Censys Pricing and Censys Alternative: Plans, API Credits and What the Work Really Costs

Censys does not publish a price for any of its three platform plans. Every plan routes through sales, and the only public number is a credit package starting at $100. A free account gets 100 credits a month, where a lookup costs 1 credit and a standard search costs 5. If you need a figure before a sales call, that is the honest answer.

Below is what each plan includes, what the credits actually buy, where Censys is the right purchase, and when a passive, report-first tool with a price on the page does the job your team is really being asked to do.

See pricing

Competitors named.
Described from published terms.
Our own limits stated.
Nothing here is sponsored.

Censys pricing, in one paragraph.

Censys sells three platform plans, Core, Adversary Investigation and Security Operations, plus separate Attack Surface Management and government offerings. None of them has a published price. The Core and Adversary Investigation plans are sold for five or more users, Security Operations for unlimited users, and all three quote through a sales conversation. Individuals and small teams buy prepaid credits instead, with packages starting at $100.

That structure tells you who Censys is built for. A security operations center with a threat hunting function and a procurement cycle can run a scoping call and negotiate an annual contract. A risk manager who needs to screen one vendor this week, or a deal team that needs a cyber view on a target before the letter of intent, usually cannot.

Censys is genuinely better at this

Internet-wide host and service data, certificate attribution at scale, historical scan data and adversary infrastructure hunting. If your question is which hosts on the internet look like a known attacker server, Censys answers it and we do not.

The artifact a report-first alternative produces.

Declare a scope, run a domain and read what comes back. Every finding carries the raw record, the endpoint it came from and the UTC moment it was retrieved. Nothing connects to the subject, and it takes a domain, never a person.

It runs in your browser. Queries go to public DNS and RDAP endpoints, not through us.
Nothing reaches the subject. The domain you enter is never contacted, probed or scanned.
A domain, never a person. There is no input on this panel that accepts an individual.
Findings carry their evidence. Raw record, source endpoint and the UTC moment of retrieval.

Domain footprint sweep

passive collection only

1. Declare the scope stamped on the report

I am authorized to assess this domain, and I am collecting only from public sources.

2. Subject domain

Samples:

Every finding will carry four things

1 Severity. What the record means for the decision in front of you.
2 The raw record. Exactly as the source returned it, unedited.
3 The source endpoint. The request that produced it, so it can be re-run.
4 The UTC retrieval time. Records change. Without this it is an assertion.

Reads dns.google and rdap.org from your browser. Nothing is sent to the domain you enter.

Tick the authorization box, then run the sweep. Enter the domain you are authorized to assess, then run the sweep. Run the sweep. The report lands here.

Censys plans compared: Core, Adversary Investigation, Security Operations.

What Censys lists on its own pricing page for each platform plan. Prices are absent because Censys does not publish them.

	Core	Adversary Investigation	Security Operations
Built for	Analysts triaging alerts on IPs, domains and certificates	Threat hunting and CTI teams tracking adversary infrastructure	Enterprises using Censys data across triage, IR, intel and detection
Users	5 or more	5 or more	Unlimited
Enrichment API calls	20,000 a day, unlimited as an add-on	20,000 a day, unlimited as an add-on	Unlimited
Data history	1 month or more	3 months or more	12 months or more
Collections	15 or more	15 or more	Unlimited
Threat data	Limited reputation score access	Full threat data search, CensEye	Full feature access
Published price	Contact sales	Contact sales	Contact sales

Built for

Core: Analysts triaging alerts on IPs, domains and certificates
Adversary Investigation: Threat hunting and CTI teams tracking adversary infrastructure
Security Operations: Enterprises using Censys data across triage, IR, intel and detection

Users

Core: 5 or more
Adversary Investigation: 5 or more
Security Operations: Unlimited

Enrichment API calls

Core: 20,000 a day, unlimited as an add-on
Adversary Investigation: 20,000 a day, unlimited as an add-on
Security Operations: Unlimited

