Expiry Checker

No sign-up, no tracking, lookups go straight to public registries

See when your domains and SSL certificates expire

Paste a list of domains to get each expiry date, registrar, status codes and nameservers from the official registry, plus the newest SSL certificate from public logs. Then add renewal reminders to your calendar in one file.

Up to 50 names. Web addresses are fine, only the name is used. For a subdomain such as blog.example.com, the registration of example.com is shown, and the certificate of the subdomain itself.

Check
Remind me days before expiry

Used for the calendar file. Each reminder becomes its own event at 9:00 your time.

What this tool checks

Two dates decide whether a website keeps working: the day the domain registration runs out, and the day the SSL certificate that gives it the padlock runs out. Miss the first and the site and its email stop working, and someone else can register the name. Miss the second and visitors see a full-page security warning. This page finds both dates for a whole list of names at once and turns them into calendar reminders.

Where the domain dates come from

Domain details come from RDAP, the Registration Data Access Protocol. It replaced the old WHOIS service at the registries and answers in a standard, machine-readable format. Your browser first reads the official list of RDAP servers that IANA publishes, finds the server for the domain ending, and asks that server directly. No server of ours is in between.

For each domain you get the registrar, the date it was first registered, the expiry date held by the registry, the status codes and the nameservers. Owner names, emails and addresses are not shown: since 2018 most registries withhold them for privacy, in RDAP and in WHOIS alike.

The registry's expiry date is the official one. Some registrars stop a domain a few days earlier when a renewal is not paid, so renew well before the date shown and check the deadline in your registrar account.

What the status codes mean

Every domain carries one or more status codes, written like clientTransferProhibited. Each one is explained next to the domain. The ones you will see most:

  • clientTransferProhibited: a transfer lock set by the registrar. The domain cannot move to another registrar until you unlock it. This is normal protection, not a problem.
  • clientDeleteProhibited and clientUpdateProhibited: protection against the domain being deleted or changed by mistake.
  • active (called ok in WHOIS): nothing pending and no special locks.
  • autoRenewPeriod: the registry renewed the domain automatically when it expired, and the registrar can still cancel that if the renewal is not paid.
  • redemptionPeriod and pendingDelete: the domain expired and is on its way to being released. Act at once if it is yours.
  • clientHold or serverHold: the domain has been taken out of DNS, so the website and email do not work.

Where the certificate dates come from

A web page cannot open a connection to another site and read its certificate. Instead, this tool searches certificate transparency logs: public, append-only records that every trusted certificate authority must write each new certificate to before browsers accept it. The search runs through Cert Spotter's public API and returns the certificates that are valid today for the name, including wildcard certificates that cover it.

The newest certificate is shown first. Because logging happens at issue time, a certificate that was issued but never installed, or that is waiting to replace the current one, also shows up. If the date matters, click the padlock in your browser's address bar on the site itself to see the certificate it really serves. Sites that renew automatically, as most Let's Encrypt and hosting certificates do, often show several overlapping certificates.

Domains are flagged amber with 30 days or fewer left. Certificates are flagged with 14 days or fewer, since automatic renewal usually happens around the 30-day mark.

Calendar reminders without an account

Add to calendar downloads one .ics file holding every date you checked. For each expiry you get an all-day event on the day itself and a separate short event at 9:00 your time for each reminder you picked, such as 30, 14, 7 and 1 days before. Reminders that would fall in the past are left out.

  • Apple Calendar on Mac, iPhone and iPad: open the file and choose a calendar. Each reminder event also sets an alert.
  • Outlook: open the file, or drag it into the calendar. Alerts are set as well.
  • Google Calendar: on a computer, go to Settings, Import and export, and import the file. Google ignores alerts stored in imported files, but the separate reminder events still appear on the right days, and your usual notification settings apply.

Each event has a fixed ID, so importing a newer file into Apple Calendar or Outlook updates the same events instead of doubling them. After you renew, check again and import the new file.

Which domain endings work

Lookups work for every ending whose registry runs RDAP and allows requests from web pages. That covers the large majority, including .com, .net, .org, .io, .co, .dev, .app, .xyz, .ca, .uk, .space, .meme, .info, .fr, .nl and most new endings. Some country registries, such as those for .de, .eu and .jp, have no public RDAP server, and a few registries block browser requests or limit them tightly. For those you get a link to the registry's own lookup instead. A few registries, such as .nl and .au, answer but do not publish expiry dates.

Privacy

There is no account, no analytics and no server of ours behind this page. Your browser sends each domain name straight to the registry that runs it, to IANA for the list of registries, and to Cert Spotter for the certificate search, and nowhere else. Your list of names is kept in this browser's storage so it is ready next time. Clear the list to remove it.

Questions

Is this a WHOIS lookup?

It is an RDAP lookup, the official successor to WHOIS. ICANN retired WHOIS for generic domains such as .com in January 2025 and RDAP is now the authoritative source. It returns the same registration facts people look for in WHOIS: registrar, creation and expiry dates, status and nameservers.

How often can I check?

The certificate search allows about 100 requests an hour from one connection without a key, which is enough for roughly 40 to 50 names. Registries set their own limits. Results are kept in memory for ten minutes, so pressing Check again does not repeat lookups that already worked.

Why does a domain say it is not registered?

The registry answered that it has no record of the name. Check the spelling. If it is right, the domain is probably available to register.

Why do I see several certificates for one name?

Hosting platforms and content delivery networks often hold more than one certificate per name, from different authorities or for different servers, and they renew early. The newest one is usually the one that ends up installed.

Will my domain renew automatically?

Only if auto-renew is turned on at your registrar and the payment card on file still works. This tool cannot see your registrar settings, which is why calendar reminders are worth having either way.