ForHosting KIT · Developer Utilities

Validate hex color

The hex color validator gives you a direct, deterministic answer for color codes used in CSS, design tokens, themes, configuration files, and generated markup.

● BetaFree · in your browser
Use it from WebAPIEmailTelegramApp soon

It accepts the standard three-, four-, six-, and eight-digit forms, with or without a leading hash, and checks every character instead of guessing or correcting the value. The result is a simple boolean that is easy to use in a form, test, import pipeline, or API workflow. Missing fields and wrong input types produce clear errors so request problems are never confused with a well-formed request containing an invalid color.

What counts as a valid hex color

A valid hexadecimal color contains exactly three, four, six, or eight hexadecimal digits. The three-digit form represents short RGB, while four digits represent short RGBA with alpha. Six digits represent full RGB, and eight digits represent full RGBA. A leading hash character is optional for this validator, because color values often move between CSS, databases, design tools, and configuration formats that do not all store the prefix in the same way. After that optional prefix, every character must be an ASCII digit from 0 through 9 or a letter from A through F, in either uppercase or lowercase. The checker does not accept spaces, punctuation, signs, repeated hash characters, color names, CSS functions, or hexadecimal digits of any other length. It also does not trim the input. That deliberate strictness makes hidden whitespace visible and prevents a value that differs from the stored source from being silently approved. The returned <code>valid</code> boolean therefore reflects the exact string supplied.

How deterministic validation helps

Color validation is a small operation, but inconsistent rules create surprisingly persistent defects. A browser may reject one form, a library may normalize another, and a handwritten regular expression may overlook alpha shorthand or accidentally allow five digits. This capability uses one explicit rule set: remove one optional leading hash, confirm that the remaining length is one of the four supported lengths, and confirm that all remaining characters belong to the hexadecimal alphabet. There is no network request, random behavior, date dependency, locale rule, case conversion, or color-space interpretation. The same input consequently produces the same boolean in the browser widget and through the API. Invalid color strings are ordinary validation results and return <code>false</code>; they are not exceptional requests. By contrast, omitting the required field or sending a number, array, or object where a string is required produces a clear input error. This distinction lets an application tell users that their color is invalid while still detecting broken integrations and incorrectly shaped payloads.

Using the result in forms and pipelines

Use the validator immediately before a color value crosses a trust boundary. In a form, call it when the field changes or before submission, then display a focused message when <code>valid</code> is false. In a design-token import, validate each source value before generating CSS so one malformed token cannot invalidate a stylesheet or propagate through a theme. In a data pipeline, keep the original string and store the boolean beside it when you need an audit trail; do not replace the source with a normalized value, because this capability intentionally validates rather than transforms. If you need expansion, conversion, or channel extraction, perform validation first and then pass approved values to the appropriate color capability. The browser execution is useful for interactive checks, while automated callers can use the API at $0.002 per request. Because the response contains a stable boolean and request-shape failures use explicit errors, the result fits conditional logic without parsing explanatory prose. Tests can also cover boundary cases directly: accepted lengths, letters at both cases, invalid symbols, extra prefixes, empty strings, and whitespace around otherwise valid digits.

Check a color form field

Confirm that a user supplied an allowed RGB or RGBA hex form before saving a theme preference.

Validate design tokens

Reject malformed color values before converting a token collection into CSS variables or application constants.

Guard generated styles

Test externally supplied color strings before inserting them into a generated stylesheet or component configuration.

Which lengths are valid?

Exactly 3, 4, 6, or 8 hexadecimal digits, excluding the optional leading hash.

Is the leading hash required?

No. Both #336699 and 336699 are valid representations for this checker.

Are uppercase letters accepted?

Yes. Hexadecimal letters A through F are accepted in uppercase or lowercase.

Does the validator trim spaces?

No. Leading or trailing whitespace makes the supplied color invalid, which helps expose formatting problems.

What does it cost?

The API price is $0.002 per request, and the same deterministic check can run in your browser.

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

POSThttps://api.kit.forhosting.com/color/is-valid-hex

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.

curl -X POST https://api.kit.forhosting.com/color/is-valid-hex \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d '{"text":"#336699cc"}'
{
  "text": "#336699cc"
}
{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "color.is_valid_hex",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

HTTPCodeMeaning
401unauthorizedMissing or invalid API key.
402insufficient_balanceYour balance doesn't cover the task price.
404unknown_typeThat task type doesn't exist.
429rate_limitedToo many requests. Use the webhook instead of polling.

Read the full KIT documentation →