The best free OSINT tools in 2026 are Sherlock and Maigret for username enumeration, WhatsMyName for browser-based checks with no install, Holehe for email-to-account matching, and Have I Been Pwned for breach exposure. Add theHarvester for domain reconnaissance, ExifTool for file metadata, SpiderFoot for automated correlation, and the Wayback Machine for historical snapshots, and you can cover most of an investigation's groundwork without spending anything. What you will not get from free tools is one query across hundreds of sources, continuous breach monitoring, or infostealer-log coverage. That line is the whole point of this post.
Every tool below is one we actually run. No affiliate links, no padded lists, no leftover from 2021. Where a free tier has limits, the limits sit next to it.
The 12 tools at a glance
| Tool | Category | Best at | The free catch |
|---|---|---|---|
| Sherlock | Username enumeration | Fast CLI sweep of social sites by username | Dead modules and occasional false positives |
| Maigret | Username enumeration | Much larger site list, profile extras, HTML/PDF reports | Full scans are slow and trip rate limits |
| WhatsMyName | Username enumeration | Browser-based checks, zero install | One username at a time in the web UI |
| Holehe | Email pivot | Finding which sites an email is registered on | Probes password-reset flows; authorized targets only |
| Have I Been Pwned | Breach exposure | Free per-email breach lookup, plus Pwned Passwords | Domain monitoring and API use are paid |
| theHarvester | Infrastructure recon | Emails, subdomains, hosts from public sources | Raw output; you do the triage |
| Shodan | Infrastructure recon | Exposed services, certificates, banners tied to an org | Free account caps queries and result depth |
| ExifTool | Files & metadata | GPS, author, and software metadata from files | Prints everything; you script the filtering |
| SpiderFoot | Correlation | Self-hosted scans that stitch sources together | Setup time; runs can take hours |
| Maltego CE | Link analysis | Best graph UI for showing how identifiers connect | Registration required; capped features |
| Wayback Machine | History | Deleted bios, removed pages, changed profiles | Coverage gaps; archived is not current |
| GHDB | Search technique | Curated index of working Google dorks | Manual; queries rate-limited |
Username enumeration: the workhorses
1. Sherlock. Default first move for a username. pipx install sherlock-project, then:
sherlock someusername
It checks hundreds of social sites in one pass and prints found URLs. Two caveats we keep repeating to ourselves: module lists rot, so a site that no longer validates the way the module expects can return a false hit, and a "not found" is only as fresh as the module. Re-run before you report a negative. Spot-check positives in a browser.
2. Maigret. Same idea, much bigger list (several thousand sites at time of writing; check the repo for the current count). It also pulls extras off found profiles (linked accounts, IDs, biographical fields) and exports HTML/PDF reports you can hand to someone who does not live in a terminal.
maigret someusername --top-sites
Use --top-sites for a fast first pass. A full sweep takes a long time and, from a residential IP, will start eating CAPTCHAs. Throttle it, or run it in chunks.
3. WhatsMyName. The zero-install option: open whatsmyname.app, type a username, get results. The maintainers verify sites by hand, so false-positive rates run lower than average. Reach for it when you cannot install anything (locked-down machine, live call with a client), or to cross-check a Sherlock run. The overlap between site lists is smaller than you'd expect.
Practical note: run any important username through at least two of these three. Coverage gaps stay invisible until you diff the results.
Email pivots
4. Holehe. Answers "which services does this email have an account on?" by probing password-reset and signup flows, then reporting which ones recognize the address. pipx install holehe, then holehe [email protected]. It covers a large set of popular sites; the count changes, so check the repo. Because it touches account-recovery endpoints, run it only against addresses you're authorized to investigate. Treat a hit as signal to verify, not proof of ownership.
5. Have I Been Pwned. The reference point for breach exposure. Enter an email, see which known breaches contained it; Pwned Passwords checks a password against a corpus of already-breached ones. Individual lookups are free; domain monitoring and heavier API use are paid as of writing (check their site). What it does not do: tell you anything about infostealer logs, which are a separate and nastier dataset. More on that below.
Infrastructure and exposure
6. theHarvester. The domain-side workhorse. Point it at an organization and it collects emails, subdomains, hostnames, and URLs from public sources. Ships with Kali; on other systems follow the repo's install docs. Output is raw. Expect to spend time deduplicating and judging relevance. Still the fastest way I know to grow an org's identifier list from a single domain.
7. Shodan. Not a people tool until you make it one: exposed services, SSL certificates with names and emails, banners that tie infrastructure back to individuals. A free account caps how many searches and full result records you can pull, so check the current limits before planning a sweep. For pure OSINT pivoting, certificates are the underrated feature. Certificate transparency data routinely exposes the email addresses people used for domain validation.
Files, history, and graph work
8. ExifTool. exiftool file.jpg prints every scrap of metadata in a file: camera or software chains, author fields, sometimes GPS coordinates. In investigations, metadata is often where a document betrays its true origin. It dumps everything. The skill is in scripting the filter, not the read.
