# projectdiscovery/subfinder

Fast passive subdomain enumeration tool.

Repository: https://github.com/projectdiscovery/subfinder
Canonical: https://ross.abutalabs.com/products/subfinder
Homepage: https://projectdiscovery.io
Language: Go
License: MIT
License Family: permissive
Topics: subdomain-enumeration, osint, subdomains, bugbounty, reconnaissance, hacking, hacktoberfest
Last push: 2026-08-26T14:22:38+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 87, longevity 100
- inputs: {"age_days": 3077, "days_push": 7, "days_rel": 11, "gap_med": 53, "n_releases_24m": 14}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 14315, forks 1611 (observed 2026-08-28T04:11:06.739068+00:00)

## What it is
Subfinder is a fast, passive subdomain discovery tool written in Go that enumerates valid subdomains for target domains using online passive sources. It is designed for penetration testers and bug bounty hunters, with a modular architecture, STDIN/STDOUT support, and multiple output formats for easy pipeline integration.

## Use cases
- enumerate subdomains of a domain for reconnaissance
- find subdomains for bug bounty targets
- passive OSINT subdomain discovery without touching the target
- build automated recon pipelines with stdin/stdout
- monitor an organization's external attack surface for new subdomains
- feed discovered subdomains into vulnerability scanners like httpx or nuclei

## When to choose
- you need fast, stealthy passive subdomain enumeration without sending traffic to the target
- you want a lightweight CLI that integrates into shell pipelines and automation workflows
- you're a bug bounty hunter or pentester doing initial reconnaissance
- you need JSON or plain-text output for downstream tooling

## When to avoid
- you need active subdomain brute-forcing or DNS resolution at scale - use tools like puredns or shuffledns instead
- you want a full attack surface management platform with continuous monitoring - consider ProjectDiscovery Neo or similar commercial offerings
- you need web application discovery and content crawling rather than just hostname enumeration

## Facets
- artifact type: cli-tool
- maturity: active
- function: osint, security, cli, developer-tools
- domain: security, osint, penetration-testing
- platform: windows, go, cli, cross-platform
- tags: subdomain-enumeration, reconnaissance, bug-bounty, passive-recon, attack-surface, command-line, linux, macos

## Member repositories
- projectdiscovery/subfinder (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:06.739068+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:12:39.300469+00:00, confidence not recorded.
  - readme: https://github.com/projectdiscovery/subfinder (fetched 2026-08-28T04:11:06.739068+00:00, sha 135370b18dde)
  - homepage: https://projectdiscovery.io (fetched 2026-08-29T08:06:15.235772+00:00, sha 4f86254fd766)
  - site_page: https://docs.neo.projectdiscovery.io/ (fetched 2026-08-29T08:06:15.275622+00:00, sha de87e1036abb)
  - site_page: https://docs.neo.projectdiscovery.io/use-cases/attack-surface-monitoring (fetched 2026-08-29T08:06:15.277577+00:00, sha e2b7027938c7)
  - site_page: https://projectdiscovery.io/pricing (fetched 2026-08-29T08:06:15.272954+00:00, sha 155f9d3a4107)
- Data as of 2026-08-30T08:39:29.467469+00:00.