Data history

Core: 1 month or more
Adversary Investigation: 3 months or more
Security Operations: 12 months or more

Collections

Core: 15 or more
Adversary Investigation: 15 or more
Security Operations: Unlimited

Threat data

Core: Limited reputation score access
Adversary Investigation: Full threat data search, CensEye
Security Operations: Full feature access

Published price

Core: Contact sales
Adversary Investigation: Contact sales
Security Operations: Contact sales

Taken from Censys's own pricing page and its credits documentation. Censys changes packaging often, so confirm the current terms with Censys before you sign.

What Censys credits cost you in practice.

The credit model is the only self-serve route into Censys, so it is worth doing the arithmetic before you buy a pack.

The free allowance

A Censys Free account receives 100 credits a month. Unused credits expire at the end of the month, and once they run out, credit-consuming features stop until the next allocation or a purchase.

What each action consumes

Censys documents the rates: an entity lookup is 1 credit, a standard query is 5, a query using regular expressions is 8, and each further page of results, applied filter or generated report costs 5 to 8. So 100 free credits buy 100 host lookups, or 20 plain searches, or roughly a dozen regex searches with a second page of results.

Buying credits

Any credit purchase moves an account to the Starter tier, which unlocks regex queries and a broader data set. Purchased credits stay valid for 12 months. Packages start at $100, and Censys does not publish a per-credit rate for larger packs.

Where the budget goes

For an investigation that pivots a lot, credit spend is hard to forecast, because the number of searches depends on what the first search finds. That is fine for a hunting team with an annual contract. It is awkward for a procurement reviewer who has to state a cost per vendor screened. Compare that with flat plans on our pricing page, where the unit is a case, not a query.

Censys alternative: how a passive, report-first tool compares.

The two are shaped for different questions, so the table shows where each wins, including where Censys is clearly the better buy.

	Censys	Osintpro
Starting question	Which hosts, services and certificates on the internet match this	What can be established about this named organization
Collection method	Internet-wide scanning plus certificate and DNS indexes	Passive reads of public records only: RDAP and WHOIS, DNS and mail posture, certificate transparency, registries
Touches the subject	Its scanners connect to hosts	No. The domain is never contacted or probed
Native output	Search results, JSON over the API, collections	A report exported as PDF or DOCX
Evidence on a finding	Observation record with scan time	Raw record, source endpoint and UTC retrieval time
Scope record	Not part of the model	Declared before collection, stamped on the report header
Who runs it unaided	An analyst fluent in the query language	A risk, procurement or deal reviewer on a first case
Pricing	Plans through sales. Credit packs from $100	$149, $449 or $1,190 a month, or $1,488, $4,488 and $11,880 a year
Smallest team it sells a plan to	Five users on Core, or credits for an individual	One seat on Analyst
API	Enrichment API on every plan	API access on Practice
Threat hunting and historical host data	Best in class	Not what we do. If this is the need, buy Censys.

Starting question

Censys: Which hosts, services and certificates on the internet match this
Osintpro: What can be established about this named organization

Collection method

Censys: Internet-wide scanning plus certificate and DNS indexes
Osintpro: Passive reads of public records only: RDAP and WHOIS, DNS and mail posture, certificate transparency, registries

Touches the subject

Censys: Its scanners connect to hosts
Osintpro: No. The domain is never contacted or probed

Native output

Censys: Search results, JSON over the API, collections
Osintpro: A report exported as PDF or DOCX

Evidence on a finding

Censys: Observation record with scan time
Osintpro: Raw record, source endpoint and UTC retrieval time

Scope record

Censys: Not part of the model
Osintpro: Declared before collection, stamped on the report header

Who runs it unaided

Censys: An analyst fluent in the query language
Osintpro: A risk, procurement or deal reviewer on a first case

Pricing

Censys: Plans through sales. Credit packs from $100
Osintpro: $149, $449 or $1,190 a month, or $1,488, $4,488 and $11,880 a year

Smallest team it sells a plan to

Censys: Five users on Core, or credits for an individual
Osintpro: One seat on Analyst

API

Censys: Enrichment API on every plan
Osintpro: API access on Practice

Threat hunting and historical host data

Censys: Best in class
Osintpro: Not what we do. If this is the need, buy Censys.

