Is this a live WebSocket stream?

No — it's a periodically refreshed pipeline feed. Public demo WebSocket firehoses for this data have proven unreliable, so this reads the real CT logs directly instead.

No. Certificate Transparency logs are public and key-less — this is one of the few pipeline-fed savers on the site that needs no API key at all.

Is this every new domain?

It's a real sample from two major logs each refresh, not an exhaustive firehose of every certificate issued anywhere.

Yes — free, no download, in your browser.

Why are certificates published openly?

Making issuance public means misissued certificates can be detected by anyone, instead of relying on the authority's honesty. That transparency is the whole point of the system.

Do these domains tell me which sites are safe?

No. A certificate only shows that somebody controlling the name obtained a certificate, which is also easy for attackers. The list is an observation of issuance, not a safety rating.

Domain Pulse Screensaver

The Domain Pulse screensaver scrolls real domains pulled directly from live public Certificate Transparency logs — reading their official API itself, no third-party aggregator or key needed — refreshed periodically by the background pipeline. It's free, runs in your browser, and ESC exits.

How the Domain Pulse screensaver works

A background pipeline reads two major, real CT logs (Cloudflare Nimbus and Sectigo Sabre by default) directly via their public API, with no key required.

Each run picks up where the last one left off and extracts the domain name from every new certificate's SAN field.

New domains trickle onto the screen one at a time from the latest batch, for a "watching it arrive" feel.

CT logs only publish new entries on their own schedule — often hours apart — so a run with nothing new simply keeps showing the last real batch.

What Certificate Transparency logs record

Certificate Transparency is a public auditing system for the TLS certificates that let browsers trust a website. Certificates are submitted to append-only logs, built on Merkle trees so that existing entries cannot be removed or altered without detection. A log returns a signed certificate timestamp as a promise of inclusion, and Chrome and Safari require a minimum number of these timestamps before they accept a certificate, so in practice publicly trusted certificates end up in logs.

The system was started by engineers at Google as a response to attacks on certificate authorities, notably the 2011 compromise of the Dutch authority DigiNotar, which led to more than 500 rogue certificates. The protocol was published as the experimental RFC 6962 in June 2013 and has since been superseded by RFC 9162. Because the logs are open and verifiable, domain owners and researchers can watch them for certificates they never requested, an early warning of mis-issuance or phishing infrastructure.

What the logs reveal is a hostname list, not who owns a site or whether it is trustworthy. A new name appearing means a certificate was requested, which may be a legitimate business, a hobby project or something malicious. The names come from the Subject Alternative Name field of each certificate, so wildcard entries and many subdomains of the same organisation can turn up together.

A worked example

A refresh might surface a real mix — a-small-blog.example, a freshly issued subdomain, a newly launched storefront — each one a genuine certificate the pipeline read straight from the log, not a simulated name.

Settings & tips

Soft tick per entry adds a quiet audio cue as each domain trickles in.
Accent recolours the scrolling text.
Run automation/run.py domainpulse on your pipeline machine to pull a fresh batch.

Frequently asked questions

Is this a live WebSocket stream?: No — it's a periodically refreshed pipeline feed. Public demo WebSocket firehoses for this data have proven unreliable, so this reads the real CT logs directly instead.
Is a key needed?: No. Certificate Transparency logs are public and key-less — this is one of the few pipeline-fed savers on the site that needs no API key at all.
Is this every new domain?: It's a real sample from two major logs each refresh, not an exhaustive firehose of every certificate issued anywhere.
Is it free?: Yes — free, no download, in your browser.
Why are certificates published openly?: Making issuance public means misissued certificates can be detected by anyone, instead of relying on the authority's honesty. That transparency is the whole point of the system.
Do these domains tell me which sites are safe?: No. A certificate only shows that somebody controlling the name obtained a certificate, which is also easy for attackers. The list is an observation of issuance, not a safety rating.

← All Security & Privacy screensavers