Subdomain finder

We list the subdomains that appear in public SSL certificates issued for the domain.

✓ Free, no sign-up

How it works

Every SSL certificate issued by a trusted authority is recorded in public Certificate Transparency logs. We query those logs through crt.sh and extract the names. Only subdomains that ever had a certificate show up; ones that never used HTTPS can't be found this way.

FAQ

Is this legal?

Yes. Certificate Transparency logs are public by design, precisely so anyone can audit the certificates that have been issued.

Why does the search sometimes take long or fail?

crt.sh is a heavily used free service and is sometimes overloaded. If it fails, try again in a few minutes.