httpx vs subfinder
Which should you use? A side-by-side look at what each one does, who it suits, what it costs, how hard it is to set up, and where each falls short.
Open source · MIT
A command-line tool that quickly checks many web hosts and reports details about each one.
Open source · MIT
Command-line tool that finds subdomains of a website using passive online sources.
The short answer
Choose httpx if you need…
- Security testers doing reconnaissance on lists of hosts they are authorized to test
- Bug bounty hunters who need to filter large lists of subdomains down to live web servers
- Researchers gathering metadata about many websites at once
- Developers who want a scriptable way to check many URLs and pipe results to other tools
Choose subfinder if you need…
- Security testers doing reconnaissance on a domain they are authorized to test
- Bug bounty hunters mapping a target's subdomains
- Researchers doing OSINT on an organization's public internet footprint
- Developers who want a quick list of their own domain's subdomains
Side-by-side
| httpx | subfinder | |
|---|---|---|
| Type | CLI | CLI |
| Price | Free and open source | Free and open source |
| Licence | MIT | MIT |
| GitHub stars | 10.6k | 14.7k |
| Setup difficulty | Intermediate | Intermediate |
| How you get it | Install with a package manager | Install with a package manager |
| Main language | Go | Go |
| Last code update | 4 days ago | 4 days ago |
What each one is
httpx
httpx is a command-line program that sends HTTP requests to a list of hosts, URLs, or IP ranges and reports what each one returns, such as status code, page title, server name, and TLS certificate details. It is built on the retryablehttp library and is designed to stay reliable when many threads run at once. People use it to quickly survey large sets of web servers, for example during security testing or research.
subfinder
Subfinder is a command-line tool that lists subdomains for a given website, such as finding blog.example.com or api.example.com for example.com. It works passively, meaning it queries online data sources rather than directly probing the target's servers. The README describes it as fast, lightweight, and built to do this one job well.
Best for
httpx
- Security testers doing reconnaissance on lists of hosts they are authorized to test
- Bug bounty hunters who need to filter large lists of subdomains down to live web servers
- Researchers gathering metadata about many websites at once
- Developers who want a scriptable way to check many URLs and pipe results to other tools
subfinder
- Security testers doing reconnaissance on a domain they are authorized to test
- Bug bounty hunters mapping a target's subdomains
- Researchers doing OSINT on an organization's public internet footprint
- Developers who want a quick list of their own domain's subdomains
Strengths
httpx
- Fast, with many configurable probe flags covering status, title, TLS, hashes, and more
- Supports hosts, URLs, and CIDR ranges as input and can fall back from https to http automatically
- Includes retries and backoffs intended to handle web application firewalls
subfinder
- Uses passive sources, so it does not directly contact the target's servers, per the README
- Supports multiple output formats including JSON, file, and stdout, and works with pipes
- Has built-in filtering and rate-limit controls
Not ideal for
httpx
- People who want a visual web browser or point-and-click interface, since it is a command-line tool
- Anyone probing systems they do not have permission to scan, because it can generate heavy traffic and is widely used for pentesting
- Users who need to run it as an always-on public service, since the README warns that running it as a service may pose security risks
subfinder
- People who need a full scanner that checks for vulnerabilities, since the README describes only subdomain discovery
- Users who need results without any API keys, because the README says many sources require API keys to work well
- Non-technical users who are not comfortable with a terminal
Trade-offs
httpx
- The README says the project is in active development and may have breaking changes between releases
- Its main purpose is as a standalone CLI tool, and the README cautions about running it as a service
- Some features, such as headless screenshots and certain probes, are off by default and need extra setup or flags
subfinder
- Many sources need API keys, so results are fuller after setup
- Requires go1.26.10 to install from source according to the README, and the README gives no prebuilt install path beyond the linked docs
- Passive sources are third-party data, so results may be incomplete or stale
Getting started
httpx
Install httpx with Go
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latestsubfinder
Install latest version with Go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latestFrequently asked questions
What is the difference between httpx and subfinder?
httpx: A command-line tool that quickly checks many web hosts and reports details about each one. subfinder: Command-line tool that finds subdomains of a website using passive online sources. httpx suits security testers doing reconnaissance on lists of hosts they are authorized to test, while subfinder suits security testers doing reconnaissance on a domain they are authorized to test.
Are httpx and subfinder free?
httpx: Free and open source. subfinder: Free and open source.
Is httpx or subfinder more popular?
subfinder has more GitHub stars (14.7k) than httpx (10.6k). Popularity isn't the same as fit — check which one matches your use case above.
What are other alternatives to httpx and subfinder?
Other options people compare them with include ffuf, Sherlock, HackBrowserData.
Keep comparing
Built from our catalogue entries for both products: open-source details come from each project's README (AI-assisted, refreshed weekly) and GitHub data; AI-tool details are editorial. Spotted something wrong? Let us know from either product's page.