9. Wayback Machine. Deleted bios, removed allegations, profile photos that changed after your subject got careful. Once the steps above give you profile URLs, check each against web.archive.org. Coverage is spotty by nature (no crawler gets everything), but a snapshot from before a subject sanitized their footprint is regularly the artifact that matters most.
10. SpiderFoot. The open-source version self-hosts a wide library of modules and correlates them into one result set per target: the join layer you'd otherwise build in a spreadsheet. The cost is setup and patience. Installation takes minutes, scans can take hours, and you maintain it yourself.
11. Maltego Community Edition. Free after registration, with capped features. Still the best graph UI for showing a non-technical audience how a username connects to an email connects to a domain. When the deliverable is "explain the web," draw it here.
12. Google Dorks and the GHDB. site:, intitle:, filetype: and friends remain the cheapest deep search available. The Google Hacking Database is a curated, searchable index of dorks that actually work. Manual by design, and Google rate-limits aggressively. Space queries out.
Where free stops
Each wall below is one you will actually hit, not a hypothetical:
- Rate limits and blocks. A full Maigret sweep, Holehe across a long email list, or an enthusiastic dork session all end the same way: CAPTCHAs, temporary blocks, and results you cannot trust. Free tools assume light usage.
- You are the correlation layer. Sherlock gives you usernames, Holehe emails, theHarvester subdomains. Then a human stitches them together in a spreadsheet. With one subject that's fine. With five identifiers across ten sources, the join work dominates the investigation.
- Rot and blind spots. Site lists decay silently. A module that stopped matching three months ago still reports "not found," and you cannot see the difference between absent and broken. Coverage gaps only surface when you diff two tools, which most people never do.
- Snapshots, not monitoring. Free tools answer today's question today. Breaches and new account registrations happen next week, and nothing free re-runs your identifiers to catch it.
- Breach data has a ceiling. HIBP answers "was this address in a public breach dump?" Infostealer logs (credentials, cookies, and form data exfiltrated from victims' browsers) circulate in different places, and free consumer tools mostly don't carry them. For exposure assessment, that's the gap that matters.
- Time. Twelve tools, one identifier each, manual dedup. If you bill by the hour, free tooling is often the most expensive option on this list.
A realistic free-first workflow
For a single-subject investigation, this order works:
- Run the username through Maigret (
--top-sites) and WhatsMyName; diff the results. - Take every email surface, run Holehe, then Have I Been Pwned.
- Pull found profile URLs through the Wayback Machine.
- Run ExifTool over any files the subject has published.
- Log everything with timestamps. You will need to say when you saw it.
The workflow stalls in three places: when you start with only a name or phone number, when identifiers multiply past a handful, and when the engagement spans weeks and needs monitoring. Those are exactly the gaps a paid layer exists to close.
Where a paid layer earns its keep
Fairness first. Revealer's free tier takes the same query you were just typing tool-by-tool (email, username, phone number, name, or address) and checks 800+ platforms, public records, and known breach datasets in one search. Start with the username search and the email lookup; use the data breach lookup for exposure, and the stealer logs page for the infostealer layer that free consumer tools don't carry.
Two things a hand-rolled free stack genuinely cannot replicate:
- Recursion. AI Deep Search follows an identifier across sources the way you would (find a username, pull its linked email, chase that email into breach data), except within one run instead of across an afternoon. For multi-identifier subjects, this is the difference between a pivot and a dead end.
- Monitoring. Breach monitoring watches identifiers over time, so exposure that lands next week comes to you instead of being discovered next quarter.
Paid self-serve plans start at $12.99/mo (card or crypto accepted), Enterprise is custom, and the API exists for teams piping results into their own tooling. The full source catalog is documented on the OSINT tools page. One legal note: Revealer is not a consumer reporting agency. Don't use it (or any people-search data) for employment, tenant, or credit decisions.
Free still wins when the work is one-off, single-identifier, and time-rich. Paid wins when identifiers multiply, deadlines exist, or monitoring matters. Most working investigators run both: free tools for ad-hoc pivots, a platform layer for anything that has to stand up later.
Frequently asked questions
What is the single best free OSINT tool? There isn't one. It depends on the pivot. Maigret for usernames, Holehe for emails, Have I Been Pwned for breaches. A working stack is three tools, not one.
Are these free OSINT tools legal? The tools are legal; the use decides everything. Stick to lawful investigation of authorized subjects, your own exposure, or research you're contracted to do, and read each platform's terms before automating against it.
Is Have I Been Pwned still free? Individual email and password lookups are free as of writing. Domain monitoring and heavy API use are paid. Check their site for current pricing.
Can I run Maigret or Sherlock from a residential connection? Yes, with throttling. Full sweeps from one IP will draw CAPTCHAs and blocks; use --top-sites, chunk your runs, and expect slower but cleaner results.
What can paid tools do that free ones can't? One query across hundreds of sources, correlation between identifier types, monitoring over time, infostealer-log coverage, and API access. Free tools can do any single pivot; paid platforms remove the stitching.
Does Revealer have a free tier? Yes. One search by email, username, phone number, name, or address checks 800+ platforms, public records, and known breach datasets before you pay anything.