What makes an OSINT tool worth using?
Four things, and vendors usually advertise only the first two. We learned this from our own engine, which runs 71 sources against an email address and 8 against a phone number: the second number is the one worth publishing.
- It names its sources. A result you cannot trace is a result you cannot defend, and anything you might have to justify later has to survive the question of where it came from.
- It reports the empty checks. A tool that only shows hits leaves you unable to tell a source that found nothing from a source that never ran.
- It is honest about age. Public data goes stale. A finding without a date is a finding you cannot weigh.
- It fails loudly. Sources break constantly. A tool that silently drops a broken source reports a thinner result as a complete one.
Free covers more than people assume. Most of what a paid platform returns is available free if you run six tools by hand and merge the output yourself. What you buy is the merging, the report and the hour.
What are the best OSINT tools for email addresses?
DetectiveCheckBest for a full email report
Runs 71 sources against a single address — account existence, breach corpora, domain records and public profiles — and merges them into one report that lists every source it checked, including the ones that came back empty. Built for people who are not investigators, so the report opens with the answer and keeps the evidence underneath it.
- Identifiers
- Email, phone, username, name, photo, password
- Sources on email
- 71
- Price
- From $15/month
- Free tier
- Sample report, no account
Good at
- Every source shown, including the empty ones
- Findings carry a source and a confidence rating
- Export to PDF, CSV and JSON
Weak at
- Phone coverage is thin next to email — 8 sources against 71
- No API yet
- Not usable for employment or tenancy decisions under the FCRA
Have I Been PwnedBest free breach check
The reference for breach exposure, and the one tool on this list that essentially everything else defers to. Paste an address and get the breaches containing it with dates and a description of what leaked in each. Free for a single address through the web form.
- Identifiers
- Email, phone, password
- Coverage
- 900+ breaches
- Price
- Free (API from $3.95/month)
- Free tier
- Unlimited web searches
Good at
- Authoritative and well maintained
- Dates every breach, so you can weigh a finding
- Notifies you of future breaches for your own address
Weak at
- Breach data only — no accounts, no profiles
- Cannot show which password leaked, by design
- API is paid and rate-limited
Hunter.ioBest for work email addresses
Maps a company domain to the email pattern its staff use, and verifies whether a given address at that domain exists. Built for sales prospecting, which makes it unusually good at the one OSINT question of confirming that a work address is real before you rely on it.
- Identifiers
- Email, domain
- Best at
- Corporate domains
- Price
- Free tier, paid from $34/month
- Free tier
- 25 searches/month
Good at
- Reliable verification for corporate addresses
- Reveals the naming pattern behind a domain
- Clean API
Weak at
- Nearly useless for Gmail and other free providers
- Free tier runs out fast
- Sales-shaped data, so coverage skews to companies that sell
What are the best OSINT tools for usernames?
A username is the strongest identifier most people have and the one they guard least. People reuse handles across a decade of services without thinking about it, which makes username search the highest-yield check in this list.
SherlockBest free username search
Checks a username against 400+ sites and prints where it exists. Command-line, open source, no account, no limits. The default first move for handle research and the tool most others measure themselves against.
- Identifiers
- Username
- Sites checked
- 400+
- Price
- Free, open source
- Runs on
- Python, any OS
Good at
- Very wide coverage for free
- Scriptable, so it fits into a larger workflow
- Actively maintained
Weak at
- False positives on sites that return 200 for any profile
- Command line only
- Confirms existence, not that it is the same person
MaigretBest username depth
A fork of the same idea that went further: 2500+ sites, and it pulls profile details from the pages it finds rather than only confirming a hit. Slower than Sherlock and worth the wait when the handle is the whole case.
- Identifiers
- Username
- Sites checked
- 2500+
- Price
- Free, open source
- Output
- HTML, PDF, JSON
Good at
- Widest coverage of any username tool
- Extracts profile details, not just presence
- Generates a readable report
Weak at
- Slow — a full run takes minutes
- More false positives, simply from checking more sites
- Noisy output that needs reading
Certificate logs and breach corpora are infrastructure: authoritative, dated, and free to query.
What are the best OSINT tools for domains and infrastructure?
crt.shBest free subdomain discovery
Searches public certificate transparency logs. Every TLS certificate issued gets logged publicly, so searching the logs for a domain reveals subdomains the owner never advertised — staging servers, internal tools, old hosts still resolving. Free, no account.
