Free CORS proxy: 7 options compared in 2026

A practical look at the free CORS proxy services still running in 2026: where they cap you, what they cost above the cap, what to do when one starts returning 429s, and whether you should trust them with the URLs you send through.

May 26, 2026 · ~8 min read · Updated Oct 13, 2026

Need a key now? corsproxy.dev is free for 500 requests/day, no card (our service; disclosure below). Quickstart.

What "free CORS proxy" actually means

A CORS proxy forwards your browser's request to a third-party API and rewrites the response with the right Access-Control-Allow-Origin header. "Free" usually means one of three things:

• A demo instance with strict rate limits (cors-anywhere).
• An open service funded by ads, donations, or a parent product (allorigins, ThingProxy, cors.lol).
• A freemium SaaS with a free tier and paid tiers above it (corsproxy.io, cors.sh, corsproxy.dev).

Vendor figures below link to the vendor's own page or repo where we have one. Where we don't, we describe the service without numbers. Pricing changes, so check before you commit.

The seven options

1. cors-anywhere.herokuapp.com

The original. Open-source Node project by Rob--W. The public demo instance requires you to opt in on a separate page before it'll proxy for you, is rate-limited, and the project's README describes it as a demo of the project, not a service (checked Sep 2026).

Best for: trying the idea out. Worst for: anything you want to keep working.

Migration: see the dedicated guide.

2. api.allorigins.win

A volunteer-run open proxy that wraps the response in JSONP or returns it as JSON. No API key and no documented rate limits, but heavy use can get you blocked. The maintainer accepts donations.

Best for: quick demos and tutorials. Worst for: anything where the response shape matters, since the wrapper adds a layer your client has to parse.

3. ThingProxy by Freeboard

thingproxy.freeboard.io/fetch/<url>. Originally bundled with the Freeboard dashboard product. Still up, with per-IP rate limiting. Returns the upstream response verbatim, including the original status code. Fine for occasional use, not for production.

4. corsproxy.io

A commercial managed proxy. Requests carry an API key: corsproxy.io/?key=YOUR_KEY&url=https%3A%2F%2Fapi.example.com%2Fdata. Per their pricing page (checked Sep 2026), the free tier is 10,000 requests and 1 GB a month, browser-side only, with no uptime commitment and production features not included. Paid plans are $5/month (Hobby) and $29/month (Production), with uptime SLAs, plus extras like caching and format conversion. Has a usage dashboard. Full comparison with corsproxy.dev.

Best for: teams who want a managed proxy with an uptime SLA on a paid plan.

5. cors.sh

A commercial managed proxy built on Cloudflare's edge, from Grida, Inc. Unusually for this list, its source is MIT-licensed and public, so we could read it instead of relying on marketing copy. Per their pricing page (checked Sep 2026), the free tier is 10,000 requests and 5 GB a month with origin-pinned "live keys" (the key is public by design; the browser's Origin header does the gating). Pro is $4/month for 500,000 requests, 500 GB, no hourly throttling, up to 6 MB per request. The spec committed to their repo lists what every request is checked against (origin pinning, target allowlists, size caps, rate limits), and private-network/SSRF filtering is not on that list. Full comparison: corsproxy.dev vs cors.sh.

Best for: a large monthly quota for little money. Worst for: anyone who needs the proxy to refuse a private/internal target, which their own spec doesn't cover.

6. cors.lol

A free, open-source (Node) proxy: prefix https://api.cors.lol/?url=. The free tier is marketed as unlimited but is rate-limited without published specifics, and a one-time paid plan lifts the limit. No API key, no origin locking, and no security documentation on the marketing site. The site's blog and footer were last dated 2024 when we looked, which doesn't mean it's abandoned but is worth checking before depending on it.

Best for: a quick no-signup prototype. Worst for: anything where you'd want to know who else shares the same open endpoint, or whether it'll fetch a target you didn't intend.

