Skip to main content

Subdomain Finder

Discover subdomains from certificate transparency logs.

Free & unlimited

Third-party data source

Subdomain discovery queries crt.sh (certificate transparency logs) via our backend. The domain you enter is sent to crt.sh. Only public CT log data is returned.

Try:
Processed on our servers and deleted right after. Never stored or shared.

What happens to your file

This is one of the few tools on ToolChamp that is not purely client-side, and the page says so in a banner before you search. The domain you type is POSTed to /api/network/subdomains, a Cloudflare Pages Function, which queries crt.sh — the public certificate-transparency log search — for %.<your domain> and then resolves the first 50 results over DNS-over-HTTPS at cloudflare-dns.com. So two third parties see the domain name: crt.sh and Cloudflare DNS. Nothing else leaves the page: there is no file upload, no account, no cookie tied to the search, and the Function stores nothing — it forwards the query, reshapes the JSON and returns it. Everything it returns was already public: a certificate-transparency log is an append-only public record that every issuing CA is required to publish, which is exactly why subdomains show up there.

About this tool

  1. 1

    Enter a domain

    Type a root domain like example.com to discover its subdomains.

  2. 2

    Start the search

    The domain is sent to a Cloudflare Pages Function, which queries crt.sh for every certificate issued under that name. crt.sh is slow and sometimes down; the Function retries three times and then tells you so rather than returning a silently empty list.

  3. 3

    Review discovered subdomains

    Names are deduplicated, sorted and shown with a wildcard flag. The first 50 are resolved to an IPv4 or IPv6 address over DNS-over-HTTPS; the rest are listed without one.

  4. 4

    Export results

    Download the subdomain list as a CSV or text file for further analysis.

  • Certificate transparency logs only reveal names a CA has issued a certificate for. A subdomain that has never had a public certificate will not appear here, and no wordlist brute-force is run.
  • Look for staging, dev, or test subdomains that may have weaker security configurations.
  • Combine results with a port checker to identify services running on discovered subdomains.
  • Not all subdomains are public-facing - some may resolve to internal IPs.
  • Queries crt.sh certificate transparency logs through a Cloudflare Pages Function
  • Resolves the first 50 results to A and AAAA records over DNS-over-HTTPS
  • Flags wildcard (*.example.com) certificate entries separately
  • Filter and sort the result list by name or length in the page
  • Export as CSV, JSON or a plain newline-separated list
  • Map the attack surface of your own domain for a security audit.
  • Discover forgotten or undocumented subdomains that may need updates or decommissioning.
  • Research a company's public infrastructure during competitive analysis.
  • Prepare for a penetration test by enumerating all accessible entry points.
Querying public DNS records and certificate logs is legal. However, always ensure you have authorization before performing security testing on discovered subdomains.
This tool reads certificate transparency logs only, so a subdomain that has never had a publicly-issued TLS certificate will not be in the result — internal names, names behind a private CA, and names covered only by a wildcard certificate all fall outside it. It also reads at most the 200 most recent crt.sh entries per domain, so a very large estate can be truncated.
Neither exactly. There is no file and nothing to upload, but the search itself cannot run in your browser: crt.sh sends no CORS headers, so a page cannot query it directly. The domain string is therefore sent to a small Cloudflare Pages Function of ours, which queries crt.sh on your behalf and returns the JSON. The Function keeps no log of what you searched for.
crt.sh, because the query goes there, and Cloudflare DNS, because the first 50 results are resolved over DNS-over-HTTPS at cloudflare-dns.com. Both requests are for public data about a public domain. If you are enumerating something you would rather nobody logged, run a local tool against your own resolver instead.

Related tools

View all

Updated

We use anonymous analytics to improve ToolChamp. No personal data is stored or sold. Privacy Policy