Run a lookup

Guide

Reverse email lookup: who is behind the address

One address in. The accounts registered to it, the breaches holding it, and the name attached to it where a name is public.

9 min read The DetectiveCheck team
EmailOSINTGuide
Envelopes in a sorting tray

The short answer

A reverse email lookup takes an email address and searches public sources for everything registered to it: accounts on services where that address is a login, breach records containing it, the domain it belongs to, and public profiles that display it. It returns what is already public. It does not open anyone's mailbox.

  • Works by asking many services the same question at once: does an account exist for this address?
  • The richest signal is usually account existence, not a name. Names are public far less often than logins are.
  • A breach hit tells you the address is real and dates roughly when it was in use.
  • An empty result is a finding: it usually means a young address, or one used for nothing but mail.

What is a reverse email lookup?

A reverse email lookup is a search that runs backwards. A normal search starts with a person and looks for their address. A reverse lookup starts with the address and looks for the person, by asking every service that might know it whether it knows it.

The word reverse is doing real work there. Nobody publishes a directory of email addresses to names, because there is no such directory to publish. What exists instead is a very large number of services that will each answer one narrow question about an address, and a lookup is the act of asking all of them and putting the answers side by side.

It reads, it does not intrude. Every source in a lookup is one anybody could query by hand. The work being saved is the hours, not the permission. Nothing here reads mail, and no service that offers to is telling the truth.

@one address inAccountsBreach recordsDomain detailsPublic profilesFound nothing@one address inAccountsBreach recordsDomain detailsPublic profilesFound nothing
One address in, and the sources that answer. The dashed one came back empty, which the report still shows you.

How does a reverse email lookup work?

Three stages, and the middle one is where nearly all the information comes from.

Normalising the address. [email protected] and [email protected] reach the same mailbox at Gmail, because Gmail ignores dots and everything after a plus. A lookup that skips this step misses accounts registered under the variant. Not every provider behaves this way, so the normalisation has to know the provider.

Asking every source at once. The address goes to account-existence checks, breach corpora, domain records if it is not a free provider, and public profile sources. These run in parallel because they are independent, and a lookup is only as fast as its slowest source.

Merging and deduplicating. The same fact arrives from several sources in different shapes, and one breach gets reported by three aggregators under three names. Merging is what turns a list of raw answers into a report about a person.

What can you actually find from an email address?

Sorted by how often it is actually there, rather than by how impressive it sounds:

  • Accounts registered to it. The most reliable result by a distance. Many services will confirm whether an address is registered, because their own sign-up and password-reset flows have to.
  • Breach appearances. Which known breaches contain the address, and when. This is the cheapest proof that an address is real and in use.
  • The domain. For anything that is not gmail.com or outlook.com, the domain has its own records: who registered it, when, in which country, through which registrar. A work address hands you the employer.
  • Public profile details. Display name, avatar, and profile URLs where the service publishes them.
  • A name. Sometimes. Less often than people expect, and almost never from a free provider unless the owner has attached the address to something public themselves.
Account-existence checks are the bulk of what a lookup returns, and they run against dozens of services at once.

Account-existence checks are the bulk of what a lookup returns, and they run against dozens of services at once.

Can you find someone's name from their email address?

Sometimes, and the honest answer is that it depends entirely on what the owner has already made public.

An address at a company domain usually gives you a name, because the domain gives you the company and the local part is usually built from the name. r.okonkwo@ at a firm with forty staff is not hard. A Gmail address created in 2011 and used only for mail may have no name attached to it anywhere public, and no tool can invent one.

Anything that promises a name for any address is either guessing from the local part or reselling a data broker's file of unknown age. Both are wrong often enough to matter, and both are confidently wrong, which is worse.

What does an empty result mean?

It is a result, not a failure, and it usually means one of four things.

  • The address is young. Nothing has had time to accumulate. A month-old address has no history to find.
  • It is used for one thing. An address that only ever receives mail is registered nowhere and leaks nothing.
  • It does not exist. A plausible-looking address nobody ever created will come back empty from every source, which is exactly what you would want it to do.
  • It is deliberately clean. An address used with a password manager, never reused, never posted, is supposed to look like this.

Two of those four are useful findings on their own. If you are checking whether an address that contacted you is a real person with a history, an empty report answers the question.

What can a reverse email lookup not do?

Four things, and they are the four people most often arrive expecting. Every one of them is sold somewhere by somebody, which is the reason to be plain about it: a service promising any of these is describing a product that cannot exist from public sources.

  • Read the mailbox. Nothing public reaches the contents of an inbox.
  • Give a home address. That is not attached to an email address in any public source. A service that offers one is selling a broker file, usually years old.
  • Prove who was typing. A lookup describes an address and the accounts on it. It cannot say who was at the keyboard, and an address can be shared, sold or stolen.
  • Recover a password. A breach record shows that a password leaked, which is a reason to change it. It is not a key, and using one would be a crime.

