How does it find subdomains?

Every public SSL certificate is recorded in certificate transparency logs. We search those logs through crt.sh for names ending in your domain.

Does it find every subdomain?

No. Subdomains without a public SSL certificate, or covered only by a wildcard, won't appear.

Yes. Certificate logs are public by design. Only test systems you own or have permission to test.

Why is it slow for big domains?

Large sites can have thousands of certificates; crt.sh may take up to a minute.

Ad Space

Subdomain Finder

Find subdomains from SSL certificate logs.

Data from public certificate transparency logs (crt.sh). Only scan domains you own or have permission to test.

Ad Space

How to Use the Subdomain Finder

Type a domain like example.com and tap Find. The tool searches public certificate transparency logs and lists every subdomain that has had an SSL certificate, with the first and latest certificate dates. Filter the list, then copy or download it.

Frequently Asked Questions

More free tools

🏷️ Meta Tag Generator 🤖 Robots.txt Generator 🛰️ IP Intelligence Lookup 🌐 WHOIS Domain Lookup

Ad Space

How to Use the Subdomain Finder

Frequently Asked Questions

How does it find subdomains?

Does it find every subdomain?

Is it legal?

Why is it slow for big domains?

Is it free?

More free tools