Free MockFox API

Updated October 19, 2026Free mock REST & WebSocket APIs

Small, sharp utilities over HTTP: UUID v4/v7, passwords and passphrases with exact entropy, unbiased random numbers, MD5/SHA/HMAC hashes, LLM token counts and API cost estimates. Every endpoint returns JSON with open CORS and needs no key — handy for scripts, CI, seed data and quick prototypes. The always-on fake REST API, hosted mocks, webhook capture and status-code endpoints are documented further down.

Try it

Endpoint

Request

GET https://mockfox.dev/api/v1/uuid?version=4&count=3

Response

Edit the parameters and press “Send request” to call the live API.

Quick start

Pick an endpoint below. Every endpoint lives under https://mockfox.dev/api/v1/.
Send a GET with query parameters, or a POST with a JSON body (Content-Type: application/json) — same parameters, same response.
Read the result from data. Show meta.attribution with a link to meta.source where people see the numbers.

Endpoints

Endpoint	What it returns
`/api/v1/uuid`	Generate UUIDs (v4 random or v7 time-ordered)
`/api/v1/password`	Generate strong passwords or passphrases with exact entropy
`/api/v1/random`	Random numbers in a range (integers or decimals, unique, sorted)
`/api/v1/hash`	Hash text with MD5, SHA-1, SHA-256, SHA-384 or SHA-512 (and HMAC)
`/api/v1/tokens`	Count LLM tokens (exact for OpenAI, estimated for Claude, Gemini, Llama…)
`/api/v1/llm-cost`	LLM API cost per request, day and month — one model or ranked across all
`GET /api/fake/{resource}`	Fake REST API (JSONPlaceholder-style)
`POST /api/mock`	Create a hosted mock API
`GET /api/m/{id}/{path}`	Call a hosted mock
`POST /api/bins`	Create a webhook capture URL
`POST /api/hook/{id}`	Send a webhook to a capture URL
`GET /api/status/{code}`	Return any HTTP status code
`GET /api/ws/echo`	WebSocket echo server

`GET /api/v1/uuid`

RFC 9562 UUIDs from a cryptographically secure RNG. v7 UUIDs sort by creation time (good primary keys); a batch is strictly increasing. See the calculator →

Parameters

Name	Type	Default	Description
`version`	4 \| 7	`4`	UUID version: 4 (random) or 7 (Unix-time ordered)
`count`	integer (1–1000)	`1`	How many to generate (1–1000)
`upper`	boolean	`false`	Uppercase hex
`dashes`	boolean	`true`	Include dashes
`braces`	boolean	`false`	Wrap in {braces}

Example request

curl "https://mockfox.dev/api/v1/uuid?version=4&count=3"

Example response

Sample output — every call returns fresh random values.

{
  "data": {
    "version": 4,
    "uuids": [
      "3f2b8c1e-9a4d-4e7b-8f21-6c0d5a9e7b43",
      "a91c0e57-2b6f-4d88-9c3a-15e7f4b20d69",
      "0d6e4f8a-7c21-4b95-a3e0-9f1b2c7d8e54"
    ]
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/uuid-generator",
    "attribution": "Powered by MockFox — https://mockfox.dev/uuid-generator"
  }
}

`GET /api/v1/password`

Uniform, unbiased passwords from a CSPRNG (optionally guaranteeing one character from every selected set) or diceware-style passphrases. Returns the exact entropy in bits and a strength label. Generated on request and never stored or logged. See the calculator →

Parameters

Name	Type	Default	Description
`type`	password \| passphrase	`password`
`length`	integer (4–256)	`20`	Password length (type=password)
`count`	integer (1–100)	`1`	How many to generate (1–100)
`lower`	boolean	`true`	Include a–z
`upper`	boolean	`true`	Include A–Z
`digits`	boolean	`true`	Include 0–9
`symbols`	boolean	`true`	Include symbols !@#$%^&*()-_=+[]{};:,.<>?/~
`exclude_ambiguous`	boolean	`false`	Leave out look-alike characters (I l 1 O 0 …)
`words`	integer (3–20)	`5`	Words per passphrase (type=passphrase)
`separator`	string	`-`	Passphrase word separator
`capitalize`	boolean	`false`	Capitalize passphrase words

Example request

curl "https://mockfox.dev/api/v1/password?length=20&count=2"

Example response

Sample output — every call returns fresh random values.

