Fast passive subdomain enumeration — a speed-focused fork of subfinder.
subfaster is a fork of subfinder tuned for one thing: getting a clean, sorted list of subdomains as fast as possible. It keeps subfinder's passive-source engine but changes the defaults, trims the startup cost, and drops weight so a typical run finishes in seconds with no noise.
It installs as its own binary with its own config directory, so it runs side by side with an existing subfinder install without colliding.
- Curated fast sources are the default. A run uses seven fast, keyless sources (
thc,submd,crt,shodanct,rapiddns,hackertarget,sitedossier) instead of every source. Use-allfor the full set, or-fast=falsefor subfinder's original default selection. - HTTP keep-alive. Connections are reused instead of a fresh TCP+TLS handshake per request. Sources that paginate heavily (e.g.
thc) drop from ~32s to ~11s on large domains. - Update check is off by default. subfinder makes a blocking network call to its update registry on every startup (~1s). subfaster skips it, so startup is ~30ms. Re-enable with
-duc=false. - Lower default timeout (10s, was 30s) and Cloudflare-only resolvers (
1.1.1.1,1.0.0.1) for-active, instead of a long list that includes slow resolvers. - Preflight probe on block-prone sources.
sitedossierandhackertargetare checked with a cheap 3s homepage probe first — if your IP is blocked they bail in 3s instead of hanging the whole run to the timeout.
-silentis the default — only subdomains go to stdout. Pass-v(or-silent=false) for logs.- Output is sorted alphabetically.
- No ASCII banner.
- Reorganized, terse
-hwith examples, grouped by importance. - Honest source errors. When a free source hits its quota (
hackertarget) or a captcha (sitedossier), it's reported as an error in-statsinstead of silently returning zero.
- No rate-limit flags.
-rl/-rlsand the rate-limiting engine are gone. crtshis HTTP/JSON only. The crt.sh Postgres backend (and its driver dependency) was removed.- Fixed User-Agent instead of a random one per request.
Dropped direct dependencies: json-iterator/go (→ stdlib encoding/json), lib/pq, corpix/uarand, rs/xid, hako/durafmt, golang.org/x/exp, and the rate-limit library.
subfaster requires go1.24+:
go install -v github.com/melvinsh/subfaster/v2/cmd/subfaster@latestsubfaster -hCommon examples:
# Enumerate one domain (fast sources, only subdomains printed)
subfaster -d example.com
# Many domains from a file, saved to out.txt
subfaster -dL domains.txt -o out.txt
# Resolve and keep only live subdomains, with their IPs
subfaster -d example.com -active -oI
# Use every source (many need API keys, see below)
subfaster -d example.com -all
# JSON output including which source found each subdomain
subfaster -d example.com -oJ -csRun subfaster -h for the full, grouped flag list.
subfaster keeps its own config so it never clashes with subfinder:
- Config directory:
$HOME/.config/subfaster/(config.yaml,provider-config.yaml) - Environment overrides:
SUBFASTER_CONFIG,SUBFASTER_PROVIDER_CONFIG - API keys can also be supplied via
<SOURCE>_API_KEYenvironment variables (e.g.SHODAN_API_KEY).
Many sources (used with -all) require API keys. The provider-config.yaml format is identical to subfinder's — see the upstream post-install configuration docs.
subfaster can be used as a library; a minimal example is in examples/main.go.
subfaster is a fork of subfinder by ProjectDiscovery — all credit for the original tool and its source integrations goes to them and the upstream community (THANKS.md).
Read the usage disclaimer at DISCLAIMER.md.