What does OSINT actually mean?
Open source intelligence: reaching a conclusion about something using sources anybody is allowed to consult.
Two words in that sentence get misread constantly. Open does not mean free — a commercial database that anybody may subscribe to is an open source, and a leaked file that circulates privately is not. Intelligence does not mean data. It means a conclusion that somebody can act on, which is why collecting a thousand rows is not intelligence and one dated, corroborated fact often is.
The term arrived from military and government analysis, where it distinguished newspapers and broadcasts from intercepts and informants. It kept the distinction and lost the context: it now mostly describes people looking things up on the internet on purpose.
Why do public sources answer questions about people?
Because answering is a side effect of working, and this is the part almost every definition leaves out.
A sign-up form has to tell you when an address is already registered, or two people end up sharing an account. A password reset has to tell you when it is not, or it sends mail into a void. A company register has to be searchable, or it cannot do the job it was created for.
In each case the disclosure is not a leak or a bug. It is the feature, weighed against a support queue full of people who forgot which address they used.
That is why the discipline is stable. A technique built on a bug dies when the bug is fixed; one built on a service doing its job survives, because stopping would make the service worse.
This is the sentence to keep. OSINT works because the useful parts of the internet have to answer questions to be useful at all. Everything else — the tools, the acronyms, the methodology diagrams — is downstream of that.
What counts as an open source?
Anything a person is permitted to consult without deceiving anybody or using a credential they were not given. That definition is broader than most people expect and narrower than the marketing of this industry.
The list below is ordered by how often a source actually contains something, rather than by how impressive it sounds. The first entry is the one nobody writes about and the one most reports are mostly made of.
- Services that confirm registration. The sign-up and reset behaviour above, across dozens of platforms at once.
- Public registers. Companies, land, courts, sanctions, professional licences. Authoritative, dated, and dull.
- Breach corpora. Files already published and indexed. Legally awkward in places, and the single best evidence that an address is old.
- Published pages. Sites, archives, cached copies, and what search engines kept after the original was deleted.
- Files themselves. A photograph carries camera, software and sometimes coordinates, all written by the device rather than the person.
The lamp reaches what it reaches. Everything behind a login stays where it is, and no tool on the market changes that.
What is OSINT used for?
Four things, and only the first is what most people picture when they hear the word.
Investigation. Journalists placing a photograph, fraud teams checking a counterparty, lawyers finding an asset. Security. Working out what an attacker can already see about a company before they attack it, which is the same search pointed at yourself.
Safety. Checking whether the person you are about to meet has any history at all, which is the commonest use by volume and the least discussed. Self-defence. Running your own identifiers to find what is exposed, which is the only category where nobody else's expectations are involved.
The technique is identical in all four. What changes is who the subject is, and that is what the law and the ethics both hang on.
How is OSINT different from hacking?
By authorisation, not by difficulty, and the line is sharper than the grey area people imagine.
Reading what a service tells any stranger who asks is OSINT. Using a credential you were not given, exploiting a flaw, or persuading somebody to hand over access is not, and the fact that a technique is easy does not move it across the line. Guessing a password is trivial and still unlawful; checking whether an address is registered is a request the service answers by design.
The awkward middle is scraping. A page you may read in a browser is not automatically a page you may collect automatically, because terms of service and rate limits are separate from access. That distinction is where most real trouble in this field actually starts.
What can OSINT not do?
Four things, each of which is sold by somebody, which is exactly why they are worth naming.
The pattern is the same in all four: a real limit gets described as a premium feature, and the reader who paid assumes the limit is theirs rather than the technique's. Knowing where the ceiling is turns a disappointing report into an accurate one.
- See behind a login. A private account's existence is public; its contents are not, and no service that offers them is telling the truth.
- Produce what was never published. If a name was never attached to an address anywhere public, no tool can invent one. It can only guess.
- Prove identity. It shows that identifiers are connected. Who was at the keyboard is a different question, and accounts get shared, sold and stolen.
- Be complete. Every result is bounded by the identifier you started with. A second address you have never seen stays invisible.
