<!-- Source: https://issued.live/pricing -->
issued.live
 /
 Pricing

# Pricing

Free lookups with no account. Paid plans lift the daily cap, add the daily
 data files, and unlock the extended record on every domain page. Above that, what separates
 them is how much of the corpus you can sweep at once.

 See the extended record
 Certificates with their keys and JA4X fingerprints, DNS per vantage point and the
 full address history -- what every plan unlocks, public on one domain.
 View the example →

## Look things up, take the files

Read the public record, and download the daily domain and DNS files. No
 advanced queries on either of these.

## Free

You look up domains one at a time, or from a script.

 $0

- The public record for any domain: certificate, issuer, expiry, hosting address
 and current DNS

- 1,000 requests a day per address, no account and no key
- JSON, Markdown or a web page from the same URL
- No daily data files
- No search, pivots or reverse IP
- No extended record

 Read the docs →

## Basic

You need the domain and DNS corpus in bulk.

 $39/month

- No daily cap. 60 requests a minute
- Daily data files for domains and DNS, csv.zst and json.zst
- The **extended record on the website** for any domain you look up:
 certificate internals, DNS per vantage point, full address history

- Registration and expiry dates, registrar
- No reverse IP, pivots or search: those start at Plus
- No Pro datasets as files

 Subscribe — Basic

## Hunter plans

Everything above, plus the **advanced queries** — reverse IP,
 pivots, pattern search, batch. Those are bounded by how many you may run at once on
 your key rather than by the per-minute cap, and that is what separates these two.

## Plus

You work leads one at a time: an address, a certificate, a name.

 $99/month

- Everything in Basic, at 300 requests a minute
- **Reverse IP and CIDR**: every domain on an address or a range
- **Pivots** by certificate, SPKI or JA4X: the other names on a
 certificate, everything sharing a key

- The **extended record by API**, not only on the website
- Domain timeline by API: every dated event with the gap between them
- **1 advanced query in flight** on your key
- No pattern search or batch lookup
- No Pro datasets as files

 Subscribe — Plus

## Pro

You run collection: sweep the corpus, take the feeds, hold the files.

 $199/month

- Everything in Plus, at 1,200 requests a minute
- **Pattern search** across the corpus, and **batch lookup**
 of up to 500 domains in one call

- The **newly registered domains** and **provisioning**
 feeds, cursor-paged

- **Daily files for DNS per vantage point, certificates and address
 history** — the three datasets Basic and Plus do not get in bulk

- **2 advanced queries in flight** on your key

 Subscribe — Pro

## Compare

Weighing us against another service? The
 [comparison page](/compare) covers AllZonefiles.io, Domains-Monitor,
 WhoisXML API and crt.sh, including where each of them is the better choice.

 Features
 Basic API response
 Pro API response

| | Free | Basic | Plus | Pro |
|---|---|---|---|---|
| Limits |
| Requests a day | 1,000 | no cap | no cap | no cap |
| Requests a minute | n/a | 60 | 300 | 1,200 |
| API keys on the account | No | 1 | 1 | 1 |
| Lookups and records — one domain at a time |
| Public record API | Yes | Yes | Yes | Yes |
| Registration and expiry, registrar | Yes | Yes | Yes | Yes |
| Current DNS records | Yes | Yes | Yes | Yes |
| Extended record on the website | No | Yes | Yes | Yes |
| Certificate internals, on a domain you look up | No | Yes | Yes | Yes |
| DNS per vantage point, on a domain you look up | No | Yes | Yes | Yes |
| Full address history, on a domain you look up | No | Yes | Yes | Yes |
| Domain timeline on the website | No | Yes | Yes | Yes |
| The extended record by API | No | No | Yes | Yes |
| Domain timeline by API, with `gap_seconds` | No | No | Yes | Yes |
| Pivot by certificate, SPKI or JA4X, by API | No | No | Yes | Yes |
| Advanced queries — bounded by concurrency, not by the per-minute cap |
| Reverse IP and CIDR: what resolves to an address | No | No | Yes | Yes |
| Pattern search across the corpus | No | No | No | Yes |
| Batch lookup, up to 500 domains in one call | No | No | No | Yes |
| Provisioning feed | No | No | No | Yes |
| Newly registered domains, cursor-paged | No | No | No | Yes |
| **In flight at once, on your key** | No | No | **1** | **2** |
| Downloads — the daily files, by dataset |
| Domains | No | Yes | Yes | Yes |
| DNS | No | Yes | Yes | Yes |
| DNS by vantage point | No | No | No | Yes |
| Certificates | No | No | No | Yes |
| Address history | No | No | No | Yes |
| Full weekly snapshot | No | the datasets on your plan | the datasets on your plan | all five |
| Formats | No | csv.zst and json.zst | csv.zst and json.zst | csv.zst and json.zst |
| Download allowance | No | 1 per file per day | 1 per file per day | 1 per file per day |
| Published SHA-256 checksums | Yes | Yes | Yes | Yes |
| Account |
| Sign-in, billing page | No | Yes | Yes | Yes |
| Ad-free, every page | No | Yes | Yes | Yes |

