Is There a Public CAGE Code List? The Honest Answer

No complete, current, freely downloadable list of every CAGE code exists, and none of the sites offering one are giving you something better than what you could pull yourself from an official source — usually the opposite. That is not a gap in how the data is published; it is a direct consequence of licensing rules on the company information a CAGE record carries, and understanding why is the fastest way to see why a "complete" list would be worse for you than a live one.

Is there a public CAGE code list? Short answer

No single, current, freely downloadable file lists every active CAGE code with company details attached, and nothing legitimate offers one for free. What does exist is a government-published extract of the underlying registration data, gated behind a SAM.gov account and a specific data-access role rather than a plain download link, plus individual lookups that are genuinely free and current. A site advertising an open "CAGE code database" you can just download is either years out of date, is missing the licensed company-identity fields entirely, or is quietly re-publishing data in a way its own source terms do not actually allow.

Why no complete list is published

A CAGE record is not just a five-character code — it is that code paired with a company's legal name and physical address, and on registrations last updated before April 4, 2022, some of that company information is Dun & Bradstreet data licensed to the government for this specific purpose, not owned outright by whoever publishes it next. The terms governing that data allow it to be shown in individual, on-demand lookups with attribution, but not gathered into one file and handed out as a substitute for getting the data from its actual source. That is the specific thing "bulk republishing" means here: not that any one lookup is restricted, but that assembling enough of them together to function as an alternative to the original database crosses a line the individual lookups do not.

That is also why this site's own lookup tool works the way it does: one CAGE code, one live result, on request — never a static page generated in advance for every company in the registration data. A tool that pre-built a page per company would be exactly the kind of bulk assembly the licensing terms are written to prevent, whether or not anyone called it a "list."

What SAM.gov actually publishes, and who can get it

SAM.gov does publish an official Entity Registration extract, and it genuinely is public — it is the one legitimate source behind this data, and this site is built on it. But "public" here means something narrower than "click a link on the homepage and download a file." Getting it requires a SAM.gov account with the correct data-access role approved for Entity Management extracts, at which point monthly and daily files become available: a monthly file processed on the first Sunday of the month containing all active registrations plus anything that expired in roughly the prior six months, and a daily file capturing whatever changed since the last one. That daily cadence recently changed to run every day of the week rather than skip Sundays and Mondays, which is a sign the extract is actively maintained infrastructure, not a static download nobody touches.

None of that is a secret process, and none of it requires paying anyone. It also is not the same thing as a public list, because the access step exists specifically to keep bulk use tied to an identifiable account operating under SAM.gov's terms — including the same restriction on turning the extract into a redistributed company database that applies to everyone else. A third-party site that hands you a CSV of company names and CAGE codes with no login, no terms acceptance, and no attribution obtained that file through this same gated process (or an older, unmaintained copy of it) and is skipping the part of the terms that governs what happens next.

Why an old CAGE list is a real risk, not a formality

The practical reason "just find a downloadable list" is bad advice, independent of the licensing question, is that CAGE and SAM.gov registration data changes constantly and a frozen copy cannot show what has changed since it was made. Registrations require renewal roughly annually to stay active, so a list built even a year or two ago already contains entities that have since let their registration lapse, closed, moved, or re-registered under different details. A copy from a decade ago is not a smaller version of the current data — it is describing a federal supplier landscape that in large part no longer exists.

The sharpest version of this problem is exclusions. A federal exclusion flag — meaning an entity is debarred, suspended, or proposed for debarment from federal contracting — can be added to a registration at any time, and it is exactly the kind of status that changes after a list is generated and stays wrong in every copy of that list from then on. In the current SAM.gov extract this site is built on, 83 entities carry that exclusion flag today. A screening process built on a stale list would show every one of those 83 as a clean, unremarkable registration, because their exclusion happened after the list was frozen. Someone using that old copy to vet a supplier has no way to know the flag exists — the list simply does not contain the information that would tell them, and it looks exactly as complete and confident as it would if the entity had never been excluded at all.

This is also why a stale list is worse than merely "slightly out of date" in the way an old phone book is: a phone book's errors are visible when a number doesn't connect. A CAGE list's errors are invisible. A dead registration, a changed address, or a new exclusion all look identical to an accurate row unless it is checked against the live source, which is the entire function a bulk list cannot perform.

What to do instead, by use case

The honest recommendation depends on how many codes are actually involved, because "I want a list" usually turns out to mean one of three different, more specific needs:

Checking one supplier or one code. Use a live, per-record lookup rather than searching for a list at all — this is what a single CAGE code or company name actually calls for, and it returns current status, registration dates, and exclusion flags rather than a snapshot that may already be wrong. This site's own CAGE code lookup exists specifically for that single-record case.

Checking a batch of suppliers, not the whole database. A reasonable, capped bulk-lookup tool — checking a defined list of codes you already have, rather than trying to enumerate every code that exists — is the compliant middle ground between one-at-a-time and a full database dump, and is the right tool for a supplier-screening list of dozens or hundreds of known entities.

Programmatic or ongoing access. Get your own SAM.gov API key or Entity Management data-access role and pull directly from the government source under your own account and your own acceptance of its terms, rather than depending on a third party's redistribution of it. This is the correct path for a system that needs to check CAGE data on an ongoing basis, not a one-time list.

None of these three answers is "download a file and treat it as the database" — and that is the actual point. The use cases that feel like they need a static list are all better served by something that stays current, because currency is precisely the property a downloaded file loses the moment it is saved.

What third-party "CAGE code list" sites are actually offering

Sites advertising a free, complete CAGE code database are typically doing one of three things, and none of them is "here is a current, complete, freely licensed dataset nobody else has access to." Some are running a live, per-record lookup themselves and just calling it a "list" or "database" in their marketing — which is a legitimate tool wearing a misleading label, not actually a downloadable file. Some are working from an old copy of a SAM.gov extract, sometimes years old, without disclosing how stale it is or attributing where the data came from. And some are attempting the kind of bulk republishing that CAGE and D&B licensing terms specifically restrict, which creates exactly the debarment-blind-spot risk described above, whether or not the operator understands that is what they are doing.

None of these are reasons to avoid third-party CAGE tools generally — a free lookup tool built correctly on current data is a legitimate and useful thing, and is what this site is. The distinction that actually matters when evaluating one is whether it performs a live lookup against current data with a visible freshness date, or hands you a static file and calls it complete.

Current beats complete

A complete-looking list that cannot show today's exclusions, today's expirations, or today's address changes is not actually more useful than a narrower tool that is verifiably current — it is just more convincing at first glance, because nothing about a spreadsheet signals which of its rows have quietly gone wrong since it was made. For CAGE data specifically, where the highest-value field is a status that can change at any time, current is the property that matters, and complete is the property that is impossible to keep true for more than a day.