{
  "data": {
    "type": "password",
    "passwords": [
      "q7#Vt2mK!xR9pL@4wN8z",
      "Hc3$e9Yb!T6uQ2&jW5rd"
    ],
    "entropy_bits": 130.6,
    "strength": "Very strong"
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/password-generator",
    "attribution": "Powered by MockFox — https://mockfox.dev/password-generator"
  }
}

`GET /api/v1/random`

Unbiased random numbers between min and max (inclusive) from a CSPRNG — integers or a fixed number of decimals, optionally unique and sorted. See the calculator →

Parameters

Name	Type	Default	Description
`min`	number	`1`	Minimum (inclusive)
`max`	number	`100`	Maximum (inclusive)
`count`	integer (1–1000)	`1`	How many numbers (1–1000)
`decimals`	integer (0–10)	`0`	Decimal places (0 = integers)
`unique`	boolean	`false`	No repeats
`sort`	none \| asc \| desc	`none`

Example request

curl "https://mockfox.dev/api/v1/random?min=1&max=100&count=5"

Example response

Sample output — every call returns fresh random values.

{
  "data": {
    "min": 1,
    "max": 100,
    "values": [
      42,
      7,
      93,
      "… 2 more"
    ]
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/random-number-generator",
    "attribution": "Powered by MockFox — https://mockfox.dev/random-number-generator"
  }
}

`GET /api/v1/hash`

Digest of a UTF-8 string, as hex or Base64. Pass `hmac_key` for an HMAC (SHA algorithms only). Send secrets with POST — query strings end up in logs; responses with a key are never cached. See the calculator →

Parameters

Name	Type	Default	Description
`text` required	string	—	Text to hash (UTF-8)
`algorithm`	md5 \| sha1 \| sha256 \| sha384 \| sha512	`sha256`
`encoding`	hex \| base64	`hex`	Output encoding
`hmac_key`	string	—	HMAC secret key (SHA algorithms only)

Example request

curl "https://mockfox.dev/api/v1/hash?text=hello+world&algorithm=sha256"

Example response

Computed by the same engine as the API when this page was built.

{
  "data": {
    "algorithm": "sha256",
    "hmac": false,
    "encoding": "hex",
    "digest": "b94d27b9934d3e08a52e52d7da7dabfac484efe37a5380ee9088f7ace2efcde9",
    "bytes": 11
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/hash-generator",
    "attribution": "Powered by MockFox — https://mockfox.dev/hash-generator"
  }
}

`GET /api/v1/tokens`

Exact token counts with the OpenAI o200k_base (GPT-4o, GPT-4.1, o-series, GPT-5) and cl100k_base (GPT-4, GPT-3.5) encodings, plus estimates for Claude, Gemini, Llama, Mistral, DeepSeek and Grok. Pass `model` (an id from /api/v1/llm-cost) to get that model's count. Use POST for long text. See the calculator →

Parameters

Name	Type	Default	Description
`text` required	string	—	Text to tokenize
`model`	string	—	Model id (e.g. gpt-5, claude-opus-5-5); see /api/v1/llm-cost
`messages`	integer (0–1000)	`0`	Chat messages the text is split into (adds OpenAI chat framing tokens)

Example request

curl -X POST https://mockfox.dev/api/v1/tokens \
  -H 'Content-Type: application/json' \
  -d '{"text":"MockFox counts tokens for every major LLM.","model":"gpt-5"}'

Example response

Computed by the same engine as the API when this page was built.

{
  "data": {
    "characters": 42,
    "words": 7,
    "chat_overhead_tokens": 0,
    "model": {
      "id": "gpt-5",
      "name": "GPT-5",
      "tokenizer": "o200k_base",
      "tokens": 10,
      "exact": true,
      "context_window": 400000
    },
    "by_tokenizer": {
      "o200k_base": {
        "tokens": 10,
        "exact": true
      },
      "cl100k_base": {
        "tokens": 10,
        "exact": true
      },
      "claude": {
        "tokens": 15,
        "exact": false
      },
      "claude-legacy": {
        "tokens": 12,
        "exact": false
      },
      "gemini": {
        "tokens": 11,
        "exact": false
      },
      "llama": {
        "tokens": 11,
        "exact": false
      },
      "mistral": {
        "tokens": 11,
        "exact": false
      },
      "deepseek": {
        "tokens": 11,
        "exact": false
      },
      "grok": {
        "tokens": 11,
        "exact": false
      }
    }
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/token-counter",
    "attribution": "Powered by MockFox — https://mockfox.dev/token-counter"
  }
}

`GET /api/v1/llm-cost`

Price a workload (input/output tokens per request, requests per day, prompt-cache hit rate, Batch API share) with current list prices (retrieved 2026-10-18), including long-context tiers. Omit `model` to rank every model from cheapest. See the calculator →

Parameters

Name	Type	Default	Description
`model`	string	—	Model id; omit to compare all models
`input_tokens` required	integer (0–10000000)	—	Input (prompt) tokens per request
`output_tokens`	integer (0–10000000)	`0`	Output tokens per request
`requests_per_day`	number (0–1000000000)	`1`
`cache_hit_rate`	number (0–1)	`0`	Share of input tokens read from the prompt cache (0–1)
`batch_share`	number (0–1)	`0`	Share of requests sent via a Batch API (0–1)
`limit`	integer (1–200)	`10`	Models to return when comparing

Example request

curl "https://mockfox.dev/api/v1/llm-cost?model=claude-opus-5-5&input_tokens=2000&output_tokens=500&requests_per_day=1000"

Example response

Computed by the same engine as the API when this page was built.

