Are free subdomain registries safe?

A free subdomain is not a small version of a domain. It is a different arrangement. When you register example.com, a registrar holds your record and ICANN-accredited rules govern how it can be taken from you, with a dispute process and a transfer window. When you claim yourname.runs-on.dev, one company owns the registered domain and has added a row pointing part of it at you. There is no registrar between you and them, and no dispute process beyond their own.

That is not automatically bad. It is how js.org has run since the 1990s and how is-a.dev runs today, both with large active user bases. But it means the question is not "is this a scam" — for the established registries it plainly is not — it is "what specifically am I exposed to, and does it matter for what I am putting here."

This is the test that separates a serious free subdomain registry from a hobby one, and it is the one no operator volunteers, because the honest answer is often uncomfortable. Ours is.

Browsers need to know where one site ends and the next begins. Without help, a browser has no way to tell that alice.example.com and bob.example.com belong to strangers rather than to one organisation. The Public Suffix List is how it finds out: a domain listed there is treated as a boundary, so each subdomain under it becomes its own site for cookie scope and for safe-browsing reputation.

The consequence when a registry is NOT on the list is specific and worth stating plainly. If one subdomain on the apex serves a phishing page and a browser vendor flags it, the flag can attach to the apex, and every other name underneath it can inherit an interstitial warning that its owner did nothing to earn. Cookie isolation is similarly weaker.

Note the second half of that: getting onto the list is not instant even once accepted. The list is compiled into browser releases, so there is a lag of weeks to months between a merged entry and the protection being real in the browsers your visitors use. Treat any registry's claim of being "on the PSL" as a question about when, not just whether.

How to check for yourself, for any registry, in about thirty seconds: open the raw list at publicsuffix.org and search it for the apex domain. If the bare domain appears on its own line, it is listed. This is a fact about a public file, not a claim you have to take from the operator.

Every free registry reserves the right to reclaim names, and they have to. A registry that cannot recycle abandoned names fills up with dead claims and stops being useful to anyone. The meaningful difference between registries is not whether they can revoke, it is whether a revocation leaves a record a stranger can audit.

Git-backed registries — where each claim is a file in a public repository and every change arrives as a pull request — make this checkable. Removing a name means deleting a file in a commit with an author and a timestamp. You cannot quietly un-person someone; the history shows what was removed, by whom, and when. A registry run from a private database offers you the operator's word instead.

Our own terms are deliberately blunt about this, and you should read any registry's equivalent before claiming: names are free, dormant names come back into circulation, and impersonation, phishing, malware and illegal content forfeit a name on sight without warning. The reason is in the same document — the company that registered the apex answers for everything served underneath it, so abuse gets removed quickly rather than carefully.

This is the risk with no mitigation, and any operator who tells you otherwise is selling something. If the company holding the registered domain stops paying for it, every name underneath goes dark together. There is no escrow, no transfer, and no registrar to appeal to, because you were never the registrant.

What you can do is size the risk honestly before you depend on it. Three questions, in order of how much they tell you:

For the registry we operate, those answers are: every claim is a JSON file in a public repository under an open licence; the apex is held by Advance Labs Inc., federally incorporated in Canada; and the project is young, which is the honest weak point of the three. A registry launched in 2026 has no renewal track record, and js.org's decades of it is a genuine advantage we cannot manufacture.

Less than people fear, and differently than they expect. Search engines treat a subdomain on a shared apex as its own site for ranking purposes in most cases, which means you neither inherit the apex's authority nor are dragged down by it. You start from nothing, the same as a new domain would.

The real costs are two, and neither is a ranking penalty. First, links you earn accrue to a name you do not own, so if you later move to your own domain you are rebuilding from zero unless the operator will serve a redirect for you. Second, and increasingly the bigger one, an AI answer engine deciding whether to cite you is making an entity-trust judgement, and a free subdomain is weaker evidence of a real organisation than a registered domain with matching business records.

If the thing you are putting on the subdomain needs to be cited by name — a company, a product, anything commercial — that second cost is the one that matters, and it is worth the price of a domain. If it is a personal project, a demo, or a developer portfolio, it is not.

Is runs-on.dev safe?

It is operated by Advance Labs Inc., a federally incorporated Canadian company, and every claim is a public file in an open-source repository, which makes revocations auditable and the registry data portable. Two honest caveats: it launched in 2026, so it has no long renewal track record, and as of 2026-10-02 it is not yet on the Public Suffix List, while js.org and is-a.dev are. Suitable for portfolios, demos and side projects; not suitable for anything commercial, printed or contractual.

What is the safest free subdomain registry?

On the one measure that is a matter of public record rather than operator assurance — presence on the Public Suffix List, which keeps one subdomain's bad behaviour from damaging the others — js.org and is-a.dev are both listed and most newer registries are not. Beyond that, prefer any registry whose claims are public files in a public repository, because that makes revocation auditable and the data portable if the operator disappears.

Can a free subdomain be taken away from me?

Yes. Every free registry reserves the right to reclaim names, both for abuse and for dormancy, and you have no registrar or dispute process to appeal to because you are not the registrant. The practical rule is to never put anything on a free subdomain whose URL you cannot afford to change.

Does using a free subdomain hurt my SEO?

There is no ranking penalty — search engines generally treat a subdomain on a shared apex as its own site, so you start from zero rather than being dragged down. The real costs are that any links you earn accrue to a name you do not own, and that AI answer engines weigh a free subdomain as weaker evidence of a real organisation when deciding whether to cite you by name.