Certificate Transparency Search

Certificate Transparency logs record every certificate a CA issues. This tool aggregates them and pulls out every hostname that ever appeared on a certificate — a great way to find forgotten subdomains. Primary source is Cert Spotter, with crt.sh (which often falls over) as a fallback. Both are free and key-less.