Subdomains Finder — Find Subdomains of a Domain Online
Discover every subdomain of any domain using two methods: public Certificate Transparency logs via crt.sh, or a live DNS wordlist scan. Everything runs in your browser — nothing is stored.
Press Enter, or use the Find Subdomains button in the header.
Scan method
Certificate Logs mode scans public Certificate Transparency logs via crt.sh. Fast, but only finds subdomains that appear on SSL certificates.
Certificate Logs mode uses crt.sh. DNS Wordlist mode queries Google Public DNS (dns.google) with a 100 ms delay between requests.
Frequently Asked Questions
A subdomain is a prefix added to a root domain that points to a separate part of a website — for example blog.example.com, mail.example.com or api.example.com. Organisations use subdomains to organise services and features under one main domain.
Every publicly trusted SSL certificate is logged in public Certificate Transparency (CT) logs. This mode queries crt.sh for every certificate that mentions the domain and collects all of the domains listed in each certificate's SAN field, then deduplicates and sorts them.
This mode tests a list of common subdomain names (www, mail, ftp, api, admin, cdn and more) by asking Google Public DNS whether each name has an A record. Only subdomains that exist and resolve to at least one IP address are shown, along with their IPs.
CT logs only contain subdomains that appear on SSL certificates, so they miss internal or unencrypted hosts. The DNS wordlist only covers common names, so it misses unusual or non-standard subdomains. Running both gives you the most complete picture.
No. All scans run directly from your browser against public services (crt.sh and dns.google). We do not store, log or share any domain you search.
We'd Love Your Feedback
Share your thoughts, suggestions for new tools, or how we can improve this tool.
→ Send Feedback