The 9 Best Email OSINT Tools in 2026 (Free & Paid)

The best email OSINT tools in 2026 fall into three buckets: account-existence checkers (Holehe, Epieos, Mosint), breach and credential databases (Have I Been Pwned, Revealer's breach and stealer-log indexes), and provider-specific enrichment (GHunt for Google accounts, Hunter.io for corporate mail patterns). Nobody has built the one tool that does all three well, which is why working analysts chain them. Sweep the platforms first so you know where the address is registered. Then drop into breach data for passwords, aliases and old usernames. Then spend time only on the leads that actually go somewhere. I rank nine tools here, I say what each one does badly, and I give you the order I run them in.

This is legal, open-source-intelligence work. You are verifying an identity you have a lawful reason to check, investigating fraud, mapping an attack surface you own, or confirming a counterparty before a transaction. You do not need to log into anyone's account.

How to judge an email OSINT tool

Most "best of" lists rank tools by GitHub stars. Stars measure popularity. They do not measure whether the tool helps you close a case. Four things actually matter:

Signal type. Does the tool tell you an account exists, or does it tell you something about the person? Holehe returns "this address is registered at Instagram." A breach index returns "this address appeared in the 2019 Canva set with the display name jmartin84." Those are different classes of evidence. You need both.

Freshness and decay. Account-existence checkers live off password-reset and signup endpoints, and platforms rewrite those constantly. Every registration-check tool I keep around has at least one module that quietly died. Treat a null result as "no answer," never as "no account."

Pivot value. You almost never want the email for its own sake. You want the username, the phone digits, the display name, the profile photo, or the recovery hint that gets you into the next source. A tool that hands you a pivot beats a tool that hands you a clean yes/no.

Operational footprint. GHunt authenticates to Google with your cookies. Holehe hammers signup endpoints from your IP. Know what you are emitting before you point either one at a live subject.

Quick comparison

1. Revealer.US: the aggregation layer

Start here when you want breadth in one query. Revealer's email lookup runs a single address against 800+ platforms, public-records sources and known breach datasets, and returns the registrations, associated identifiers and leaked records in one result set rather than nine terminal windows.

Two things separate it from a scripted sweep: the credential-side data, and the recursion. Breach lookup tells you which datasets contain the address and what fields came with it (the aliases and old usernames that are usually the real pivot). Stealer-log data is a different animal. Infostealer malware logs capture browser-saved credentials and session artifacts from an infected machine, so they can show accounts that no registration checker will ever reveal, because the service has no enumerable signup endpoint. AI Deep Search then runs the pivots for you. It takes an identifier out of the first pass, follows it into the next source, and repeats. That loop is the part of manual OSINT that eats the most analyst hours.

Weaknesses, plainly: it is a hosted platform, so you are trusting a third party with your query, and you cannot read the module source the way you can with Holehe. If the engagement requires everything to run from your own infrastructure, use it as a corroborating source rather than the primary one. Pricing starts free and paid self-serve plans begin at $12.99/mo, with an API if you want it inside your own pipeline.

Revealer is not a consumer reporting agency and its data may not be used for employment, tenant, credit or insurance decisions.

2. Holehe: the reference registration checker

Holehe is the tool most analysts learn first, and for good reason. It queries the "forgot password" and registration flows of a long list of consumer platforms and reports where the address is already in use. One command:

holehe [email protected]

Two habits make it far more reliable. First, run it with --only-used so you are not wading through unused-site noise. Second, treat every negative as unverified. Modules break when a platform changes a response body or adds a bot check, and the failure mode is usually a quiet "not used" rather than an error. If a negative result matters to your conclusion, confirm it by hand.

Holehe also emits requests to real platforms from your address. On a sensitive engagement, run it from infrastructure you do not mind burning.

3. Epieos: fast manual triage

Epieos covers similar ground from a browser, which makes it the right first stop when you have one address and no time to configure anything. The Google-account surface is the standout. For addresses tied to a Google account it can surface the associated profile and public review activity, and that frequently gives you a real name and a rough geography in one step.

The free tier is limited and the paid tiers change; check their site rather than trusting any number in a blog post. I use it as a sanity check on a lead before I commit to deeper collection.

4. Have I Been Pwned: the authoritative breach index

HIBP answers exactly one question well: which publicly known breaches contain this address, and when. That is genuinely valuable. Troy Hunt's curation is why people trust it: the dataset list is documented and the provenance is stated.

What it will not do is give you the record. HIBP will tell you an address was in a given breach; it will not hand you the username, phone fragment or password hash that came with it. For investigative pivots you need a source that indexes record contents, which is where breach lookup tools that return fields rather than dataset names come in. Run both. HIBP for defensible provenance, a content-indexing source for the pivots.

5. GHunt: Google account deep dive

GHunt is the specialist. Given a Gmail address or a Google account ID it enumerates what Google exposes: profile photo history, account creation signals, public Maps reviews, and (where the user left calendars public) event data that can reveal employer, routine and associates.

Two caveats. It requires you to authenticate with your own Google cookies, so use a dedicated research account, never your personal one. And its capability tracks whatever Google currently exposes, which shrinks over time. Check the repository's recent commits before you rely on any specific module.