When a Censys alternative is the right purchase, and when it is not.

You need a price before a call

Budget holders screening vendors or targets often need a number to approve the tool at all. Censys quotes plans through sales. Our plans are on the page and Analyst opens with a card.

The deliverable is a document

If the work ends in a vendor file, a deal memo or an insurer questionnaire, search results still need triage, sourcing and writing up. A case platform produces the report as its output.

You may not touch the target

Pre-authorization work on an acquisition target or a prospective vendor often has to stay passive. Record-based collection never sends traffic to the subject's infrastructure.

You are one to three people

Core and Adversary Investigation are sold for five users and up. A single analyst or a small risk function either buys credits or pays for seats nobody uses.

Do NOT switch for hunting

Tracking command-and-control servers, fingerprinting adversary infrastructure or searching exposed services across the internet is Censys territory. We would lose that comparison.

Do NOT switch for exposure discovery

If you need to find unknown listening services on your own estate, a scanner sees what a records tool cannot. Pair it with our attack surface management from public records rather than replacing it.

Censys pricing questions buyers ask.

Censys does not publish a price for its Core, Adversary Investigation or Security Operations plans, which are all quoted through sales. The only public figure is prepaid credits, with packages starting at $100. A free account gets 100 credits a month, and a standard search costs 5 credits.

Censys has a free account with 100 credits a month. Those credits expire at month end and cover lookups at 1 credit each and searches at 5 to 8 credits. When the allowance runs out, credit-consuming features stop until the next month or until you buy credits, which moves the account to the Starter tier.

API access comes with the plans rather than as a separate price list. Core and Adversary Investigation include 20,000 Enrichment API calls a day with an unlimited add-on, and Security Operations includes unlimited calls. None of those plans has a published price, so API cost is part of the quote Censys gives you.

Censys Attack Surface Management is sold separately from the platform plans, and its pricing is custom through the Censys sales team. There is no published per-asset or per-domain rate. Budget for an annual contract and ask how discovered assets are counted, because that usually drives the figure.

Yes. Free monthly credits expire at the end of each month if you do not use them. Credits you purchase stay valid for 12 months from purchase. Buying any amount of credits moves the account from Censys Free to the Starter tier, which also unlocks regular expression queries.

Yes. A passive tool builds findings only from records the organization already published, such as RDAP and WHOIS registration, DNS and mail authentication records, certificate transparency logs and corporate registries. Nothing connects to the host, so it can be run before authorization is signed and leaves no trace on the subject's systems.

Plenty of teams keep Censys and add a case platform.

A scanner and a records tool answer different halves of the same review.

The arrangement that works: Censys, or Shodan, for internet-wide host data and hunting, where an analyst needs to know what is listening and where. A case platform for anything a signature depends on, where each finding must carry its evidence and the output has to make sense to a reader who never saw the query.

If Shodan is also on your shortlist, the Shodan pricing and Censys vs Shodan comparison covers that pair in detail. The best OSINT tools comparison maps the rest of the category, and buyers pricing an acquisition review should read the cybersecurity due diligence software page next.

More comparisons and alternatives

New to the category? Start with open source intelligence, then see how a scoped case runs or read the analyst notes on the blog.

Run one scoped sweep and see what a sourced finding looks like.

The demo is free, it takes a domain and never a person, and it produces the same evidence chain the paid report does.

See how a case runs

Passive collection only, from public sources.
A domain, never a person. There is no input for one.
Your case data stays yours. No card required.