--- updatedAt: 2026-10-28T18:04:15.000Z agentTools: projectIndex: https://docs.censys.com/llms.txt --- # Feature and Data Access Tiers Censys offers tiered data and feature access solutions for a wide range of users, from hobbyists to enterprise security teams. All users have a Censys Free account that offers basic internet visibility, access to basic protocols and certificates, and limited web property data such as root endpoints. To access more detailed data that provides deeper insights, you must upgrade to a higher tier account. Each tier builds upon comprehensive internet scanning data, offering progressively deeper scan results and context about assets and their importance to security workflows. Censys offers four main tiers: Censys Free, Censys Starter, Censys Search, and Censys Core. These tiers are often referred to as plans, levels, or entitlements. There is a Starter Pro sub-tier that offers more credits, tags, and collections than the Censys Starter tier. Censys Search and Core are enterprise-grade offerings. Additional modules and add-ons, like the Adversary Investigation module and the Critical Infrastructure module, are available to Censys Core customers to address specific use cases. Any Censys Free user may upgrade their account to the Censys Starter tier by purchasing a Censys Starter subscription. To gain access to Censys Search or Censys Core enterprise level-data and features, contact our Enterprise Sales team. If you encounter data with a lock icon next to it, you must upgrade or switch to an upgraded account to access it. Upgrading your account unlocks this data and provides enhanced security insights. You can see a list of data that is available and unavailable to you on the Data Definitions page in the Platform console. You may see the following image or a similar one when attempting to access a feature that is unavailable to your tier.

## Overview The following tables explain which data and features are available to each Platform tier. ### Data access | Data feature | Censys Free | Censys Starter | Censys Search (enterprise) | Censys Core (enterprise) | | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Basic protocols and data (HTTP, RDP, SSH, telnet, and more - 41 protocols total) | Yes | Yes | Yes | Yes | | Basic context data (software product and vendor information, and more) | Yes | Yes | Yes | Yes | | Labels | Yes | Yes | Yes | Yes | | Host DNS and WHOIS information | Yes | Yes | Yes | Yes | | Advanced protocols and protocol data (MQTT, IPP, and more - over 140 protocols) | Visible on records but not searchable | Most protocol data is visible and searchable; some data is only available in higher tiers or additional modules | Almost all protocol data is visible and searchable; some data is only available in additional modules | Almost all protocol data is visible and searchable; some data is only available in additional modules | | Additional context data (software and hardware and component CPE values, version data, life cycle information, and more) | No | No | Yes | Yes | | Host history | No | 7 days | 31 days or more, depending on access level purchased | 31 days or more, depending on access level purchased | | Host enrichment API | No | No | No | Yes | | Certificate data including extensions, chains, ZLint data, and more | Certificate data is visible but not all is searchable | All certificate data is visible and searchable | All certificate data is visible and searchable | All certificate data is visible and searchable | | Host and web property CVE and risk data (CVE IDs, KEV presence, and more) | No | No | No | Yes | | Root (`/`) and non-root (`/account/login`, `/admin/login.html`, for example) endpoint data | Yes | Yes | Yes | Yes | | HTTP redirect chain data for host services and web properties | Visible but not searchable | Visible but not searchable | Visible and searchable | Visible and searchable | | Deep application scan data for Cobalt Strike, Kubernetes, Elasticsearch, and more | No | No | Yes | Yes | | Threat data | No | No | No | Censys Core users can view some threat data on host and web property records; to search and pivot across threat data, users must have access to the Adversary Investigation module | | Open directory data and threats | No | No | No | Yes - with Adversary Investigation module | | JARM fingerprints and context hashes (JARM, JA4X, JA3S, and more) | No | No | No | Yes - with Adversary Investigation module | | ICS protocols and screenshots | No | No | Yes - with Critical Infrastructure module | Yes - with Critical Infrastructure module | | CVE vulnerability data | No | No | No | Yes | | Active DNS | No | No | Yes | Yes | | Active DNS history | None - feature not available | None - feature not available | 31 days or more, depending on access level purchased | 31 days or more, depending on access level purchased | ### Features | Feature | Censys Free | Censys Starter | Censys Search
(enterprise) | Censys Core
(enterprise) | | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------- | :--------------------------------------------------- | :--------------------------------------------------- | :----------------------------------------------------------------------- | | API access | Yes - lookup endpoints only | Yes | Yes | Yes | | Single sign-on (SSO) | No | No | Yes | Yes | | Additional organization users | No | No | Yes | Yes | | Regular expression in query syntax | No | Yes | Yes | Yes | | Censys Assistant | Yes - assistant prompt responses may consume credits | Yes - assistant prompt responses may consume credits | Yes - assistant prompt responses may consume credits | Yes - assistant prompt responses may consume credits | | Censys Query Assistant | Yes | Yes | Yes | Yes | | Matched fields for search results | Yes | Yes | Yes | Yes | | Download search results in CSV format | No | No | Yes | Yes | | Pages of search results (100 per page) | 1 | 5 | Unlimited | Unlimited | | Maximum concurrent actions | 1 | 1 | 25 | 25 | | Host reputation score | No | No | No | Yes - plus additional data available with Adversary Investigation module | | Collections | 1 with a maximum of 100 assets | 2 (Starter)
4 (Starter Pro) | 10+ | 15+ | | Webhooks | No | Yes | Yes | Yes | | Live Rescan | No | No | Yes | Yes | | Live Discovery | No | No | No | Yes - with Adversary Investigation module | | Tracked Threats page | No | No | No | Yes - with Adversary Investigation module | | Investigation Manager | No | No | No | Yes - with Adversary Investigation module | | CensEye automated pivoting tool | No | No | No | Yes - with Adversary Investigation module | | Certificate history timeline | No | No | No | Yes - with Adversary Investigation module | | Web screenshots (including extracted text data) | No | No | Yes | Yes | | MCP Server | Yes | Yes | Yes | Yes | | Suspicious Directory threat, open directory metadata, and open directory UI | No | No | No | Yes - with Adversary Investigation module | | AI Investigations | No | No | No | Yes - with Adversary Investigation module | | Tags | No | 10 (Starter)
25 (Starter Pro) | 1,000 | 1,000 | | Comments | No | Yes | Yes | Yes | ## Tier information ### Censys Free The Censys Free tier is designed for preliminary security investigations and is useful for testing Platform functionality. Users can search and view basic protocols and services, but some protocols and their attendant data are excluded. Basic host, web property, and certificate information is searchable and viewable for Censys Free users. To search for additional certificate fields and view historical host data, you must upgrade to a paid tier. Censys Free users are limited to 1 page of 100 results. ### Censys Starter If you purchase a Censys Starter subscription, your account is upgraded to the Starter tier, granting you additional internet visibility and actionable insights. Starter tier accounts are limited to a maximum of 500 results per search query, with 100 results shown per page. ### Censys Search and Censys Core (enterprise plans) Both of these tiers include all of the features of the Censys Starter tier. Vulnerability data is not available to the Censys Search tier, but is available to the Censys Core tier. Both tiers offer full protocol data access and advanced internet visibility provided by deep application scanners. This allows you to search and view protocols, services, web applications, and view 31 days of host history, excluding industrial control system (ICS) protocols. Censys Search and Core search results include all CPE-based fields and provide access to unlimited paginated results. Censys Core customers may view some threat data, but cannot search and pivot off of it. To see complete threat data and search and pivot across it, you must have access to the Adversary Investigation module, which may be purchased by Censys Core customers. Threat data is not visible to Censys Search customers. Censys Core customers may purchase access to Critical Infrastructure data separately.