6. Mosint: one CLI, many APIs

Mosint is an aggregator in script form. It wires together breach checks, social lookups, DNS/domain data and reputation sources behind a single command and outputs JSON, which makes it easy to drop into a pipeline.

The catch: most of the value comes from third-party APIs you must register for and key in yourself. Budget an hour for setup. Once configured it is a clean way to produce a consistent, machine-readable first pass on every address in a list.

7. theHarvester: the domain-first collector

theHarvester inverts the problem. Instead of starting from an address, you start from a domain and collect the addresses, subdomains and hosts associated with it from search engines, certificate transparency and public sources:

theHarvester -d example.com -b all

For red-team scoping and attack-surface work, this is where the list of targets comes from. For person-centric investigation it is a supporting tool. You use it to establish the organisation's mail format, then apply that format to a known name.

8. Hunter.io: corporate mail patterns

Hunter.io is the commercial version of that same job, and it is better at it for business domains. It infers the org's address convention (first.last@, flast@, and so on), lists known addresses with confidence scores, and verifies whether a given address accepts mail.

It is deliberately business-focused, so it contributes little on personal Gmail or Proton addresses. A free tier exists; check current limits on their site. Where it earns its place is in the derivation step. A verified corporate format plus a name from LinkedIn gives you a candidate address to feed into everything above.

9. SpiderFoot: the orchestration layer

SpiderFoot is not really an email tool. It is an automation framework that happens to run a large number of email-relevant modules. Give it a seed (an address, a domain, a name) and it recursively expands the graph across whatever modules and API keys you have enabled.

It rewards tuning and punishes laziness. Run it with everything enabled and you get thousands of low-value entities. Run it with a curated module set against a defined seed and it does hours of collection unattended. Use it for scheduled monitoring and large scopes, not for a single-address question you could answer in five minutes elsewhere.

How these tools chain together

The tools are complementary, not competing. A workable sequence for a single address:

1. Broad sweep first. Run an aggregated email lookup and Holehe in parallel. The aggregator gives breadth and breach coverage; Holehe gives you an independently verifiable second opinion on registrations. Disagreements between them are informative. A platform one finds and the other misses usually means a module is stale.
2. Pull the breach records. Check HIBP for the dataset list and provenance, then a content-indexing breach source for the fields. You are hunting for usernames, display names, phone fragments and secondary addresses.
3. Check the credential-theft side. Query stealer logs separately. This tells you whether a machine associated with the address was compromised, and often surfaces service registrations that no other method reaches.
4. Pivot on the username. Any handle you recovered in steps 2–3 goes into a username search across platforms. In practice this is where most investigations actually break open. Email addresses are compartmentalised; reused usernames are not.
5. Enrich the strongest lead. If the address is Google-hosted, run GHunt. If it is corporate, run Hunter.io and theHarvester against the domain to map colleagues and the mail format.
6. Automate the repeat. For anything ongoing, put SpiderFoot or a scheduled API job on it rather than re-running the sequence by hand. Revealer's API and breach monitoring cover the same need if you are already in the platform.

The failure mode to avoid is stopping at step 1. A registration list is a starting point, not an answer. The value is in the second and third hop: the username from a 2016 breach that still resolves to an active account today.

Free versus paid: what you actually give up

The open-source set (Holehe, GHunt, Mosint, theHarvester, SpiderFoot) costs nothing and runs on your own infrastructure, which matters when the query itself is sensitive. What you pay for instead is maintenance: keys to manage, modules that rot, and no support when a source goes dark mid-case.

Paid platforms buy you coverage you cannot self-host: breach and infostealer corpora, historical records, and the engineering that keeps 800+ modules alive. If you run a handful of lookups a month, the free stack is fine. If email OSINT is part of your job, the hours you spend patching broken modules cost more than a subscription. Most teams end up running both, and cross-checking one against the other. A broader inventory of adjacent tooling lives on the OSINT tools page.

Frequently asked questions

What is the best free email OSINT tool? Holehe for registration checks and Have I Been Pwned for breach history. Together they answer "where does this address exist" and "has it been exposed" at zero cost. Add Epieos for a quick browser-based second opinion.

Can I find someone's name from just an email address? Often, yes, but usually indirectly. Breach records and stealer logs frequently include display names, and Google-linked addresses can expose a profile name through GHunt or Epieos. The address alone rarely gives you a name; the records attached to it do.

Is email OSINT legal? Querying publicly available and lawfully obtained data is legal in most jurisdictions. Accessing an account, attempting logins with recovered credentials, or using results for employment, tenant or credit decisions is not. Know your jurisdiction and your purpose before you collect.

Why do Holehe and other checkers return different results for the same address? Registration checkers depend on platform endpoints that change without notice. When a module breaks it typically reports "not used" rather than failing loudly. Run at least two independent sources and treat negatives as unconfirmed.

What are stealer logs and why do they matter for email OSINT? Infostealer malware harvests saved credentials and session data from infected machines. Those logs surface service registrations and identifiers that registration checkers cannot see, because the data comes from the victim's browser rather than from a platform's signup endpoint. See stealer log search for how that data is queried.

How much does a paid email OSINT platform cost? It varies widely by vendor and volume. Revealer starts with a free tier, with paid self-serve plans from $12.99/mo and custom Enterprise pricing; see pricing for current details. For other vendors, check their site. Published tiers change frequently.