Paid plans are open on issued.live: Basic at $39 a month, Plus at $99 and Pro at $199. Basic opens the extended record on the website and the daily domains and DNS files. Plus adds lookups by address, certificate and public key through the API, and all five daily datasets. Pro adds sweeps across the whole corpus, a second concurrent advanced query and certificate lookup in the permanent archive.
issued.live reads the public Certificate Transparency logs, resolves DNS from seven vantage points and loads ICANN zone files. It records certificates exactly as logged and collects nothing by connecting to a subject's host.
Free covers the public record for any domain with no account and no key: certificate, issuer, certificate expiry, hosting address and current DNS, plus the domain's registration and expiry dates and its registrar. The same URL answers as JSON, Markdown or a web page. The cap is 1,000 requests a day per client address, resetting at 00:00 UTC.
What each plan gets
Basic, at $39 a month
Basic runs at 60 requests a minute with no daily cap, and carries the domains and DNS daily files in csv.zst. It also opens the extended record on the website for any domain you look up: certificate internals, DNS per vantage point, the full address history and the domain timeline.
A Basic key reaches the daily files and the public record API.
Plus, at $99 a month
Plus runs at 300 requests a minute and serves the extended record and the timeline through the API. It suits a hunter working one lead at a time: an address, a certificate, a name.
Reverse IP and CIDR return every hostname our resolvers have recorded answering at an address or a range, with first-seen and last-seen times and an observed count. These observations begin in August 2026.
Pivots by certificate and SPKI return the other names on a certificate and everything sharing a public key, with key-reuse coverage from September 7, 2026. Every certificate reports its JA4X fingerprint, and JA4X has no pivot because a search on one value would return a third of all Let's Encrypt certificates.
The timeline lists every dated event for a domain in order, with the gap since the previous event and a precision of exact, day or observed. A gap between two observed events measures our scan schedule, so filter on precision before fingerprinting.
Plus takes all five datasets as daily files: domains, dns, dns_vantage, certificates and address_history. It runs one advanced query at a time.
Pro, at $199 a month
Pro runs at 1,200 requests a minute and adds the sweeps. Pattern search finds registrable domains whose names fit a pattern, across the whole corpus. The grammar, its limits and an example response are covered on tuxxin.com: Pattern search on issued.live finds domains by the shape of their names. Batch lookup answers up to 500 domains in one call. Two feeds page by cursor: newly registered domains, and provisioning, which lists domains registered, certificated and resolved inside one window.
Pro takes the same five daily files as Plus and runs two advanced queries at once. It is the one plan whose certificate lookups reach the permanent archive once a certificate leaves the 48-hour live window.
Request formats, pagination and error codes for every keyed endpoint are in the Pro API reference.
Concurrency slots
Advanced queries are bounded by how many run at once on your account: one on Plus, two on Pro. Each paid account holds one API key, so the count per key and per account is the same. The per-minute rate applies to the public record API, and the slots bound the advanced queries.
Five endpoints take a slot: reverse IP, range, pattern search, batch lookup and the provisioning feed. The certificate, key, domain and timeline endpoints and the newly registered domains feed are point lookups and take none. Another customer's traffic never consumes your slots, and keyed calls through the issued.live MCP server draw on the same slots as HTTP calls.
A cold reverse-IP range query can read hundreds of millions of rows and hold its database connection for close to 18 seconds. Enough of those at once would take the whole connection pool and the memory behind it, and every other request on the site would stall. When every slot on your account is busy, a new request waits up to five seconds for one and then times out, because an unbounded queue would turn one slow query into a pile-up. The same cost caps a range at 256 addresses, an IPv4 /24.
The four plans side by side
| Capability | Free | Basic | Plus | Pro |
|---|---|---|---|---|
| Price a month | $0 | $39 | $99 | $199 |
| Rate | 1,000 a day per address | 60 a minute | 300 a minute | 1,200 a minute |
| Public record for one domain | Yes | Yes | Yes | Yes |
| Registration and expiry dates, registrar | Yes | Yes | Yes | Yes |
| Extended record and timeline on the website | No | Yes | Yes | Yes |
| Extended record and timeline by API | No | No | Yes | Yes |
| Reverse IP, CIDR and the certificate and SPKI pivots | No | No | Yes | Yes |
| Pattern search, batch lookup and the feeds | No | No | No | Yes |
| Certificate lookup in the archive, past 48 hours | No | No | No | Yes |
| Daily files | None | Domains and DNS | All five | All five |
| Full weekly snapshot | No | Domains and DNS | All five | All five |
| File downloads a day | None | One per file | One per file | One per file |
| Advanced queries in flight | None | None | One | Two |
| API keys on the account | None | One | One | One |
| Published SHA-256 checksums | Yes | Yes | Yes | Yes |
| Ad-free pages, sign-in and billing | No | Yes | Yes | Yes |
The daily files
Files come in two kinds: a daily delta of what changed, and a full weekly snapshot for seeding a new system. Every paid plan gets the snapshot for the datasets it covers. The domains, dns, dns_vantage and address_history files ship as csv.zst, and certificates ships as Parquet. JSON copies were withdrawn on September 23, 2026. Generation starts at midnight US Eastern, and the datasets publish one at a time over the following hours.
You can download each file once a day, an allowance shared between the download page and your key that resets at 00:00 UTC. A free Sample link beside a file on the download page returns its header and five real rows, and a daily checksums.txt needs no key, so anyone can verify a file they already hold.
How long each dataset is kept
Full certificate rows are queryable live for 48 hours, then age out of the live database. Every closed UTC day is archived as Parquet and kept indefinitely. On Pro, the same certificate endpoint searches that archive when a lookup misses the live window, in seconds where live lookups take milliseconds. Interactive archive coverage begins September 9, 2026.
Storage cost sets the window length. Certificates are the one dataset stored as raw observations; the others hold state plus deltas. We costed a 13-month hot window at about 3.6 TB, roughly four times the whole disk, and declined it.
Daily files stay on the download page for 14 days, counting today, and every file published is archived permanently, starting with the files for September 17, 2026. DNS change history runs 18 months, and the current DNS answer is held for as long as the name resolves. Registration data, address history and the reverse-IP index have no expiry. The about page carries the full retention table.
When Free or another service fits better
Free covers anyone reading a handful of domains a day from a shell, with no key to manage.
Anyone asking what a certificate looked like in 2019 should use crt.sh, which answers that for free. Registrant contact details and long whois histories come from other services, and we collect neither. The comparison page weighs issued.live against AllZonefiles.io, Domains-Monitor, WhoisXML API and crt.sh, and says where each of them wins.
Billing and sign-in
Plans bill monthly in advance through PayPal subscriptions and renew automatically. An active, unbroken subscription keeps its price, and a price change takes effect only at a renewal after notice by email. Cancel any time in PayPal, and access runs to the end of the period you have paid for. Part-months are not prorated or refunded.
Sign-in is passwordless: a six-digit code arrives by email, and signing in opens the page that manages your key and billing. You can rotate your API key at any time. A paid plan licenses the data for internal use while the subscription is active, and publishing findings and excerpts is allowed. Redistributing the bulk files, or a substantial part of them, as a dataset is prohibited.
The feature matrix and the subscribe buttons are on the pricing page.
Updated September 25, 2026, to match issued.live's pricing, about, compare, downloads, terms and login pages and the developer documentation. More about the author.
Top comments (0)