`GET /github.com` on the free or Basic plan.

```
{
  "domain": "github.com",
  "registered": "2007-10-09T18:20:50Z",
  "expires": "2026-10-09T18:20:50Z",
  "ssl_expires": "2026-12-26T23:59:59Z",
  "ssl_cert": "9F53ECDDF913AFBA5678C924A95149D2",
  "ssl_issuer": "Amazon",
  "ip": "140.82.113.4",
  "last_update": "2026-09-14T08:07:30Z",
  "first_cert_seen": null,
  "tracked": false,
  "first_zone_seen": null
}
```

`GET /api/v1/domain/github.com` on Pro. Abridged: the real
 response carries every certificate and address, not one of each.

```
{
  "domain": "github.com",
  "record": { ... every field from the Basic response ... },
  "addresses": [
    { "ip": "140.82.113.4",
      "first_seen": "2026-08-05T19:16:00Z",
      "last_seen":  "2026-09-12T04:26:55Z",
      "observed": 2, "current": true }
  ],
  "certificates": [
    { "serial": "0a1b2c...", "spki_sha256": "e3b0c442...",
      "ja4x": "2bab15409345_2bab15409345_a475d2a3f9e8",
      "issuer_org": "Amazon", "subject_cn": "github.com",
      "key_alg": "RSA", "key_bits": 2048,
      "signature_alg": "SHA256-RSA",
      "sans": ["github.com", "www.github.com"],
      "san_count": 2, "wildcard": false,
      "ct_logs_seen": 3,
      "valid_from": "2026-09-01T00:00:00Z",
      "valid_until": "2026-12-26T23:59:59Z" }
  ],
  "counts": { "addresses": 22, "certificates": 6 }
}
```

## Limits, and why they are set where they are

The API and the files are metered differently because they cost us different things.

| Limit | Value | Reason |
|---|---|---|
| Free daily cap | 1,000 requests per address, resetting at 00:00 UTC | Enough for an interactive visitor or a small script. It stops one scraper
 monopolizing a shared backend. |
| Paid rate limit | 60 a minute on Basic, 300 on Plus, 1,200 on Pro | Paid plans have no daily cap. The per-minute ceiling smooths bursts, and it is the
 nudge toward the files: paging an API for the whole corpus is slower for you and
 more expensive for us than one download. |
| Advanced API concurrency | 1 request in flight on Plus, 2 on Pro | A cold reverse-IP range query can read hundreds of millions of rows and hold its
 database connection for the better part of 18 seconds. Ten of those at once would
 exhaust the connection pool and the memory behind it, and every other request on
 the site would stall. The cap keeps one account from doing that. Over the limit a
 request waits briefly, then returns a timeout rather than queueing. |
| File downloads | One download per file per day | Each file is generated once a day. Re-downloading is the main way bulk access gets
 expensive, and this keeps the price flat for everyone. |

Every capped response carries its own state in the
 `X-RateLimit-*` headers, and a `Retry-After` when you are over. See the
 [API documentation](/developers#limits).

If a limit genuinely blocks legitimate work, [tell us](/contact).
 These are sized to protect the service, and we would rather adjust one than lose the use case.

## Daily files

Generated once every 24 hours as `csv.zst` and `json.zst`. Fetch them
 with your API key as a bearer token, so they drop straight into a cron job with no browser
 and no session.

Two kinds: a daily delta of what changed, and a full snapshot for seeding a new system. The
 delta is what most people run on. Files stay on the download page for 14 days; every file we
 publish is archived permanently, so the 14-day certificate window in the API is a working
 window rather than the life of the data. The
 [daily file reference](/developers/files) lists every column. The corpus currently holds
 **439,829,922** domains, so re-reading all of it to find the day's changes
 wastes time on both sides.

A sample row for every dataset, and what is published right now, are on
 [Downloads](/downloads).

## Billing

Monthly through PayPal. There is no password: you sign in with a code sent to your email,
 and manage your key and billing from there. The files are listed publicly at
 [Downloads](/downloads). Cancel any time in PayPal; the billing page
 follows within minutes. Access runs to the end of the period you have paid for. See the
 [terms](/terms).

---

issued.live, operated by Tuxxin LLC. Source: https://issued.live/pricing