# Subdomain Finder

Find the subdomains of a domain from Certificate Transparency logs: every name on a public certificate, when it was first seen, whether it is still valid, and which names look internal.

Canonical: https://tamperbox.dev/subdomain-finder

Reviewed: 2026-10-14

## Capabilities and processing

Enter a domain or paste crt.sh JSON (add ?output=json to a search). For a domain, our server searches the public Certificate Transparency logs through a public log search service; pasted JSON is read in your browser.

Every name on a logged certificate is listed with when it was first seen, its latest expiry, how many certificates name it and who issued them. Names that usually point at internal services are flagged, and the list can be filtered and copied. Text that is not JSON can still be read for names.

## Example workflow

The sample domain has 19 logged certificates, including names for staging, Jenkins and a VPN.

## Limits and interpretation

Only names returned by the public log search appear. Upstream availability varies; failures are reported without substituting sample results. Responses are limited to 2 MiB and 20,000 certificate rows. A wildcard hides the names under it, and a name stays in the logs after its server is gone. Nothing is stored.

## Related tools

[All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)