Subdomain Finder
About the Subdomain Finder
Find the subdomains of any domain — like mail., api., dev. or shop. — by searching public certificate transparency logs. Every publicly trusted SSL/TLS certificate is recorded in these logs, so any subdomain that has ever had an HTTPS certificate shows up. The search is completely passive: it queries the public crt.sh database and never contacts the target’s servers.
To answer, this tool sends the domain or IP address you look up to public lookup services, so it needs an internet connection.
How to use it
- Enter a domain like example.com.
- Tick “Include expired certificates” to uncover older or retired subdomains.
- Filter and sort the list, click any name to see its DNS records, and copy or download the results.
Frequently asked questions
What is certificate transparency?
Certificate transparency (CT) is a system of public, append-only logs where certificate authorities must record every certificate they issue. It lets domain owners spot certificates issued for their domains without permission — and makes subdomains with HTTPS publicly discoverable.
Why are some subdomains missing?
Only names that appear on a public certificate are found. Subdomains covered by a wildcard certificate (*.example.com), internal-only names and those without HTTPS won’t be listed individually.
Is it legal to look up subdomains?
Yes. Certificate transparency logs are public by design, and this tool only reads them — it does not scan or probe the domain. Always get permission before actively testing systems you don’t own.
Why is the search slow or failing?
crt.sh is a free community service, and domains with very large certificate histories can take 30 seconds or more. If it is busy, wait a minute and try again, or leave expired certificates unticked for a faster search.