- Identifiers
- Domain
- Source
- Certificate transparency logs
- Price
- Free
- Account
- Not required
Good at
- Finds subdomains nothing else will
- Authoritative — a certificate authority really issued each one
- Historic, so it shows what used to exist
Weak at
- Raw output with no interface to speak of
- Nothing about who owns the domain
- Certificates for hosts long dead still appear
ShodanBest for exposed services
Indexes internet-connected devices and the services they run. Point it at a domain or an IP range and it reports open ports, software versions and banners. The standard tool for the question of what a target actually exposes.
- Identifiers
- Domain, IP
- Indexes
- Ports, services, banners
- Price
- Free tier, paid from $69 once
- Free tier
- Limited results per query
Good at
- Unmatched for infrastructure exposure
- Historic data on paid plans
- Good API and filters
Weak at
- Scan data lags reality by days or weeks
- Free tier is genuinely restrictive
- Nothing about people — infrastructure only
Wayback MachineBest for what was deleted
Archived copies of pages going back to 1996. The tool for a page somebody took down or quietly edited: staff listings, old contact details, a removed bio, prices before they changed.
- Identifiers
- URL, domain
- Archive depth
- Since 1996
- Price
- Free
- Account
- Not required
Good at
- Recovers deleted and edited pages
- Shows how a site changed over time
- Free with no limits worth mentioning
Weak at
- Coverage is patchy and unpredictable
- Rarely captures anything behind a login
- Owners can request removal
Reverse image search, and what it misses
Google LensBest reverse image search
The strongest general reverse image search, and the starting point for checking whether a profile photo belongs to the person using it. A stock photo or a borrowed portrait usually surfaces on the first page.
- Identifiers
- Image
- Best at
- Stock photos, landmarks, objects
- Price
- Free
- Account
- Not required
Good at
- Largest index of any reverse image search
- Very good on objects, places and products
- Free and instant
Weak at
- Deliberately weak on matching faces
- Struggles with cropped or filtered images
- No metadata analysis at all
For the metadata rather than the picture, a photo report reads what the camera wrote inside the file: the make, the timestamps, and the GPS coordinates when they are still there. Social networks strip that on upload, so an image saved from Instagram will be clean — but a file sent directly, over email or a messaging app that preserves originals, very often is not. DetectiveCheck's photo analysis does this in the browser without uploading the file anywhere.
What free technique beats most paid tools?
Google dorks are search operators, not a tool, and nobody sells them. They are them, which is roughly why they stay underrated: a precise query reaches documents that no crawler-based product has indexed, because the document was never linked from anywhere a crawler goes. A PDF sitting on a council website, a conference attendee list, a spreadsheet left in a public folder.
Google dorksBest free technique
Not a tool — a way of querying search engines precisely. site: restricts to a domain, filetype: to a document type, and quotes force an exact match. site:linkedin.com "jordan blake" "logistics" does in one query what a lot of paid platforms charge for.
- Identifiers
- Anything
- Cost
- Free
- Learning curve
- An afternoon
- Works on
- Google, Bing, DuckDuckGo
Good at
- Free and immediately available
- Finds documents no crawler-based tool indexes
- Transfers to every search engine
Weak at
- Rate limits and CAPTCHAs on heavy use
- Only reaches what the engine has indexed
- Results shift as the index does, so runs are not reproducible
How do the best OSINT tools compare?
| Tool | Identifier | Price | Best at |
|---|---|---|---|
| DetectiveCheck | Email, phone, username, name, photo | From $15/mo | A full merged report |
| Have I Been Pwned | Email, phone, password | Free | Breach exposure |
| Sherlock | Username | Free | Fast wide handle search |
| Maigret | Username | Free | Deep handle search |
| Google Lens | Image | Free | Reverse image search |
| crt.sh | Domain | Free | Subdomain discovery |
| Shodan | Domain, IP | Free tier | Exposed services |
| Hunter.io | Work email, domain | Free tier | Corporate addresses |
| Wayback Machine | URL, domain | Free | Deleted pages |
| Google dorks | Anything | Free | Precise search |
Read down the identifier column rather than the price one. The question that decides which tool you need is what you are holding, and almost every real piece of work uses three or four of these rather than one.
