Free VPN Detection APIs Compared: Limits, Inputs and Terms

Free VPN detection APIs come in two kinds: ones you send an IP address, and ones that check a live visit to your website. This page compares ten of them on four things: the free allowance, what you send, whether the response names the VPN service, and whether the free plan allows commercial use. Every other vendor’s figure was checked on its own pricing, documentation or terms page on 23 September 2026; Maskbreak’s row reflects its plans as of 30 September 2026.

Maskbreak publishes this page and is one of the ten, so read it as a vendor’s comparison. Every other row links to that vendor’s own page, and free allowances change, so confirm the current offer before you integrate. This is about APIs that detect VPN use, not services that provide a VPN connection; for residential and mobile proxies, see our proxy detection API comparison. If you already know you need a live-visit check, the VPN detection API page covers Maskbreak on its own.

Free VPN detection APIs compared

“Not in the documented response” means we did not find the field in the vendor’s public documentation, not that the vendor cannot tell you. The table says nothing about detection quality: none of these vendors, Maskbreak included, publishes an independent accuracy benchmark that we could cite, so test on your own traffic.

IP address or live visit: which input do you have?

The first question is not which vendor, but what you can send. On their free plans, nine of the ten services above take an IP address. That suits server logs, batch jobs, API-to-API traffic and anything without a browser. The answer comes from what the vendor knows about that address: VPN exit lists, proxy observations, hosting ranges and similar data.

Maskbreak works differently. A small script on your page collects a token during the visitor’s real visit, your server forwards that token to POST /v1/evaluate, and the response carries VPN and residential-proxy signals, the service name when known, and an allow, review or block decision. Optional device evidence adds browser-tampering and automation signals.

The honest limit: without a live visit, Maskbreak can do much less. Its bare-IP lookup (GET /v1/lookup/{ip}) checks Tor exits and cloud-server ranges only. It does not return a VPN or proxy verdict. If you only have addresses from logs and need VPN flags for them, one of the IP-based services above is the better fit. Many teams run both: an IP API for logs and back-office jobs, and a live-visit check on the signup, login or checkout form.

Notes on each free VPN detection API

Maskbreak

Free plan: 10,000 visitor checks a month, up to 1,000 an hour, no credit card; paid plans start at €29 a month (pricing). Bare IP lookups have their own allowance, ten times the plan’s visitor checks. A VPN on its own produces review, not block, under the default policy. Inspect a sample response without an account.

proxycheck.io

The pricing page lists a free plan of 1,000 daily queries and says it has the same features as the paid plans. The API documentation shows an operator object that names the VPN or proxy operator when it is known (and is null otherwise), which makes it the free IP-based option here that documents a service name. The terms allow one free account per customer. See the proxycheck.io alternatives page for a longer comparison.

IPHub

IPHub’s pricing page offers a free plan of 1,000 requests per day on the Basic tier, which covers open proxies, Tor exits, datacenter addresses and commercial VPNs. Its home page says residential proxy detection is on the commercial plans. The response carries a block value plus ISP and ASN.

FindIP

FindIP’s VPN detection page says the API has no daily or monthly caps and needs no credit card. Its terms say the service is currently free, reserve the right to add limits later, and ask you not to use the data as the sole basis for consequential decisions. That is good advice for any vendor in this table.

GetIPIntel

GetIPIntel returns a probability that an address is a proxy, VPN or bad IP rather than a yes/no flag. The documentation asks free users to stay under 500 queries a day and 15 a minute, and requires a contact email that is checked often. Its terms forbid reselling the results without consent and ask for credit when results are reused. Residential proxy detection is an optional flag. See GetIPIntel alternatives.

vpnapi.io

vpnapi.io documents separate security.vpn, security.proxy, security.tor and security.relay flags plus ASN details (API documentation). Free accounts get 1,000 requests a day (pricing). Its terms of use limit the free version to personal, non-commercial use; commercial use needs a paid plan. See vpnapi.io alternatives.

ipinfo

ipinfo’s free Lite plan (pricing) covers country-level location and ASN name. VPN, Tor, proxy and relay detection starts on the paid Core plan, and the Max plan adds residential proxy detection and service names. If you already use ipinfo for geolocation, VPN detection is an upgrade rather than a new vendor. See ipinfo alternatives, and for geolocation itself the IP geolocation comparison of ipinfo, MaxMind, IP2Location and three others.

ipgeolocation.io

The pricing page gives 1,000 credits a day on the free plan and marks security data (VPN, proxy and Tor) as not available on it. On paid plans, the IP Security API documents vpn_provider_names and proxy_provider_names fields, and the paid plans also list a client-side real-time VPN and proxy detection script.

IPQualityScore

The IPQS plans page lists a free plan of 1,000 lookups a month and 35 a day, shared with its email, phone and URL checks. The Proxy & VPN Detection API returns a fraud score with VPN, proxy and Tor flags from an IP address. See IPQS alternatives.

ip-api

The free JSON endpoint returns geolocation, a combined proxy/VPN/Tor flag and a hosting flag, over HTTP only, at up to 45 requests a minute per IP address (documentation). Its terms restrict free use to non-commercial purposes, so it suits hobby projects, not a business’s fraud checks.

Maskbreak: live check vs IP lookup

Read the IP lookup reference for its separate response shape. A false VPN flag from that endpoint does not prove an address is outside a VPN. To see the live check’s answer for your own connection, open the free VPN checker. For the full distinction, see proxy detection API vs IP lookup.

