Every registrar's search box checks one name at a time, and it logs what you type — which is exactly why serious domain hunters avoid it for brainstorming. Paid APIs (WhoisXML, DomainTools) solve bulk checking but start around $19/month and keep query logs. There is a third way: RDAP, the public JSON successor to WHOIS, called directly from your browser.
Registries like Verisign (.com/.net), Google Registry (.dev/.app/.page), Identity Digital (.io/.ai/.me), CentralNic and Radix expose RDAP over HTTPS with permissive CORS headers. An HTTP 200 means the domain is registered; a 404 means it is not in the registry. Because CORS is open, a plain web page can call these endpoints directly — no backend, no API key, no proxy.
com and dev to so and ly), and new gTLDs are discovered via the live IANA registry map.For ICANN-contracted gTLDs an RDAP 404 is authoritative. Some ccTLDs have less reliable RDAP, so a good tool corroborates with DNS (NS lookups over DNS-over-HTTPS) and reports probably available instead of overpromising. And remember: availability is a snapshot — a name can be registered seconds after you check it.
RDAP is the registries' own public interface, and bulk use is fine when rate-limited: per-registry spacing, exponential backoff on HTTP 429, and honoring Retry-After. Google Registry, for example, is capped near one request per second.
Source code (MIT): github.com/WhiteBite/Domain-Hunter