key:value tokens in the search bar. They work the same in the console and in the API’s q parameter. The query syntax page explains how tokens combine.
In the console you can also use the filter buttons under the search box (Provider, Status code, First seen, Email, Favicon hash, Exposed keys). Each opens a list of options: clicking one adds it to the query or removes it, and a typed value is added with Apply or Enter. Your choices show as chips in the search bar that you can remove one by one. The search runs when you press Search or Enter, so setting several filters costs one search. Status code offers the four classes and a field for codes, such as 451, 522. On Plus, Exposed keys offers any key type and a field for key types, which suggests the ones found so far; on Free the button is greyed, since filtering by keys is a Plus feature. The buttons write the same tokens you could type, so a search built either way can be shared as a link.
Values are lower-cased before matching. A value the filter cannot read (a non-numeric status, a
lastSeen: or firstSeen: without < or >, or with a window too large to represent) is ignored or searched as text; it never errors. In the API’s query field an ignored value is gone, and a value searched as text comes back as you sent it, with the free text at the start of query, so it can read like a filter. A window that applies always comes last in query, after every other filter, with < or >, a whole number of at least 1 and a unit of h, d or w, and is at most 15,250 weeks (about 292 years): q=acme lastSeen:7d echoes acme lastSeen:7d (text, no < or >), and q=lastSeen:<30501w echoes lastSeen:<30501w (text, too large).
domain:
domain:acme.com finds every app tied to acme.com. A bare acme.com does the same. See Domain search for what “tied to” means and why comma-separated domains must all match.
provider:
provider:<slug> restricts results to one hosting platform; provider:vercel,netlify to either. Slugs are lower-case and listed on the providers page. An unknown slug matches nothing.
status:
status:<code> matches the HTTP status from the last render or fallback request that got an answer; a bot-wall page shown to the scanner does not change it. Comma-separate to accept several. A class, 2xx to 5xx, matches every code in it, and mixes with codes: status:4xx,503 is any 4xx or 503. A class counts as one term toward the query limit.
has:creds
has:creds keeps only apps with at least one verified credential, one the scanner confirmed as live with its issuer. has:emails keeps only apps showing at least one email address. has:creds,emails asks for both.
creds:
creds:<detector> narrows has:creds to verified credentials from specific detectors, such as creds:anthropic or creds:anthropic,groq. Detector names are case-insensitive. The Exposed keys button lists every detector found in the index with its count. Like has:creds, it is a Plus filter.
email:
email:<value> matches on the email addresses found on the page. A value with an @ is an exact address; a value without one is a domain, and matches any address on it.
faviconHash:
faviconHash:<hash> matches apps serving a favicon with that hash. The hash is the same one Shodan, Censys, and FOFA use, so a value from those tools works here. Clicking a favicon in the console runs this search for you. See Finding clones.
lastSeen:
lastSeen: filters on the last seen time, Periphery’s last visit that did not prove the host dead, whether or not the host answered (see Reading an app page). It is not the time the snapshot was captured. lastSeen:<7d keeps apps seen within the last 7 days; lastSeen:>2w keeps apps not seen for more than 2 weeks. Units are h (hours), d (days), and w (weeks). You can give one lower and one upper bound; a second bound of the same kind replaces the first. A window over about 292 years (15,250 weeks), such as lastSeen:<30501w, is too large to represent and is searched as text.
firstSeen:
firstSeen: filters on the first seen time, the first visit that got an answer from the host, even an error status. Use it to see what is new: acme.com firstSeen:<1w lists the apps tied to acme.com that Periphery saw for the first time this week. It takes the same <N / >N values and units as lastSeen:.