Set up a live VPN and proxy check

Create a free account, copy your live key from the dashboard, and store it as MASKBREAK_API_KEY in your server’s environment. The browser loads the collector without a secret. Keep the live API key out of HTML, browser JavaScript and public source repositories.

1. Collect evidence in the visitor’s browser

Add this script to the page containing your existing signup form:

<script defer src="https://maskbreak.com/assets/sentinel.js"></script>

After the SDK loads, collect evidence in your form’s submit handler and include these fields with the form data you already send to your own backend:

// Inside your existing async submit handler, after event.preventDefault().
const { token, fingerprintEventId, tz } = await window.Sentinel.collect();
const response = await fetch('/your-signup-endpoint', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    ...formData, // your existing signup fields
    token, fingerprintEventId, tz
  })
});
// Handle response.status in your existing signup UI.

The network token is required for the live VPN/proxy assessment. fingerprintEventId adds device evidence when available. Handle collector errors in your form UI; missing evidence must not silently authorize the signup.

2. Evaluate on your server before completing the action

This Node 22 / Express example plugs into an existing application. app, express and existingSignupHandler belong to your app. Keep its normal validation, authentication, rate limiting and abuse controls.

app.use(express.json({ limit: '16kb' }));
app.post('/your-signup-endpoint', async (req, res, next) => {
  try {
    const { token, fingerprintEventId, tz } = req.body;
    const response = await fetch('https://maskbreak.com/v1/evaluate', {
      method: 'POST',
      signal: AbortSignal.timeout(2000), // example budget; measure yours
      headers: {
        'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ token, fingerprintEventId, tz })
    });
    if (!response.ok) {
      const refusal = await response.json().catch(() => null);
      // The month's checks are used up: continue unchecked until the 1st
      // (00:00 UTC), logged. Every other error holds the signup.
      if (response.status === 429 && refusal?.code === 'monthly_quota_exceeded') {
        console.warn('[maskbreak] monthly_quota_exceeded: continuing unchecked');
        return next();
      }
      throw new Error('Visitor check unavailable');
    }
    const result = await response.json();
    if (result.test || result.sandbox || result.sample) {
      throw new Error('Synthetic result in production');
    }
    if (!['allow', 'review', 'block'].includes(result.decision)) {
      throw new Error('Unexpected verdict');
    }
    if (result.decision === 'block') {
      return res.status(403).json({ error: 'Action refused by policy' });
    }
    if (result.decision === 'review' || result.degraded) {
      // Your app must complete a real step-up or manual review here.
      return res.status(409).json({ next: 'step_up' });
    }
    req.fraudCheck = result;
    return next(); // continue normal signup validation
  } catch {
    // Example temporary hold; choose a fallback for your business action.
    return res.status(503).json({ error: 'Check unavailable; try again shortly' });
  }
}, existingSignupHandler);

The example holds a signup when the check fails, except when the month’s checks are used up (HTTP 429 with the code monthly_quota_exceeded): then it lets the signup through unchecked and logs it until the 1st, so running out never takes your signup form offline. A 409 response only requests your application’s review flow; it does not implement a challenge. If your action needs a different timeout or fallback, define it explicitly. The integration guide and timeout guide cover the rest, and JavaScript VPN detection explains what the browser side can and cannot see.

How to use VPN detection without rejecting every VPN user

A VPN signal describes a connection, not a person’s intent. Under Maskbreak’s default evaluation policy, a VPN alone produces review, not block. Customer rules and exceptions can change the final decision. Read decision and reasons; do not turn isSuspicious or network.vpn into an automatic rejection. The same applies to any vendor’s VPN flag in the table above.

For explanations, use network.vpn, network.proxy and network.tor. network.service names the VPN or proxy service when known and can be null. If degraded: true is present, false network flags mean evidence was unavailable. Optional device fields may also be absent. See the response reference and how to avoid rejecting legitimate VPN users.

What to test before relying on a free tier

• Response handling: use test_clean, test_vpn, test_proxy and test_tor with the public sandbox key in a separate test environment. Fixtures check your code paths; they do not measure detection coverage.
• Controlled live visits: compare a direct connection, your own VPN and an authorized residential proxy (our mobile proxy test is one such visit). Record which evidence was available and whether the resulting action fits your policy. Run the same visits through any IP-based API you are considering.
• Missing evidence: test a blocked collector, a missing token, a timeout and an unavailable device layer. None should become a successful check by accident.
• Quota handling: free plans count differently (per hour, per day, per month, per minute). Test 429 responses, respect Retry-After, and size for your busiest hour and your monthly total, not your average day.

Use the sandbox documentation and VPN API test cases to make these checks repeatable. Before you commit beyond a free tier, work through our VPN detection API evaluation guide.

Which free VPN detection API should you choose?

• You only have IP addresses and run a business: start with proxycheck.io, IPHub or FindIP, and read each one’s terms for your use. GetIPIntel fits low volumes if you can credit it.
• You want the VPN’s name from an IP, on a free plan: proxycheck.io documents an operator field on every plan. ipinfo and ipgeolocation.io name services on paid plans.
• It is a personal, non-commercial project: vpnapi.io and ip-api license their free tiers for exactly that.
• You already pay for geolocation: check whether your current vendor’s next plan adds VPN detection before adding another one.
• You protect a signup, login or checkout in a browser: a live-visit check sees the visit itself and returns a decision. That is what Maskbreak is built for.

Start on the Free plan: 10,000 visitor checks a month, with no card. Or inspect the response first. Review the plans and their limits before choosing.