Verify before you trust
AI API Model Tester
Check whether an endpoint really delivers the advertised model. Runs in your browser — your key is never sent to our servers.
Request configuration
Configure endpoint and key, then run the test in your browser.
Sent only to the configured endpoint — never to our servers.
A run sends 6 tiny requests on your key (fractions of a cent on api.airforce).
Why this tester is different
Deterministic, not a guess
Every check maps to a concrete signal in the response, so genuine models are never flagged as fake the way statistical fingerprinting flags them.
Evidence you can see
Every verdict shows the sent prompt, the raw response and the exact text that triggered it. Nothing is hidden.
Your key stays yours
Everything runs in your browser. The key goes only to the endpoint you test — never to our servers — and the history lives in localStorage.
How the probes work
Tokenizer fingerprinttokenizer
The model must echo a fixed string verbatim. Wrappers and re-tokenizing gateways often mangle exact echoes — the real model passes cleanly.
Echo this exact string back verbatim: Hello, world! This is a tokenizer fingerprint test.
Letter counting (strawberry)quirk
How many 'r' are in strawberry? Weak or substitute models famously fail this; the advertised tier answers '3'.
How many letter r appear in the word strawberry? Reply with ONLY a single integer.
Number sense (9.11 vs 9.9)quirk
A classic reasoning quirk: 9.9 is larger than 9.11. Smaller substitute models routinely get this wrong.
Which is larger: 9.11 or 9.9? Reply with ONLY the larger number, no explanation.
Knowledge cutoffcutoff
Who won the November 2024 US election? Models older than claimed cannot know — a clear signal when the answer is missing.
Who won the November 2024 US Presidential election? If you genuinely do not know, reply exactly: I DO NOT KNOW.
Language fidelitylanguage
A German instruction demands exactly one German word. Silent translation layers or wrappers betray themselves by answering in English.
Antworte ausschließlich mit dem einen deutschen Wort „Apfel". Kein anderes Wort, keine Erklärung.
Self-report (info only)identity
We ask the model to name itself and its builder. This is never a failure: real models are often unsure of their exact version — shown as a hint only.
In ONE short sentence: state your exact model name, who built you, and your training data cutoff.
Usage sanityusage
We compare the billed token counts against the delivered text. A token averages ~4 characters, so a completion count far above the character count is impossible without inflation — a deterministic over-billing signal. The bar is deliberately high so short answers never trigger it.
What does NOT count as fraud
A real model confirms its provider and tier but is often unsure of its exact version. That alone is never a failure — noted as a hint only.
Rate limits (429), 5xx and timeouts mark a run as unverified, never as suspicious. A genuine endpoint having a bad moment is not punished.
Naming AWS Bedrock, Google Vertex or Azure as the host is accepted — those are legitimate ways to resell the real model.
Translating between chat-completions and the native messages format is normal gateway behaviour, not a fraud signal, as long as the model itself is real.
Four of five passing probes are enough for genuineness — a single deviating answer does not convict an honest endpoint.
Frequently asked questions
Does my API key touch your servers?
No. The tester runs entirely in your browser: requests go straight from your machine to the endpoint you configure. We never see, log or store your key. The run history is kept in your browser's localStorage only.
What does a test run cost?
Six tiny requests with a few output tokens each — on api.airforce that is a fraction of a cent, billed to your own key. Free-tier keys use their normal free allowance.
My run came back 'unverified' — is the endpoint fake?
No. Unverified only means a transient problem (rate limit, 5xx, timeout or a CORS block) interrupted the test. Wait a moment and re-run. We never mark an endpoint as suspicious because of a bad moment.
Can I test endpoints other than api.airforce?
Yes — enter any base URL and key. Browser security (CORS) applies though: api.airforce is guaranteed to answer browser calls, other providers may block them, in which case the run is marked unverified rather than failed.