Live
New TLS certificates are read as they are logged, and the hostnames on them are added as they arrive.
Search the subdomain index.
Give it an apex domain and you get every subdomain on file, plus the date each name first showed up.
Free · no token · 100 requests per IP per day
5,672,593,635
apexes and subdomains indexed
Index
How the index is built.
History
Years of earlier names, filled in from a range of public sources.
Discovery
The index also looks for names that never showed up in a certificate.
Every name is stored as (apex, subdomain, first-seen). No certificate metadata, and nothing is ever deleted.
API
Query it your way.
Plain HTTP, an MCP endpoint for agents, or straight from the command line.
Search
Free · no token100 requests per IP per day. Returns one subdomain per line.
apex must be an eTLD+1; add ?format=json for
JSON or &dates=1 for first-seen dates.
More endpoints
Closed beta- GET /v1/find?q=loginSearch all indexed names when you know part of a subdomain.
- GET /v1/top?n=100Apexes ranked by how many subdomains the index holds.
- GET /v1/streamServer-sent events for newly indexed names.
MCP
Free · no tokenStreamable HTTP endpoint for agent clients, with one tool,
search: pass an apex, get every indexed subdomain. Shares
the free /v1/search budget.
CLI
On by defaultA subdomain enumerator that queries this index directly. Its
crt source is on by default and needs no key, so
subfaster -d namecheap.com works on a fresh install.
Token access, with higher limits and the closed-beta endpoints, is invite-only for now. Paid plans aren't available yet.