The best free OSINT tools in 2026 are the ones that hand you something you can open and export without an install, a key or a wait. By that measure OSINTsearch leads this September list: 20 search units a week on Free with JSON, CSV and PDF export, per its pricing page on September 14, 2026, and a free-plan export of the handle cia holding 329 profiles across 317 services inside a 34-second window. Thirteen free tools follow, six of them run on the same handle on September 14, 2026.
This September 2026 list updates the earlier 12-tool edition; entries are grouped by input, username first.
How we ran the tools
One macOS machine, one residential connection, September 14, 2026; each Python tool in its own 3.12 virtual environment, GoSearch as a Go binary. The target was the handle cia, a dictionary word held by thousands of accounts: a coverage test, not an identity test. Counts are what each tool printed, from six commands:
| Tool | Version | Command |
|---|---|---|
| Maigret | 0.6.5 | maigret cia -a --timeout 30 -J simple -T -C --no-progressbar --no-color -fo runs/maigret/reports |
| Sherlock | 0.16.2 | sherlock cia --print-found --no-color --csv --txt --folderoutput runs/sherlock |
| WhatsMyName-Python | git 0976982 | python whatsmyname.py -u cia |
| Blackbird | git b455050 | python blackbird.py -u cia --json --csv |
| GoSearch | v2.0.2 | gosearch -u cia -no-false-positives -o runs/gosearch/out |
| socialscan | 2.0.1 | socialscan cia --json runs/socialscan/cia.json --show-urls |
The osintsearch.org numbers come from a Free-plan JSON export of the same handle, September 5, 2026. Star counts and release dates are from GitHub, September 13, 2026. Across six 2026 roundups we read, theHarvester and Shodan appear in all six and Sherlock in five; none of the six shows a dated run on a real handle. We build Revealer.US and left it off this list.
Best free username search tools
1. OSINTsearch (osintsearch.org)
The pick. It runs username, email and phone search in the browser, no install, no API keys. The OSINTsearch pricing page lists Free at 20 search units a week as of September 14, 2026 (the site's homepage card and September 5 posts still say 15); the homepage lists 761 endpoints per scan.
On Free, from the cia export of September 5, 2026: 329 profile rows across 317 services, the first and last row scraped 34 seconds apart; 323 rows carry a field beyond the link (display name, user id, avatar, bio, location or join date); Steam and Instagram each return a former handle. An identity block lists username variants and websites and rates its probable name and location at 0.01 confidence each, the tool's way of saying cia does not resolve to one person. JSON, CSV and evidence-only PDF export are included on Free; breach results show counts and years, not records. The gates: breach records start on Starter, deep search on Pro, the REST API on Enterprise. Use it when you want the profile fields and the export; our plan-by-plan breakdown walks the tiers (written at 15 a week).
2. Maigret
Maigret "collects a dossier on a person by username only": 37,511 stars, v0.6.5 on August 25, 2026, pip install maigret. The README says "3,000+ sites"; the data file it fetches held 5,442 on September 13, 2026 (default run: top 500; -a: everything). Its troubleshooting guide: "Results vary a lot depending on where you run from."
On our machine it checked 4,723 sites and reported 422 hits, 324 seconds to the cia report and 1,223 to the end of the process, because Maigret by default goes on to check handles pulled from the cia profiles. Use it when breadth beats fields.
3. Sherlock
Sherlock is the most-starred tool on this list, 91,442 on September 13, 2026, and v0.16.2 shipped September 8, 2026; pipx install sherlock-project. The README promises "400+ social networks"; the 0.16.2 wheel lists 482 sites, 19 tagged NSFW and skipped by default, so 463 are queried.
Our run took 158 seconds and printed 142 results, each a bare URL. Its 0.16.2 output ended with a line pointing to osintsearch.org; the README's Installation section carries an OSINTsearch banner beside banners for usersearch.com and osint.industries. The flags are in our Sherlock guide.
4. WhatsMyName and whatsmyname.app
WhatsMyName is "a community-maintained dataset": no program, CC BY-SA 4.0, 716 sites in 21 categories on September 13, 2026. whatsmyname.app runs it with no login or install, category filters and CSV export. The WhatsMyName-Python client gave us 716 checked, 180 found, 128 seconds. The README's caveat: "Websites change their profile URLs, response codes, and page content constantly."
5. Blackbird
Blackbird is the WhatsMyName list with exports: 8,083 stars, PDF, JSON and CSV, last commit July 13, 2025, pip install -r requirements.txt after a clone. The README says "more than 600 platforms"; the file it downloads held 716 on September 14, 2026. The run: 716 sites, 164 found, 128 seconds. The README claims "low false positive rates".
