About Subdomain Finder
Enumerate and find all subdomains for a target domain using Certificate Transparency logs from crt.sh. High-grade, fast, and secure. It's built for network, DNS and IP investigation, runs instantly, and works on any device — no install, no sign-up.
How to use Subdomain Finder
- Paste or type your input into the editor on the left.
- Leave the defaults, or tweak them if the tool exposes options.
- The result appears instantly on the right — everything runs in your browser, so nothing is uploaded.
- Copy the output, or download it, and you're done.
Why use Subdomain Finder?
- Fast and local — the transform happens in your browser, so there's no round-trip and no waiting.
- Private by default — only the specific lookup you request leaves your device; nothing is stored.
- Accurate — the same, well-tested logic powers both this page and the public API.
- Free — unlimited use in the browser, with an optional API for automation.
Use it from the API
Everything this page does is also available as a REST endpoint, so you can call Subdomain Finder from your own code, a script or a CI pipeline.
Bashcurl "https://api.toolsxpo.com/v1/subdomain-finder" \ -H "Authorization: Bearer txp_live_YOUR_KEY"
The endpoint returns a JSON envelope ({ ok, data, meta }) and costs 3 credits per successful call. Try it in the playground or browse the full API reference.
Frequently asked questions
Is Subdomain Finder free to use? Yes — use it in the browser as much as you like. The optional API has a free tier and pay-as-you-go pricing for heavy or automated use.
Is my data private? This tool makes a live network request to do its job, so the address or input you submit is sent to the relevant service. It is never stored on our servers.
Can I automate Subdomain Finder?
Yes — call the subdomain-finder API endpoint from any language and script it into your workflow.