Searching public sources is lawful in the United States and in the EU. What you then do with the result is where the law actually lives, and it is stricter than most people assume.

In the United States, using a report to decide someone's employment, housing, credit, insurance or tenancy puts you under the Fair Credit Reporting Act, and a consumer-facing lookup service is not a consumer reporting agency. That use is not permitted here. In the EU and the UK, personal data stays personal data when it is public, so processing it still needs a lawful basis under the GDPR.

Contacting someone is a separate decision. Finding an address does not make writing to it welcome, and repeated contact after being asked to stop is harassment in most jurisdictions no matter how the address was obtained.

How to run one on DetectiveCheck

Four steps, and the report is the interesting part.

  1. Create an account and open the email lookup.
  2. Paste the address. Variants are normalised, so the form you have is the form to use.
  3. Wait for the sources to answer. Seventy-one sources run against an email address, and slow ones do not hold up the fast ones.
  4. Read the report. Every source is listed, including the ones that found nothing, because a source that came back empty is a fact about the address.

Each finding carries the source it came from and a confidence rating, so a strong signal and a weak one do not look alike on the page. You can see the whole shape of it in the sample report without creating an account.

Common questions

What is a reverse email lookup?

A reverse email lookup is a search that starts with an email address and finds what is publicly registered to it: accounts on services where the address is a login, data breaches containing it, the domain it belongs to, and public profiles that display it. It searches public sources only and never accesses a mailbox.

Is a reverse email lookup legal?

Searching publicly available sources is legal in the United States and the EU. How you use the result is restricted: in the US, using it to decide employment, housing, credit, insurance or tenancy falls under the Fair Credit Reporting Act and is not permitted with a consumer lookup service. In the EU and UK, public personal data still requires a lawful basis under GDPR.

Can I do a reverse email lookup for free?

Partly. Have I Been Pwned (haveibeenpwned.com) checks breach exposure for free, and a search engine query on the address in quotes finds public mentions. What free tools do not do is run account-existence checks across dozens of services at once and merge the results, which is where most of the information in a full lookup comes from.

Can you find someone's name from their email address?

Sometimes. A work address usually gives a name, because the domain identifies the employer and the local part is often built from the name. A free-provider address gives a name only if the owner has attached it to something public. No tool can produce a name that was never made public, and any service promising one for every address is guessing or reselling old broker data.

What information can a reverse email lookup reveal?

Most often: which services have an account registered to the address, which known breaches contain it and when, the domain's registration details if it is not a free provider, and public profile details such as a display name or avatar. A full name and photo appear less often, and only where the owner has published them.

How accurate are reverse email lookup results?

Account-existence checks and breach records are the most reliable, because they come from the service or the breach corpus itself. Inferred details like a guessed full name are the least reliable. A report worth reading marks the difference; treat any result that does not distinguish confirmed from inferred as unverified throughout.

Why did my reverse email lookup come back empty?

Usually the address is recent, is used only to receive mail, was never registered anywhere, or does not exist. An empty result is itself informative: if you are checking whether an address that contacted you belongs to an established person, finding no history at all answers that question.

Can a reverse email lookup find social media accounts?

Yes, where the service confirms that an address is registered. Many platforms reveal this through their own sign-up or password-reset flow. It confirms an account exists on that service under that address; it does not always give the profile URL, and platforms that have closed this behaviour cannot be checked this way.

Does the person get told I looked them up?

No. A lookup queries public sources and the account-existence endpoints that services expose publicly. It does not send mail, friend requests or password resets, and nothing about the search reaches the address owner. The one thing that can reach them is what you do afterwards: opening a profile on a platform that shows visitors, or writing to the address, are both visible actions the lookup itself never takes.

What is the difference between a reverse email lookup and an email verifier?

An email verifier answers one question: will mail to this address be delivered. It is a deliverability check used before sending. A reverse lookup asks who is behind the address, across accounts, breaches, domain records and public profiles. A verifier says the address works; a lookup says what it is attached to.

In short

A reverse email lookup answers what is this address attached to, and it answers that well. Accounts and breach records are the solid part of any result.

It answers who is this person only when the owner has already made that public. Anything promising a name for every address is guessing, and an empty report is often the real answer rather than a failed search.

Written by the DetectiveCheck team

We build the lookup engine this site runs on, so the numbers in these guides are the ones our own reports use: 71 sources against an email address, 71 platforms against a username, 13 registers against a name, and 8 against a phone number. Where a module is thin, we say so rather than round it up.

Run one yourself

Create an account and the first report is a couple of minutes away. Nobody you look up is told.

Create my account

Plans from $15 a month. Cancel in one click. Or read a sample report first.

Try it on something you already have