{
  "data": {
    "prices_retrieved": "2026-10-18",
    "currency": "USD",
    "id": "claude-opus-5-5",
    "name": "Claude Opus 5.5",
    "provider": "anthropic",
    "price_per_million": {
      "input": 4,
      "cached_input": 0.2,
      "output": 20
    },
    "context_window": 1000000,
    "cost": {
      "per_request": 0.018,
      "per_day": 18,
      "per_month": 540
    },
    "long_context_pricing": false,
    "fits": true
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/llm-pricing-calculator",
    "attribution": "Powered by MockFox — https://mockfox.dev/llm-pricing-calculator"
  }
}

Hosted services

These older endpoints keep their own response format (no data/meta envelope).

`GET /api/fake/{resource}`

Fake REST API (JSONPlaceholder-style). Always-on fake data: users, posts, comments, todos, albums, photos, products, orders. Supports /{resource}/{id}, nested routes (/users/1/posts), ?_limit, ?_page, ?_sort, ?_order and field filters. POST/PUT/PATCH/DELETE are simulated (nothing is stored). X-Total-Count header on lists. More →

Name	In	Type	Description
`resource` required	path	string	One of users, posts, comments, todos, albums, photos, products, orders
`_limit`	query	integer	Max items
`_page`	query	integer	Page number (with _limit)

Example request

curl https://mockfox.dev/api/fake/posts?_limit=2

Example response

[
  {
    "userId": 1,
    "id": 1,
    "title": "…",
    "body": "…"
  }
]

`POST /api/mock`

Create a hosted mock API. Body: a mock spec (resources and/or custom routes). Returns the mock's base URL, a WebSocket URL and an editKey — send it as `Authorization: Bearer <editKey>` to PUT/DELETE /api/mock/{id}. 30 mocks per hour per network. More →

Name	In	Type	Description
`spec` required	body	object	Mock spec JSON (see the mock API page)

Example request

curl -X POST https://mockfox.dev/api/mock -H 'Content-Type: application/json' -d '{"name":"Shop","resources":[{"name":"products","items":[{"id":1,"name":"Mug"}]}]}'

Example response

{
  "id": "k3x9…",
  "url": "https://mockfox.dev/api/m/k3x9…",
  "ws": "wss://mockfox.dev/api/ws/m/k3x9…",
  "editKey": "…",
  "expiresAt": "…"
}

`GET /api/m/{id}/{path}`

Call a hosted mock. Any method and path defined in the mock's spec. CORS is open and responses are never cached. More →

Name	In	Type	Description
`id` required	path	string	Mock id from POST /api/mock
`path` required	path	string	Route defined in the spec, e.g. products/1

Example request

curl https://mockfox.dev/api/m/<id>/products

Example response

[
  {
    "id": 1,
    "name": "Mug"
  }
]

`POST /api/bins`

Create a webhook capture URL. Returns a URL (/api/hook/{id}) that records every request sent to it. Poll GET /api/bins/{id} (?after=<ISO time>) to read captured requests. More →

Example request

curl -X POST https://mockfox.dev/api/bins

Example response

{
  "id": "h7q2…",
  "url": "https://mockfox.dev/api/hook/h7q2…",
  "expiresAt": "…"
}

`POST /api/hook/{id}`

Send a webhook to a capture URL. Any method, any sub-path, any body. Answers 200 `{ ok: true }` (or the custom response configured on the page). 1,000 requests per hour per URL. More →

Name	In	Type	Description
`id` required	path	string	Capture id from POST /api/bins

Example request

curl -X POST https://mockfox.dev/api/hook/<id> -H 'Content-Type: application/json' -d '{"event":"ping"}'

Example response

{
  "ok": true,
  "received": true
}

`GET /api/status/{code}`

Return any HTTP status code. Responds with the given status (200–599) and the headers a real server sends with it (Retry-After, Allow, WWW-Authenticate…). ?delay=ms (≤ 10 s) adds latency; ?location= sets Location on 3xx/201. More →

Name	In	Type	Description
`code` required	path	integer	Status code 200–599
`delay`	query	integer	Delay in ms (max 10000)