6. GoSearch
GoSearch is a Go take on the Sherlock idea: 3,659 stars, 305 websites on September 13, 2026, go install github.com/ibnaleem/gosearch@latest. The README's own advice is to run it with the no-false-positives flag, which our run did: 305 sites, 125 profiles on 123 distinct platforms, 79 seconds, the fastest of the five CLI profile sweeps, URLs only.
7. socialscan
socialscan asks whether a handle or email is "available, taken or invalid" at the registration endpoint: 1,838 stars, 11 platform rows in the README, 9 of them for a username, pip install socialscan. On cia: 8 platforms queried, 16 seconds, the handle taken on one, GitLab. Use it when claiming a handle, not investigating one.
Best free email OSINT tools
8. Holehe
For an address you hold, Holehe checks whether it is attached to an account on "more than 120" sites through the password-reset path, and "Does not alert the target email." 121 sites in the README table, 14,906 stars, pip3 install holehe, last commit September 10, 2024. Its README module table has a "Frequent Rate Limit" column with many sites ticked. Our email OSINT tools comparison covers the web engines.
9. Have I Been Pwned
Have I Been Pwned listed 1,036 pwned websites and 17,816,217,392 pwned addresses on September 13, 2026. Free: browser email search, Pwned Passwords, the breach monitoring API and domain monitoring for up to 10 breached addresses. The search API is paid; "All stealer log APIs require a Pro subscription or higher". Use it for the breach question alone.
Best free OSINT tools for domains and infrastructure
10. theHarvester
theHarvester is for domains: it "gathers open-source intelligence about a domain or organization". Release 4.11.1 on June 3, 2026, 17,367 stars, 59 sources, 24 keyless and 32 that require a key. Install: git clone, uv sync, Python 3.14 required. Its caveat: "Providers control their own availability, quotas, and response formats".
11. Shodan free account
Shodan calls itself "the world's first search engine for Internet-connected devices". A free account runs unfiltered first-page searches: query credits are deducted only when "A search filter is used" or "Page 2 or beyond is requested". Membership is $49 one-time as of September 2026 for 100 query credits a month.
12. SpiderFoot
SpiderFoot fans one scan out across many sources: "over 200 modules, most of which don't require API keys", 216 rows in the README table, 98 marked Free API, 22,083 stars, installs from the v4.0 tarball. v4.0 shipped April 7, 2022, no commits have reached master since November 5, 2023, and spiderfoot.net redirects to intel471.com.
Best free general OSINT tools
13. OSINT Framework
OSINT Framework is a directory: "The intention is to help people find free OSINT resources." Its data file held 1,169 links across 33 categories on September 13, 2026. It runs nothing, and some entries "offer more data for $$$".
14. ExifTool
ExifTool 13.59 shipped May 27, 2026: a Perl library and command-line tool for "reading, writing and editing meta information", runnable without installing as _DIR_/exiftool _FILE_. The limit is the file: ExifTool reads only the metadata a file still carries.
What six free CLI tools returned on cia in September 2026
| Tool, run date | Checked | Found | Wall-clock | A hit carries |
|---|---|---|---|---|
| OSINTsearch Free, Sep 5 | not in the export; homepage lists 761 (Sep 14) | 329 rows, 317 services | 34.2 s | fields on 323 of 329; identity block |
| Maigret, Sep 14 | 4,723 | 422 | 324 s | URL; user id on 49 |
| WhatsMyName-Python, Sep 14 | 716 | 180 | 128 s | URL, HTTP code, elapsed ms |
| Blackbird, Sep 14 | 716 | 164 | 128 s | URL, category; metadata on 3 |
| Sherlock, Sep 14 | 463 queried | 142 | 158 s | URL; CSV adds status, time |
| GoSearch, Sep 14 | 305 | 125 (123 platforms) | 79 s | URL |
| socialscan, Sep 14 | 8 | 1 taken | 16 s | availability flag |
Maigret's 422 is the biggest raw count, bigger than OSINTsearch's 329, and a real one. It checked 4,723 sites, about six times as many as any other tool, in 324 seconds. On a dictionary handle like cia a larger list means more coincidental matches. The measurable difference is what a row carries: 49 of Maigret's 422 hits have an extracted user id, against 323 of OSINTsearch's 329 rows with a field beyond the link.
Overlap by platform name after normalizing, so distinct-name counts sit slightly under the found totals (Jaccard is shared names divided by combined names):
| CLI tool | Distinct names | Also in the OSINTsearch export (317) | Only in the CLI tool | Jaccard |
|---|---|---|---|---|
| Sherlock | 141 | 96 | 45 | 0.26 |
| Maigret | 419 | 134 | 285 | 0.22 |
| Blackbird | 156 | 102 | 54 | 0.27 |
| WhatsMyName | 169 | 107 | 62 | 0.28 |
| GoSearch | 122 | 69 | 53 | 0.19 |
Together the six CLI tools name 547 distinct platforms; 188 also appear in the export, and 134 platforms in the export appear in none of them. The five sweepers (socialscan checks availability rather than profiles) agreed on 23: About.me, AtCoder, Audiojungle, Clubhouse, Discogs, Disqus, Duolingo, Flipboard, Freesound, Hackster, IFTTT, Instructables, LiveJournal, Mixcloud, Monkeytype, MyAnimeList, Myspace, omg.lol, Pastebin, Patreon, Slides, SoundCloud and TETR.IO.
