Download websites that use Keybase

About Keybase

To claim a domain on Keybase, the owner has to publish a signed statement on it and leave it in place. The proof is a file rather than a program, so what a crawler finds is usually that statement, or the profile links that accompany it, rather than an application installed on the server. The platform exists to bind a cryptographic key to identities a person already controls, and a domain is one of those identities. A detection here is closer to a signature left on the door than to a piece of infrastructure.

The distinction changes how the list should be read. A domain here has a human behind it who took a deliberate, public step to prove ownership. The inference is unusually clean: somebody on that site is comfortable with public key cryptography, or wanted a verifiable channel for release signatures, security contacts, press claims or donations, and cared enough to wire it up.

As of September 2026 we see Keybase on 31,961 sites, with United States accounting for 21,042 of them and .com recurring throughout. The tilt toward developer-heavy, English-language domains matches the audience the product was built for. Engineers, security researchers, journalists and privacy-minded users adopted it because they needed auditable identity, not another chat client, and the site owners who bothered with a domain proof are the deepest end of that group.

History matters for interpretation here. First released in 2014 and written in Go under a BSD license, the client stayed open and the protocol stayed inspectable, but Zoom Video Communications acquired the company and visible development slowed afterward. Proofs published long before that acquisition keep working, because a signed file on a web server does not expire on its own. The count therefore includes domains whose owners have not thought about the service in years, which is useful if you are studying persistence and misleading if you read it as current engagement.

Detection also undercounts, and the undercount is structural rather than accidental. A proof placed at a path we do not request, an identity linked only from a social profile, or an account that verifies a domain without publishing anything visible on it will all pass unseen. Treat the figure as a lower bound on a population that is quiet by design.

Checking whether one domain carries a proof is trivial and free. The reverse question is the useful one and cannot be answered that way. Which domains across the internet publish an identity proof of this kind, what else do they run, where are they registered, and how do they cluster by country and suffix. Our export answers that in a single file, with the surrounding stack attached to each row, which is the part no per-domain lookup will ever give you.