Help — Subdomain Scanner
You type a domain and get its list of subdomains — blog.example.com, api.example.com, and so on. The search takes a few seconds and needs no account.
Where the names come from
Every time someone issues a security certificate for a site (the padlock in your browser), the authority that issued it is required to publish that in an open, permanent log. It is called Certificate Transparency, and it exists precisely so nobody can issue a certificate in someone else's name in secret. We simply read those public logs and collect everything that shows up under the domain you asked about.
We never touch the target server
Worth insisting on: this scanner does not send a single packet to the domain you search. It does not probe ports, does not guess names, does not log in anywhere. All of it comes out of a public record that was already there — the digital equivalent of looking up a company registry, not of knocking on someone's door. That is why the search never shows up in the target's logs and cannot take anything down.
What it does NOT find
Since everything comes from certificates, a subdomain that never had a public certificate simply does not exist to us. Internal servers, staging behind a VPN, anything running plain HTTP — none of it shows up. Which means: an empty list does not mean there are no subdomains, it means none of them were publicly certified. And on very large domains, with thousands of certificates, you see the most recent page, not the whole list.
Why it is sometimes instant
We keep each domain's result for a few hours. Certificates are issued over hours and days, never seconds, so an answer from a few hours ago is still a true answer — and it keeps a popular domain from costing a fresh lookup per visitor. If your search came back instantly, that is why. There is also a short gap enforced between two fresh searches in the same session, so that a free tool does not become anyone's recon proxy.
Who can see your searches
If you are not logged in, the search is always public and joins the list everyone can see. Logged in, you choose: you can mark a search as private, and then only you can open its result. The searched domain itself is never a secret — it was already in a public log before you typed it.
Can I search any domain?
Technically, yes: these are public records, and reading them is no different from reading a newspaper. What you do with the list afterwards is another matter — probing, accessing or attacking a system that is not yours, without written authorization, is a crime in most countries. This tool is for mapping what is yours, or what you were hired to assess.