7. corsproxy.dev (us)

Disclosure: this is our service, on this site. A managed API with API keys you can lock to an origin (browser-only protection) and to a list of target hosts, exact daily limits enforced per account in a Cloudflare Durable Object, a daily bandwidth cap, and a dashboard with your recent calls. Literal private, loopback and metadata addresses are refused, and hostnames are resolved through Cloudflare's security DNS resolver first, so names pointing at private addresses or flagged as malware/phishing are refused too. That DNS check is a separate lookup before the fetch and fails open if the resolver errors; redirects aren't followed, so an upstream 3xx comes back to you as is. It can keep third-party API secrets out of the browser with managed upstream headers, cache responses at the edge with ttl (Pro), and set headers per request. Free is 500 requests/day; Pro is $5/month for 20,000/day. We also publish a simpler open-source CORS relay (MIT, Go) you can self-host. It's a separate program, without accounts, quotas, managed headers or caching.

The comparison table

"Not documented" means the service's own pricing, docs and marketing pages don't mention blocking private-network or internal targets. We didn't test for it. cors.sh is the exception: its source is public, so "No" there is read from its own committed spec. For everyone else, if it matters to you, ask the vendor before you rely on it.

If your current proxy just started returning 429s

Most no-signup proxies serve everyone from one shared pool of capacity. Without a key there's nothing to tell your traffic apart from anyone else's, so when another site or a bot hammers the same endpoint, the limit trips for all callers at once, including you. Some demo instances, like cors-anywhere's, are rate-limited on purpose to push people toward self-hosting.

Before you switch, check:

• Signup and keys. A per-key or per-account limit isolates you from other people's traffic. No signup almost always means a shared pool.
• Published limits. You want the number in writing, and a clear 429 with a reset time you can build backoff against, not silent drops.
• Maintenance. A status page, recent releases, or a business model that pays for hosting.
• SSRF posture. Whether it refuses private and internal targets (next section).

Most proxies take the target as a ?url= query parameter, so moving is usually one line, for example https://api.corsproxy.dev/proxy?url=https://api.example.com/data&key=YOUR_KEY. For wrapper functions and Axios, see migrating from cors-anywhere; for how our quota works, see rate limits and quotas explained.

What to actually watch for

"Free" is a feature, but so are the things that make a proxy safe to depend on:

• Does it block private-network targets? An open proxy that will fetch http://169.254.169.254/ is an SSRF bug waiting to be exploited, and the hosting provider's complaint lands on whoever runs it. corsproxy.dev blocks private-network targets; for any other proxy, check its docs, and if it doesn't say, assume it doesn't.
• What does it do with Authorization and cookies? A proxy that blindly forwards them lets anyone call paid APIs with credentials that were never meant to leave the browser. Better proxies strip them by default and give you an explicit way to set auth.
• Are rate limits per identity? Per-IP limits get crushed by NAT (one shared egress IP can be a whole company). Per-key limits are the right granularity.
• Will it be there next month? Volunteer-run proxies disappear. Prefer something with a business model that pays for hosting.

For the full security argument, see how a CORS proxy can be abused.

What we'd actually recommend

1. You control the upstream. Don't use any proxy. Configure CORS on the upstream. It's correct and free.
2. You're in dev and just need it to work. Use your build tool's proxy config. 5 ways covered here.
3. You need a managed proxy in production. Pick one with API keys, per-account limits, and a documented security stance. corsproxy.dev is our answer: $5/month for 20,000 requests/day, with SSRF handling documented down to its limits. cors.sh's $4/month tier is a dollar cheaper and includes more bandwidth (500 GB a month); corsproxy.io's paid plans come with an uptime SLA, which we only offer on Enterprise.
4. You can't send your data through anyone else. Self-host. Our open-source Go relay (MIT) is a separate, simpler program than the hosted service; cors-anywhere is the other obvious open-source choice but is heavier (Node, more features).