Bad e-mails never enter your base. Validate at the moment of capture.
A single script checks every address the moment the visitor leaves the field — corrects typos, blocks disposable and non-existent mailboxes, and tells the person exactly what to fix. No bounces later, no cleaning campaigns.
- ~300 ms per check
- 20+ verifications per address
- 7 KB, zero dependencies
This demo simulates the widget behaviour (no API calls). Test with the real API →
Four steps in less than a second
The visitor barely notices. Your base does.
- 1
The visitor types
Nothing happens while typing — no flicker, no premature errors.
- 2
Leaves the field
On blur (or after a pause, if you prefer) the widget sends the address to AT Valid over HTTPS.
- 3
~300 ms of verification
Syntax, DNS/MX, SMTP mailbox check, disposable and trap lists, typo detection, catch-all evidence, toxicity.
- 4
A clear answer
Green tick, a specific reason ("mailbox full", "did you mean gmail.com?") or a block — and the submit button follows your rules.
Same widget, different rules per form
Each form decides what it accepts. Click the chips or type an address.
Strict: personal addresses only — no disposable, no role-based, no toxic.
Blocks: disposable · role-based · non-existent · toxic
The order confirmation must arrive — block what bounces, allow the rest.
Blocks: disposable · non-existent · mailbox full
Maximise sign-ups: accept role-based with a warning, still block the garbage.
Blocks: disposable · toxic · typo without correction
Not just "is this an e-mail?"
The widget uses the same Score v3 engine as bulk validation.
Typos with a one-click fix
gmial.com → gmail.com, hotmal.com → hotmail.com. The suggestion is clickable.
Disposable addresses
8,700+ temporary-mail domains, refreshed daily.
Non-existent mailboxes
A real SMTP conversation with the mail server — no message is sent.
Full mailboxes
Over-quota accounts that would bounce today.
Catch-all with a confidence score
Servers that accept everything get a 0–10 evidence score instead of a blind "unknown".
Role-based addresses
info@, sales@, support@ — accept, warn or block per form.
Toxic addresses
Spam traps, blacklisted and parked domains, no-reply — a 0–5 toxicity index.
Dead domains
No mail server, Null MX, parked or for-sale domains.
Syntax and Unicode
RFC-compliant parsing, homograph risk, plus-tags, invalid characters.
Two lines. Two minutes.
Paste before </body>. Every input[type="email"] on the page is protected — including forms injected later by page builders.
Public key restricted to your domains. No back-end code, no framework, no build step.
Copy-paste examples for:
Prefer server-side? The same engine is available through the REST API, with SDK samples in JavaScript, Python, PHP and cURL.
<script src="https://www.atvalid.com/widget/v2/widget.js"></script>
<script>
ATValid.init({ publicKey: 'pk_live_…', preventSubmit: true });
</script> Lightweight, customisable, unobtrusive
7 KB gzipped, zero dependencies
Plain JavaScript. No jQuery, no framework, no CSS file to load.
Your words, your look
Every message is configurable — including the specific reasons — and every CSS class can be overridden.
Works with your validation
HTML5 setCustomValidity(), custom events (atv:verified, atv:error) and callbacks for anything else.
Dynamic forms are fine
A MutationObserver picks up forms rendered after load: WordPress, RD Station, HubSpot, React, Vue.
Nothing sent twice
A 5-minute in-page cache: re-typing the same address costs nothing.
Any language, any alphabet
International domains and Unicode local parts are parsed correctly.
Safe to put on a public page
Domain-restricted public keys
A pk_live_ key only works from the domains you list. Leaked keys are useless elsewhere.
Anti-flood by design
60 requests/min per key and 30/min per visitor IP. Bots cannot drain your credits.
Nothing reaches the mailbox
The check happens server-side, in an SMTP conversation that never sends a message.
LGPD / GDPR
Addresses are used only for the validation you requested — never stored in clear, sold or reused.
Frequently asked questions
Does the widget slow down my form?
No. The check runs only when the visitor leaves the e-mail field (or after a typing pause, if you choose), takes around 300 ms, and the 7 KB script loads asynchronously.
Does it send an e-mail to the address?
Never. AT Valid opens an SMTP conversation with the mail server to ask whether the mailbox exists and closes it before any message is sent.
Can I block free providers like Gmail?
Yes — allow.free: false blocks Gmail, Outlook, Yahoo and 4,000+ other free providers. Most B2C forms keep them on; B2B lead forms often turn them off.
What happens if the API is unreachable?
The widget fails open by default: the visitor can still submit. You can change that with blockOnRateLimit and the onError callback.
Does it work with WordPress, RD Station or HubSpot forms?
Yes. The widget detects dynamically rendered forms automatically and we publish copy-paste snippets for the most common platforms.
How is it billed?
One credit per verified address, from the same balance as bulk validation. Repeated checks of the same address within 5 minutes are cached in the page and cost nothing.
Stop cleaning lists. Start capturing clean.
Create a free account, generate a public key and paste the snippet — the first 200 checks are on us.