Subdomain Enumeration via Certificate Transparency · crt.name
crt.name
Search the subdomain index.
Give it an apex domain. You get every subdomain on file, plus the date each name first showed up.
Apex domain
Search →
Free · no token · 1000 requests per IP per day
5,052,899,910<br>apexes and subdomains indexed<br>live from the CT firehose
api.namecheap.com
login.example.net
cdn.example.org
status.example.dev
assets.example.io
mail.example.app
vpn.example.co
git.example.sh
How the index is built
Live CT. The index reads every usable CT log in Chrome's<br>and Apple's programs as entries land: Static CT (Let's Encrypt Sunlight,<br>Geomys, Cloudflare Raio) and legacy RFC 6962 (Google Argon, Sectigo,<br>DigiCert). It parses each certificate in memory, pulls out the SAN hostnames,<br>then throws the rest away.
Backfill. The live feed only sees forward, so most of the<br>depth is history: retired CT logs replayed from the Internet Archive, plus<br>Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, and HaGeZi DNS<br>blocklists.
Active probing. A prober works through common hostnames<br>against known apexes on a loop, and anything it turns up joins the same<br>index.
Every name is normalized by apex. The index keeps three fields,<br>(apex, subdomain, first-seen) . It holds no certificate<br>metadata and never deletes a name.
API
GET /v1/search?apex=namecheap.com<br>free · no token
No token. 1000 requests per IP per day. Returns one subdomain per line by<br>default. apex must be an eTLD+1; use ?format=json<br>for JSON or &dates=1 to include first-seen dates.
GET /v1/find?q=loginclosed betaSearch all indexed names when you know part of a subdomain.
GET /v1/top?n=100closed betaApexes ranked by how many subdomains the index holds.
GET /v1/streamclosed betaServer-sent events for newly indexed names.
Token access (higher limits and the endpoints above) is in closed beta. Paid plans are not available yet.
MCP
POST /mcp<br>free · no token
Streamable HTTP endpoint for agent clients. Shares the free<br>/v1/search budget (same counter). One tool, search:<br>pass an apex, get every indexed subdomain. No token; free tier does not probe.
CLI
github.com/melvinsh/subfaster<br>crt source · on by default
A subdomain enumerator that queries this index directly. Its<br>crt source runs by default and takes no key, so<br>subfaster -d namecheap.com reaches the free API on a fresh<br>install.
Search a domain →