Example request

curl -i https://mockfox.dev/api/status/429

Example response

{
  "status": 429,
  "name": "Too Many Requests",
  "description": "…",
  "reference": "https://mockfox.dev/…"
}

`GET /api/ws/echo`

WebSocket echo server. Connect with wss://mockfox.dev/api/ws/echo — every message is sent straight back. Hosted mocks also get a WebSocket at /api/ws/m/{id}. More →

Example request

npx wscat -c wss://mockfox.dev/api/ws/echo

Example response

(echo of each message)

Response format

Successful calls return HTTP 200 with the result in data and links in meta:

{
  "data": {
    "…": "…"
  },
  "meta": {
    "version": "1",
    "docs": "https://mockfox.dev/api",
    "source": "https://mockfox.dev/uuid-generator",
    "attribution": "Powered by MockFox — https://mockfox.dev/uuid-generator"
  }
}

Errors

`400`	Invalid or missing parameters. details lists each problem as { param, message }.
`404`	Unknown endpoint on this domain (each site serves only its own calculators).
`429`	Rate limit exceeded. Wait for the number of seconds in the Retry-After header.

{
  "error": "Invalid parameters.",
  "details": [
    {
      "param": "value",
      "message": "Invalid input: expected number, received string"
    }
  ],
  "docs": "https://mockfox.dev/api"
}

Rate limits and caching

120 requests per minute per IP address. Over the limit you get 429 with Retry-After.
No API key, no sign-up. CORS is open (Access-Control-Allow-Origin: *), so you can call it from the browser.
Deterministic GET responses are cached at the edge for 24 hours (Cache-Control: public, s-maxage=86400); cache them on your side too.
Random generators and POST responses are never cached.
Need more? Email us — we're happy to raise limits for reasonable use.

Attribution

The API is free. In return we ask (but don't enforce) a visible credit with a followed link to the page in meta.source wherever you show results:

<a href="https://mockfox.dev/uuid-generator">Powered by MockFox</a>

OpenAPI spec

A machine-readable OpenAPI 3.1 description of every endpoint is at https://mockfox.dev/api/v1/openapi.json — import it into Postman, Insomnia, or a client generator.

Terms

Use of the API is covered by our Terms of Use. Results are estimates for information only — not tax, legal or financial advice — and MockFox is provided as is, without warranty. Don't resell raw access, hammer the endpoints, or present the numbers as your own engine's. We may change or rate-limit the API; breaking changes get a new version (/api/v2).

Frequently asked questions

Is the MockFox API free?

Yes. No key, no sign-up. The v1 utilities allow 120 requests per minute per IP; the hosted mock and webhook endpoints have their own limits listed below.

Are generated passwords and UUIDs logged?

No. They are generated per request from a cryptographically secure RNG, returned with Cache-Control: no-store, and never stored. For maximum secrecy, generate passwords in your own environment — or use our browser-only password generator.

How exact are the token counts?

OpenAI counts (o200k_base and cl100k_base) are exact, computed with the official BPE ranks. Claude, Gemini, Llama, Mistral, DeepSeek and Grok don't publish tokenizers for this, so those counts are estimates from calibrated ratios — use the provider's own count-tokens endpoint when billing depends on it.

Should I send secrets in the query string?

No — URLs end up in logs and histories. Use POST with a JSON body for HMAC keys or private text; responses computed with a key are never cached.

Your business here? Sponsor this tool from $16/week. See placements

Try it

Quick start

Endpoints

GET /api/v1/uuid

Parameters

Example request

Example response

GET /api/v1/password

Parameters

Example request

Example response

GET /api/v1/random

Parameters

Example request

Example response

GET /api/v1/hash

Parameters

Example request

Example response

GET /api/v1/tokens

Parameters

Example request

Example response

GET /api/v1/llm-cost

Parameters

Example request

Example response

Hosted services

GET /api/fake/{resource}

Example request

Example response

POST /api/mock

Example request

Example response

GET /api/m/{id}/{path}

Example request

Example response

POST /api/bins

Example request

Example response

POST /api/hook/{id}

Example request

Example response

GET /api/status/{code}

Example request

Example response

GET /api/ws/echo

Example request

Example response

Response format

Errors

Rate limits and caching

Attribution

OpenAPI spec

Terms

Related

Frequently asked questions

`GET /api/v1/uuid`

`GET /api/v1/password`

`GET /api/v1/random`

`GET /api/v1/hash`

`GET /api/v1/tokens`

`GET /api/v1/llm-cost`

`GET /api/fake/{resource}`

`POST /api/mock`

`GET /api/m/{id}/{path}`

`POST /api/bins`

`POST /api/hook/{id}`

`GET /api/status/{code}`

`GET /api/ws/echo`