Subdomain Finder
Discover publicly known subdomains using Certificate Transparency logs (crt.sh). Only use this on domains you own or are authorized to test.
Authorized Use Only. This tool queries publicly available Certificate Transparency logs. Only scan domains you own or have explicit permission to test. Unauthorized scanning may violate laws.
How This Tool Works
Certificate Transparency
Every time an SSL/TLS certificate is issued for a subdomain (e.g., api.example.com), it is publicly logged by the Certificate Authority into a Certificate Transparency (CT) log.
crt.sh Query
We query the free public crt.sh database, which aggregates all CT logs. It returns every certificate ever issued that contains your domain — revealing all known subdomains.
Deduplication & Display
Results are parsed, deduplicated, and sorted alphabetically. You can filter the list, copy everything to clipboard, or download as a .txt file.
About Subdomain Finder
Our Subdomain Finder queries the public Certificate Transparency (CT) log database via crt.sh to discover all publicly known subdomains for a given domain. This is the same data used by security professionals for authorized reconnaissance.
Why use our Subdomain Finder?
Unlike DNS brute-force tools, CT log based enumeration is passive, fast, and requires no special tools. Every SSL certificate issued is a public record — this tool simply reads those records. Use it to audit your own attack surface, discover forgotten assets, or learn security concepts.