Online Tool Store
Subdomain Finder
Enter a domain to generate common candidate subdomains as a starting wordlist for DNS checks and security research.
This works right here on your device — nothing gets sent out.
Browsers can't perform live DNS lookups, so this generates a candidate wordlist of common subdomain names for you to check yourself (e.g. with nslookup or a DNS tool) — it doesn't confirm which ones actually exist.
Candidate subdomains
How the subdomain finder works
- Enter a domain.
- The tool combines it with a list of common subdomain prefixes — www, mail, api, staging, admin, and more.
- Copy any candidate individually, or copy the whole list to check against DNS yourself.
Why this can't be a live scanner
Web browsers deliberately don't expose a DNS lookup API to JavaScript — there's no way for a page running in your browser to ask "does subdomain.example.com resolve?" without a server doing that lookup on its behalf. This tool sticks to what's genuinely possible client-side: generating the candidate list, the same starting point real subdomain enumeration tools use before they run DNS queries against each one.
FAQ
Does this actually check which subdomains exist?
No — a browser can't perform arbitrary DNS lookups, so there's no way to confirm which of these actually resolve from client-side JavaScript alone. This generates a wordlist of common subdomain naming patterns; you'll need a DNS tool (like nslookup, dig, or a command-line subdomain scanner) to check which ones are actually in use.
Why is a wordlist still useful?
Most real subdomain enumeration tools start exactly this way — trying a large list of common names (www, api, staging, admin, and so on) against a target domain's DNS. This tool gives you that starting wordlist instantly, pre-filled with your domain.
How do I actually check if a subdomain exists?
From a terminal, run something like nslookup subdomain.example.com or dig subdomain.example.com — if it returns an IP address, the subdomain is active. There are also dedicated command-line and web-based DNS lookup tools built for this.
Is my domain sent anywhere?
No. The candidate list is generated entirely in your browser by combining your domain with a fixed list of common prefixes — nothing is looked up or sent anywhere.
How we compare
| Feature | Online Tool Store | Sublist3r (command-line tool) | crt.sh certificate search |
|---|---|---|---|
| Instant, no install | ✓ | Requires Python setup | ✓ |
| Confirms which subdomains are live | Wordlist only | ✓ | Certificate records only |
| Works entirely offline once loaded | ✓ | Needs network access | Needs network access |
For a quick, honest starting wordlist before you run a real DNS check, the Online Tool Store Subdomain Finder gets you the candidate list instantly.