Razi Web Tools

Reviewed Jan 1, 2000.

• tools: 6 tools scanned
• metadata: scanned

No findings.

Tools (6)

• shorten_url

  Create a permanent razi.pro short link that redirects to a long URL. Returns JSON { code, shortUrl } and nothing else. Visits through the link are counted, but no tool here reads that count back, and the link cannot be edited, retargeted or deleted through this API. It never expires. The destination is stored, never fetched or checked for reachability, so a dead or mistyped URL still yields a working short link. Only http and https targets are accepted. This shortens an existing address; it does not host anything, so a file needs a public URL of its own before there is something to shorten. No sign-in is required; an anonymous call creates the link unowned, so it will not appear in any account's list. 30 links per hour per IP, then 429.

• screenshot_url

  Capture a screenshot of any public web page, rendered in a real headless browser so JavaScript, web fonts and lazy-loaded images all appear. Returns JSON with a hosted image URL — not image bytes: { url, screenshotUrl (the same value under the older key), width, height, format, bytes, cached, source }. When source is "vps" the image is on razi.pro's CDN and every field is populated, except that height is null for a fullPage capture. If source is "thumbio" the renderer was unavailable and a third-party fallback produced the image: the URL points at image.thum.io rather than razi.pro, only width accompanies it (height, format and bytes are absent), and the fullPage, format, darkMode and delayMs options were ignored. Public pages only: every capture runs in a fresh browser with no cookies or credentials, so anything behind a login is unreachable, and a URL that is not http(s) or that resolves to a loopback, private or link-local address is refused with 400. Identical requests are cached f

• fetch_site_logo

  Get a company's logo from its website URL. Reads the web app manifest, apple-touch-icons, declared favicons, OpenGraph/Twitter images and /favicon.ico, then downloads at most the first 10 candidates and measures their real dimensions — declared `sizes` attributes are frequently wrong, so ranking uses the measurement rather than the claim. Returns JSON { logo, icons, cached } plus the same page-metadata fields as fetch_page_metadata (url, finalUrl, title, description, siteName, canonical, lang, themeColor, author, generator, feeds, openGraph, twitter), so there is no need to also call it. Use that tool instead if you do NOT need the logo: it skips the image downloads entirely and is much faster. `logo` is the best candidate and is absent when nothing usable was found; `icons` lists all candidates, best first, with real icon assets deliberately outranking social share images, which are usually a wide marketing banner rather than a logo. If the site declares nothing fetchable, a Google fa

• fetch_page_metadata

  Read a web page's metadata without downloading any images. Returns JSON { url, finalUrl, title, description, siteName, canonical, lang, themeColor, author, generator, feeds, openGraph, twitter, icons, cached }, where `feeds` is an array of RSS/Atom URLs, `openGraph` and `twitter` are the complete tag sets as string maps, and any tag the page does not declare is simply omitted. `icons` is always an empty array here because icon resolution is switched off — call fetch_site_logo when the caller wants a logo, favicon or icon. `finalUrl` is the address after redirects (up to 3 hops are followed), which is how you resolve where a domain actually points. This is the fast, cheap counterpart to fetch_site_logo: one page fetch and no image work. It reads the served HTML only — it runs no JavaScript, so a client-rendered page may expose little, and it does not capture how the page looks (use screenshot_url for that). The crawler identifies itself as RaziMetadataBot, and HTTP status is not checked

• encode_url

  Percent-encode a string with encodeURIComponent so reserved characters survive transport inside a URL. Returns JSON { encoded }. It escapes the structural characters too — : / ? # & = all become %XX — so it is for a single query-string value or path segment, NOT for a whole address you still want to be clickable. This is escaping for URLs only. It is the wrong transform for making binary-unsafe content fit in JSON, an HTTP header or a data URI, which call for Base64 rather than percent-encoding. Reverse it with decode_url.

• decode_url

  Reverse percent-encoding with decodeURIComponent, turning %20-style escapes back into the characters they stand for. Returns JSON { decoded }. A malformed or truncated escape sequence is rejected with an error rather than passed through. Note that '+' is left as a literal plus, not converted to a space. It understands percent-escapes and nothing else: Base64 text and JWTs pass through unchanged or fail, rather than being decoded. It is the exact inverse of encode_url.