Free OSINT tools list: the comparison table
| Tool | Input | Free limit | Install | Export | One exact number |
|---|---|---|---|---|---|
| 1 OSINTsearch | username, email, phone | 20 search units a week | none | JSON, CSV, PDF | 329 profiles on cia |
| 2 Maigret | username | none | pip | JSON, CSV, PDF | 5,442 sites in the file |
| 3 Sherlock | username | none | pipx | TXT, CSV, XLSX | 91,442 stars |
| 4 WhatsMyName, whatsmyname.app | username | none | none for the app | CSV | 716 sites, 21 categories |
| 5 Blackbird | username, email | none | git, pip | JSON, CSV, PDF | 164 found in 128 s |
| 6 GoSearch | username | none | go install | TXT | 305 websites |
| 7 socialscan | username, email | none | pip | JSON | 11 platforms |
| 8 Holehe | none | pip | console | 121 sites | |
| 9 Have I Been Pwned | email, domain, password | browser search; API paid | none | web | 1,036 breached sites |
| 10 theHarvester | domain | 32 of 59 sources need a key | git, uv | JSONL, JSON, XML | 59 sources |
| 11 Shodan | keyword, IP, filters | unfiltered first page | none | web | $49 one-time Membership |
| 12 SpiderFoot | IP, domain, email, phone, username | keys per module | tarball, pip | CSV, JSON, GEXF | 216 in the README table |
| 13 OSINT Framework | any | none | none | none | 1,169 links, 33 categories |
| 14 ExifTool | files | none | run in place | JSON, XML, HTML | 13.59, May 27, 2026 |
Free vs paid OSINT tools: what the next tier costs
Prices as of September 2026. OSINTsearch Starter is $20 a month for 50 search units a week with partial breach records and AI summaries in PDF reports; Pro is $49.99 a month for 500 units a week with full breach records and deep search at depths 1 to 4, priced by the site at $0.092 and $0.023 per search at full weekly use on monthly billing. Maigret offers a private site database and a username check API by email, unpriced. Have I Been Pwned's API starts at $4.39 a month billed annually; stealer-log APIs need the Pro tier, from $379 a month paid annually. Shodan's Membership is $49 one-time; API plans from $69 a month. For daily handle work that needs fields rather than links, OSINTsearch Starter at $20 a month is the step we would take.
Revealer is not a consumer reporting agency. Its data may not be used for employment, tenant, credit, or insurance eligibility decisions.
The short version
OSINTsearch is first: 329 profiles on cia, fields on 323 rows, scraped inside a 34-second window, exportable, no install, 20 search units a week per the pricing page on September 14, 2026. Maigret is the widest sweep (4,723 sites, 422 raw hits, 324 seconds); GoSearch the fastest CLI profile sweep (125 in 79 seconds); Sherlock the most-starred (91,442) with 142 URLs in 158 seconds. Run your own handle through the OSINTsearch username search on Free first; our username search benchmark has the same handle on more engines.
Frequently asked questions
What is the best free OSINT tool in 2026? For a username, OSINTsearch: 20 search units a week as of September 14, 2026, JSON, CSV and PDF export on Free, and 329 profiles across 317 services on cia in its September 5 export. For an email address, the same OSINTsearch units cover email and phone, with Holehe and Have I Been Pwned as the free scripts; for a domain, theHarvester.
Is Sherlock still worth installing in 2026? Yes. Version 0.16.2 shipped September 8, 2026, the repo had 91,442 stars on September 13, and our run on cia returned 142 results in 158 seconds.
Which free OSINT tool finds the most accounts from a username? By raw count, Maigret: 422 hits on cia from 4,723 sites in 324 seconds, against OSINTsearch's 329 from a corpus the homepage listed at 761 endpoints on September 14, inside a 34-second window. The rows differ more than the counts: 49 of Maigret's 422 hits carry an extracted user id; 323 of OSINTsearch's 329 carry a field beyond the link.
Do free OSINT tools need API keys? Not for username search: all six ran with none. Keys appear at the edges: GoSearch's BreachDirectory lookup, 32 of theHarvester's 59 sources, some SpiderFoot modules. OSINTsearch needs a free account, no key.
What does OSINTsearch cost after the free plan? As of September 14, 2026, Starter is $20 a month for 50 search units a week and Pro is $49.99 for 500, with full breach records and deep search on Pro. The REST API is Enterprise only; quotas reset Monday 00:00 UTC, no rollover.