3

GET /api/password?len=16&upper=1&lower=1&digits=1&symbols=0&noambig=0

A cryptographically-random password. len 4–256. Each character class is a 0/1 flag; noambig drops look-alikes (0/O/1/l).

https://quicktoolz.dev/api/password?len=20&symbols=1

GET /api/hash?text=hello&algo=sha256

Hex digest of text. algo: md5, sha1, sha256, sha384, sha512. text up to 100 KB.

https://quicktoolz.dev/api/hash?text=hello&algo=sha256

GET /api/base64?text=hello&op=encode

Base64 encode or decode (op=encode|decode), UTF-8 safe.

https://quicktoolz.dev/api/base64?text=hello%20world

GET /api/lorem?paragraphs=3 | ?sentences=5 | ?words=40

Placeholder text. Pass exactly one of paragraphs / sentences / words. classic=0 drops the fixed opening.

https://quicktoolz.dev/api/lorem?paragraphs=2

Response shape

Default is text/plain. With ?format=json you get:

{ "ok": true, "kind": "uuid", "result": "…" }

Errors are JSON regardless of format, with a matching status code (400 bad input, 404 unknown endpoint,405 wrong method, 429 rate-limited):

{ "ok": false, "error": "Missing ?text=" }

Limits & fair use

60 requests per minute per IP. text inputs are capped at 100 KB. This is a convenience endpoint, not an SLA — for anything load-bearing, lift the logic (it is a few pure functions) into your own code. The individual tools —UUID, password,hash, Base64,lorem ipsum — do the same work in your browser with a UI.

Frequently asked questions

Is it really free? Do I need a key?
Free, no key, no sign-up. It is rate-limited to 60 requests per minute per IP — plenty for scripts and docs examples, not enough to build a product on. If you need more, run the same open-source logic yourself.
What formats does it return?
Plain text by default, so `curl` output is clean. Append `?format=json` to any endpoint to get `{ "ok": true, "kind": "...", "result": "..." }` instead. Errors are always JSON with `ok: false` and an `error` string, plus the right HTTP status.
Can I call it from a browser?
Yes. `Access-Control-Allow-Origin` is `*`, so fetch() from any page works. Responses are sent with `Cache-Control: no-store` because most of them are random.
Is anything logged?
Cloudflare's standard edge request metadata only. The tool inputs you pass in the query string are processed in the edge Worker and not stored. Still — do not send secrets you care about through any third-party URL.
Why does /api/hash offer MD5 if MD5 is broken?
Only for reproducing legacy checksums. Never use it where collision resistance matters — use sha256 or better.