Subdomain Permutation Generator
Turn subdomains you already know into likely new names: extra words, number steps, environment swaps and dropped labels.
Runs in your browser Your input never leaves your device.
Names are built in your browser from what you enter. Nothing is looked up or sent. Resolve them only against domains you are authorised to test, with your own tools.
Report a problem with this tool
About this tool
Passive sources such as certificate logs and search engines find the names a target has already published, but teams often run siblings of those names: if api.example.com exists, api-dev, api2 and staging-api are worth checking. This tool takes the subdomains you already know and builds those candidates in your browser, so you can resolve them with your own tooling on scope you are allowed to test. Five methods are available and each can be switched off: a word added as a new label (dev.api.example.com and api.dev.example.com), a word joined to the first label with a hyphen (dev-api, api-dev, and optionally devapi and apidev), number steps (web01 gives web00, web02 and so on, keeping the zero padding; a name without a number gets api1 and api-1), environment swaps (dev becomes test, stage, staging, prod and the rest, also inside names like api-dev) and dropped labels (a.b.example.com gives b.example.com and a.example.com). Input can be plain hostnames, URLs, wildcard entries or host:port lines; they are reduced to the hostname, lowercased and de-duplicated, and IP addresses and invalid names are listed as skipped instead of silently dropped. The root domain is detected for you for common two-part endings such as co.uk and shared hosts such as github.io; for an ending the tool does not know, set the root domain yourself. Words must be valid hostname labels; anything else is reported. The list is capped at the number you choose so the page stays fast. The tool never queries DNS; it only writes text.
How to use it
- Paste the subdomains you already know, one per line.
- Adjust the word list, or keep the common words (dev, stage, api, admin, v2 and more).
- Choose the methods and the number of steps, then press Generate names.
- Copy or download the list and resolve it with your own tools, only for domains you are authorised to test.
Common problems
- The list is far too long
- Use fewer words, switch off methods you do not need, or lower the limit. Most of the volume comes from the word-as-a-label and joined-word methods.
- Some of my lines were skipped
- Open the skipped list under the result. Usually the line is an IP address, has no dot, or has an invalid character in a label.
- It did not find a real subdomain
- This tool only guesses names. Whether they exist is decided by DNS, so resolve the list with a resolver you trust.