✉ unfurlit.dev
no signup · no keys · deterministic · free

Rich link previews,
one GET away.

Fetch any URL and get Open Graph tags, meta description, favicon and canonical URL back as clean JSON. Built for chat apps, link aggregators and social schedulers: SSRF-guarded, deterministic, free tier with no card.

Try it live Read the docs

One call, 6 checks

Every response field is documented and deterministic — no opaque scores.

🏷️Open Graph tagsog:title, og:description, og:image with sane fallbacks
🗒️Meta descriptionstandard meta tags, normalized and trimmed
🖼️Faviconapple-touch-icon and favicon discovery
🔗Canonical URLrel=canonical plus the final URL after redirects
🛡️SSRF-guardedprivate IPs, internal redirect targets and non-HTTP schemes refused
⚡Deterministic JSONsame URL, same flat typed fields — missing tags come back null

Try it

Live demoreal endpoint
try:
result appears here

That was the real API, no signup needed. See the docs for the full reference.

Use it

# title, description, image, favicon and canonical URL in one GET — no key needed
curl "https://unfurlit.dev/v1/preview?url=https://example.com"

Free tier: 50 fetches/day per IP, no signup, no card. Full reference in the docs below.

Where teams use it

Unfurl links in chat apps

Turn bare pasted URLs into rich preview cards, right when the message lands.

 Preview posts before you schedule

Show creators exactly how their link will look when it's shared.

 Enrich bookmarks and read-later lists

Give every saved link a title, description and icon without manual entry.

FAQ

What does the API return?

One JSON object per URL: title, description, image, site_name, type, canonical_url, favicon, lang, content_type, status and the final URL after redirects. Fields the page doesn't provide come back null — never guessed.

Do you follow redirects?

Yes, up to a hard cap, and the response reports the final URL. Redirect chains that end at private or internal addresses are refused (SSRF guard).

Do you store the URLs I check?

No. Usage logging stores the request path only — never the query string, never the URL.

Do I need an API key or account?

Not right now. The free tier is 50 fetches/day per IP, open to everyone. Accounts and keys (for higher volumes and attribution) come later — the endpoint already accepts optional x-api-key headers, so you can adopt one without changing your integration.

Is it deterministic?

Same URL, same response. Fetches are fresh per call, but parsing is pure and stable — same HTML in, same JSON out.