Validate an image
An 8 by 4 pixel PNG of 74 bytes checked against a minimum width of 16 fails, with the reason spelled out. The real content of the file is read, not its name, and you get its format, width, height and weight. Free in your browser.
- Free
- Runs in your browser
- No sign-up
- Your data stays on your device
Run — free
Runs in your browser. Free, unlimited — your data never leaves this page.
An upload form that trusts the browser's file extension is a support ticket waiting to happen.
Why the file name is not enough
An upload form that trusts the file extension is a support ticket waiting to happen. People and browsers send the wrong thing all the time, sometimes on purpose and often by accident: a renamed file, a corrupted download, a HEIC photo saved with a .jpg ending. Checking the extension or the type the browser declares catches none of that, because both are supplied by the sender and are easily wrong. This check opens the file and reads its real signature and structure, which is the only reliable way to know what you are actually holding.
Your own limits, and where to apply them
You set the rules: the largest file size you accept, a minimum or maximum size in pixels and the formats you allow. The answer gives the detected format, the width and height, the weight and a clear pass or fail with its reason, so a tiny 8 by 4 pixel PNG fails a minimum width of 16. Run it the moment a file arrives, before it is stored or published: a marketplace receiving product photos, a social app accepting profile pictures, an agency collecting hundreds of design files from a freelancer, or a media library that should never publish an oversized image.
The gap between 'file.jpg' and an actual JPEG
Browsers and users lie to upload forms constantly, sometimes on purpose and often by accident: a renamed file, a corrupted download, a HEIC saved with a .jpg extension. Checking a MIME type header or a file extension catches none of that, because both are supplied by the client and trivially wrong.
What you can do with it
Marketplace product photo intake
A seller uploads a product photo and the platform validates it is a real JPEG or PNG under the size cap before it ever reaches the listing pipeline.
User avatar upload gate
A social app checks that a profile picture upload is an actual image within dimension limits before generating thumbnails, avoiding wasted processing on bad files.
Bulk contractor asset intake
An agency receiving hundreds of design assets from a freelancer validates every file against format and weight rules before importing them into the project.
CMS media library guardrail
A content team's CMS validates every media upload against a size and format policy so editors can't accidentally publish an oversized or wrong-format image.
FAQ
Does it catch mislabeled files, like a HEIC saved as .jpg?
Yes, because the check reads the file's actual signature and structure rather than trusting the extension or MIME type sent by the client.
Which formats can be validated?
JPEG, PNG, WebP and GIF are all detected and validated; the response tells you exactly which format was found, whether or not it matches what you expected.
Can I set my own size and dimension limits?
Yes, you pass the constraints — maximum weight, minimum or maximum width and height, allowed formats — and the result includes a clear pass or fail against those rules.
What happens with corrupted or unreadable files?
A genuinely unreadable file returns a clear failed-format result rather than an error, so your backend can reject it with a specific reason instead of guessing.
Why isn't the file extension enough to trust an upload?
Because the extension and the type a browser declares both come from the sender's device, and they are easily wrong: a renamed file or a corrupted download looks fine by name. Only reading the file itself shows what it really is.
Related tools
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/image/validate \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"image":"https://ejemplo.com/imagen.jpg"}'const res = await fetch("https://api.kit.forhosting.com/image/validate", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"image": "https://ejemplo.com/imagen.jpg"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/image/validate",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"image": "https://ejemplo.com/imagen.jpg"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/image/validate", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"image":"https://ejemplo.com/imagen.jpg"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"image":"https://ejemplo.com/imagen.jpg"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/image/validate", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"image": "https://ejemplo.com/imagen.jpg"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "image.validate",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_mb | 15 |
max_megapixels | 12 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |
Technical notes
The image validation API inspects the actual file bytes, not the filename, and reports back format, pixel dimensions and weight in kilobytes so your backend can accept or reject an upload with certainty. It answers one question precisely: is this file what it claims to be, and does it fit your limits?
The gap between 'file.jpg' and an actual JPEG
This endpoint opens the file and reads its actual signature and structure, which is the only reliable way to know what you're really holding.
What gets checked
POST an image to /image/validate and the task returns the detected format, width and height in pixels, and file size in kilobytes, along with a pass or fail flag against whatever constraints you specify — maximum weight, minimum or maximum dimensions, allowed formats. That single structured answer is what a backend needs to decide, in one branch of logic, whether to store the file or bounce it back to the user with a specific reason.
Where this sits in an upload pipeline
Most teams call this endpoint the moment a file lands, before it touches permanent storage, a CDN or a database record. Because the check runs asynchronously, an upload flow fires the request and either waits briefly for the webhook on a small form or queues the file for later confirmation on a bulk import — either pattern avoids holding a request thread open while an image is inspected byte by byte.
Who this protects
Marketplaces validating seller-uploaded product photos, user-generated-content platforms filtering profile pictures before they ever get processed further, and internal tools accepting design assets from external contractors all rely on this endpoint for the same reason: catching a bad file at the door is cheaper than debugging why it broke a downstream resize job three steps later.
Straightforward, honest pricing
A request that fails due to a transient error is retried automatically up to three times before returning a clear error, and you are never charged for a failed task, only for a completed validation result. Validation is billed at a single flat fee per request — no per-image multiplier, since one file in means one check out.
Technical questions
What does the image validation API actually check?
It inspects the real file bytes to detect the true format, then reports pixel width and height and file weight in kilobytes, flagging whether the file passes the format, size and dimension limits you define.
Is the image validation API free?
The tool above runs free in your browser. The API is paid — each call draws from your prepaid ForHosting KIT balance: top up from $10.00 (it never expires), pay each request's published price, and a call with no balance returns HTTP 402. No subscription, no tokens, and a failed task is never charged.
How fast do I get a result?
The task runs asynchronously and returns a task_id immediately; the validation result arrives via signed webhook, or you can retrieve it from a signed link valid for 24 hours.
Can I validate a large batch of images at once?
Each request validates one image, so a bulk import calls the endpoint once per file; since it's billed at a flat rate per request, cost scales predictably with volume.