01 · Product name
Censys
Search internet-wide host and certificate data.
Published by Censys.
In short
Censys scans the public internet and lets you search hosts and certificates. It is the other major internet-scan index beside Shodan, with a reputation for certificate and host data born out of University of Michigan research. Censys Search has a free tier with limits. Higher volume, the platform, and the API are paid.
Product pricing strategy
02
Free and paid
Censys is free to start and paid when you need more. The free tier is the on-ramp. Volume, locked filters, private scans, or an API are what paid plans usually add. Confirm the current split on the vendor site. This listing does not invent a dollar amount.
There is a free search tier with query limits. Platform access, larger historical data, and serious API use are paid. Confirm the current plan on censys.com.
Utility and features
03
Censys answers “what is on this address, and which certificate was presented?” with data from its own scans. That makes it a check on Shodan rather than a duplicate tab. Hosts, services, and certificate fields are the objects. The query language is specific. A sloppy keyword search wastes the free quota and returns noise.
- Hosts and certificates. Search hosts by service and location data, or certificates by names and issuers. The two indexes answer different questions.
- Free tier. Enough to learn queries and to check a lead. Automated collection and large exports sit on paid plans.
- How it differs from Shodan. Overlap is real. Coverage, query style, and which host was seen yesterday will not match. Cite the dataset you actually used.
Use it when the lead is an IP, a certificate name, or a service fingerprint. Use Shodan when you already think in banners and product strings. Neither dataset is complete, and both are delayed relative to a scan you run today against a network you own. The academic history of the project does not make the commercial terms academic — read the current free-tier limits before you build a workflow on them.
- 1
Open Censys Search and read the query examples before you spend credits.
- 2
Look up an address or certificate name you are allowed to research.
- 3
Compare one result with Shodan and write down what only one of them saw.
- 4
Move to the API when the web query is stable, not before.
Caveats
04
Censys is an internet scan index, strongest on hosts and certificates. Data is from Censys’s collection, so freshness is whatever their last scan of that address was. A host can be missing because it was not scanned, firewalled, or gone.
Free search is not the platform or the API. Paid tiers change the volume. Searching the index is not authorization to connect to the service. Honeypots and shared hosting make a single IP a bad unit of blame.
Screenshots
05
Potential use cases
06
- An IP showed up in a log you are allowed to analyze. Search Censys for the host. You get services and certificates from Censys’s scans, with timestamps, not a live probe you just ran. Pivot the same IP to Shodan and read whether the banners agree. If they do not, write both observations and the dates. Do not ‘verify’ by scanning the host because the two indexes disagreed.
- A brand moved sites and you need certificates that still name the old name. Search the certificate data. The output is certs and the hosts that presented them. Pivot a hostname you recognize into a passive Amass list to see if it is still delegated. A certificate name is not proof the company still operates that host.
- You are teaching host-level OSINT without anyone running an internet scan. One IP, one host page, one comparison with Shodan. The lesson is the difference between an index and a scan you perform. The free search tier is limited. Higher volume and the API are paid. This listing does not invent the current quota.
Hard cases
The case where the first result is easy to over-read.
The certificate name is a CDN, not the brand
The cert contains the brand and also a hosting provider’s names. The host page is a shared front. Do not list every name on the certificate as the company’s infrastructure. Note the name that matched, the issuer, and the timestamp, then pivot only the names that also appear in the company’s own DNS. Shodan may show a different banner on the same IP for the same reason: many customers, one address.
Questions
Is Censys free?
There is a free search tier with query limits. Platform access, larger historical data, and serious API use are paid. Confirm the current plan on censys.com.
Can I use Censys instead of an authorized scan?
You can use it to see prior public scan data. It does not replace an authorized assessment of a private network, and it does not permit attacking hosts you find.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Censys home
https://censys.com/Product
Censys Search
https://censys.com/product/censys-search/Pricing
Censys pricing
https://censys.com/resources/pricing/