Subdomain Finder
Discover the subdomains of a domain using Certificate Transparency — the public logs every trusted TLS certificate must be recorded in. Get the list of hostnames with certificate dates in seconds, filter it, and export it to CSV, without sending a single packet to the target.
Enter a domain and our server queries public CT log search services (crt.sh, with Cert Spotter as a fallback) for unexpired certificates covering *.domain, extracts every hostname, and de-duplicates them. It's passive reconnaissance: it only reads public records.
Instant Results
Live checks in seconds
Nothing Stored
No logs of what you check
No Sign-Up
Free, no credits or email
Suggest a Feature or Improvement for Subdomain Finder
Need custom options, higher limits, or extra format support? Let our engineering team know!
How to use Subdomain Finder
- 1Enter the domain.
- 2Wait while CT logs are searched (up to 30 seconds).
- 3Filter the list and open hosts you want to inspect.
- 4Export to CSV.
Why CT logs reveal subdomains
Since 2018, browsers require every publicly trusted certificate to be logged in Certificate Transparency logs, which anyone can search. So any subdomain that ever got its own HTTPS certificate — staging sites, admin panels, old marketing pages — is publicly listed.
Wildcard certificates (*.example.com) hide individual names, and internal-only hosts without public certificates won't appear.
Using the results responsibly
For your own domains, the list is a great inventory: find forgotten hosts, check their certificates with the Certificate Expiry Checker, and remove dangling DNS records that could allow subdomain takeover. Only test systems you own or are authorised to assess.
Frequently Asked Questions
Why are some subdomains missing?
Hosts covered only by wildcard certificates, internal hosts, and names that never had a public certificate don't appear in CT logs.
Is this legal?
Yes — CT logs are public by design and we only read them. Scanning or attacking hosts you don't own is a different matter.
What do you do with the domains and URLs I check?
Our server performs the lookup once and returns the result to your browser. We don't store the addresses you check or build a history. Private and internal addresses are blocked.
Related Tools
Certificate Expiry Checker
Check SSL certificate expiry dates for up to 20 domains at once.
Domain Security Checker
Scan a domain's email, DNS and HTTPS security: SPF, DMARC, DNSSEC, CAA, SSL, HSTS and headers.
SSL Checker
Check a site's SSL/TLS certificate, chain, expiry, TLS versions, HTTPS redirect and HSTS.