Is OSINT legal?
Searching public sources is lawful in the United States and in the EU. What the result is used for is where the law actually lives, and it is stricter than most people assume.
In the United States, using a report to decide somebody's employment, housing, credit, insurance or tenancy puts you under the Fair Credit Reporting Act, and a consumer lookup service is not a consumer reporting agency. In the EU and the UK, personal data stays personal data when it is public, so processing it needs a lawful basis under the GDPR.
Write down why you searched. A lawful basis you cannot describe afterwards is one you did not have. This costs a sentence at the time and is the whole of your position later.
How do you actually start?
With the identifier you already have, because that decides everything else about the result.
An email address reaches 71 sources here and a handle reaches 71 platforms. A name reaches 13 registers and a phone number reaches 8, which is why starting from a number is the commonest wasted afternoon in this field. A photograph is its own case: the file carries what the camera wrote.
Then read what came back empty as carefully as what did not. A source that answered and found nothing is evidence; a source that failed to answer is unknown, and treating the second as the first is how people reach confident, wrong conclusions.
The step most people skip is the second pass. A display name or a handle returned by the first search is a new identifier, and running that usually returns more than the thing you started with.
Where to go next
Each of these takes one piece of the above and goes as far into it as the sources allow, with the real numbers from our own engine rather than round ones.
If you only read one, make it the one matching the identifier you actually hold. Everything in this field follows from that choice, and the guides organised by question are only useful once you know which door you are coming in through.
- By identifier. Email, usernames, phone numbers, names, and photographs.
- By question. Which identifier finds accounts, why platforms answer, and how to check somebody before meeting them.
- Pointed at yourself. What is findable about you and whether a password has leaked.
- Tools. The ranked list and the comparison.
Common questions
What does OSINT stand for?
Open source intelligence. Open means openly available rather than free, so a commercial database anybody may subscribe to counts and a privately circulated leak does not. Intelligence means a conclusion somebody can act on, which is why a thousand collected rows are not intelligence and one dated, corroborated fact usually is.
How does OSINT actually work?
It relies on services disclosing things as a side effect of functioning. A sign-up form must say when an address is already registered, a password reset must say when it is not, and a public register must be searchable to be useful. None of that is a leak or a bug, which is why the technique keeps working year after year.
Is OSINT legal?
Searching publicly available sources is legal in the United States and the EU. Use is restricted: in the US, deciding employment, housing, credit, insurance or tenancy from a lookup falls under the Fair Credit Reporting Act and is not permitted with a consumer service. In the EU and UK, public personal data still requires a lawful basis under the GDPR.
Is OSINT the same as hacking?
No, and the difference is authorisation rather than difficulty. Reading what a service tells any stranger who asks is OSINT. Using a credential you were not given, exploiting a flaw, or persuading somebody into handing over access is not, however easy it happens to be. Guessing a password is trivial and still unlawful.
What are the best OSINT sources?
Ranked by how often they actually contain something: services that confirm whether an identifier is registered, public registers such as companies and courts, breach corpora, published and archived pages, and the metadata inside files themselves. The first is the highest-yield and the least discussed.
Can OSINT find anyone?
No. Every result is bounded by the identifier you started with, so an account opened under a second address you have never seen stays invisible. It also cannot see behind a login, cannot produce a name that was never published anywhere, and cannot prove who was at the keyboard rather than which identifiers are connected.
What is the difference between OSINT and a background check?
A background check is a regulated product: in the United States it falls under the Fair Credit Reporting Act, is run by a consumer reporting agency, and carries dispute rights. OSINT is a method, not a product, and a consumer lookup service is not a reporting agency. The same facts, used for a hiring or tenancy decision, put you under a different law.
Do I need special tools to do OSINT?
No. A search engine, quotation marks and patience cover most of it, and the strongest free tools — Sherlock and Maigret for handles, Have I Been Pwned for breaches, Google Lens for images — cost nothing. What paid tools sell is running many sources at once and merging the answers, which is the hour rather than the technique.