Notice how little the price column explains. Six of the ten are free outright, and the two strongest results in most investigations — a username hit and a breach record — come from tools that cost nothing. Paying buys breadth in one query, not a better answer to a narrow one.
Free or paid: which do you actually need?
Free tools do more than the paid ones would like you to believe. Sherlock, crt.sh, Have I Been Pwned, the Wayback Machine and a well-built search query cover a large share of what most people need, and none of them cost anything.
What paid tools sell is not secret data. It is the aggregation — one query instead of six, merged and deduplicated, in a report you can hand to somebody else. If you run one lookup a year, that is not worth paying for. If you are doing this weekly, the hour you save each time is the entire product.
Be suspicious of exclusive sources. Any tool claiming data nobody else has is either reselling a broker file of unknown age or scraping something it should not be. Public means public; there is no premium tier of public.
Is using OSINT tools legal?
Searching public sources is lawful. The restrictions land on what you do with the result, and they are stricter than the phrase publicly available suggests.
In the United States, using any of this to decide employment, housing, credit, insurance or tenancy falls under the Fair Credit Reporting Act, and consumer lookup services are not consumer reporting agencies. In the EU and the UK, public personal data is still personal data and still needs a lawful basis under the GDPR. Everywhere, sustained unwanted contact is harassment regardless of how you found the address.
Two practical consequences follow. Keep a note of why you ran a search, because a lawful basis you cannot describe afterwards is one you did not have. And treat scraping terms as real: a source being visible in a browser does not mean an terms permit collecting it automatically, and that distinction is where most OSINT trouble actually starts.
Common questions
What is the best OSINT tool in 2026?
There is no single best tool, because the right one depends on the identifier you are starting from. For email, DetectiveCheck for a merged report and Have I Been Pwned for breach exposure. For usernames, Sherlock or Maigret. For domains, crt.sh and Shodan. For images, Google Lens. Most real work uses three or four together.
What are the best free OSINT tools?
Sherlock and Maigret for usernames, Have I Been Pwned for breaches, crt.sh for subdomains, the Wayback Machine for deleted pages, Google Lens for images, and Google dorks as a technique. Together they cover most of what a paid platform aggregates; what you give up is having it merged into one report.
Are OSINT tools legal to use?
Yes, searching publicly available sources is legal. Restrictions apply to use: in the US, decisions about employment, housing, credit, insurance or tenancy fall under the Fair Credit Reporting Act and are not permitted with consumer lookup services. In the EU and UK, processing public personal data still requires a lawful basis under GDPR.
What does OSINT stand for?
Open Source Intelligence. Open source here means openly available information rather than open source software: published records, public profiles, court filings, certificate logs, archived pages and anything else a person can lawfully access without special permission. The term comes from military and intelligence work, where it distinguishes what can be read in the open from what requires a source, a warrant or an intercept.
Do OSINT tools tell the person I searched for them?
No. These tools query public sources and public endpoints. They do not send messages, friend requests or password resets, and nothing about the search reaches the subject. The exception is anything you do yourself afterwards, such as viewing a profile on a platform that shows viewers.
What is the difference between OSINT and a background check?
A background check is a regulated product built on court, credit and employment records, sold for permitted purposes under the FCRA. OSINT is unregulated research across openly available sources. The distinction matters legally: an OSINT report cannot be used for hiring or tenancy decisions, however thorough it is.
Which OSINT tool is best for finding social media accounts?
Sherlock or Maigret if you have a username, since both check hundreds of platforms for that handle directly. If you only have an email address, an account-existence check across services is the route, because many platforms confirm through their sign-up or password-reset flow whether an address is registered.
Can OSINT tools find someone's home address or phone number?
Not from public sources. Home addresses are not published against names or emails in any general public record, and services claiming otherwise are reselling data broker files of unknown age and accuracy. Phone numbers appear only where the owner has published them, such as a business listing.
How accurate are OSINT tools?
It varies by source type. Certificate logs, breach corpora and account-existence checks are highly reliable because they come from authoritative systems. Inferred details — a guessed name, a probable employer, a matched face — are much weaker. Any tool worth using marks which is which.
Do I need to know how to code to use OSINT tools?
For some of them, yes. Sherlock and Maigret are command-line tools that need Python installed. Have I Been Pwned, crt.sh, Google Lens, the Wayback Machine and hosted platforms need nothing beyond a browser, and cover a large share of the same ground.
