The most reliable way to find someone's email address legitimately is to run a dedicated email lookup that checks public records, social profiles, and breach datasets in a single query. The other reliable path is to derive the address from a known company email pattern ([email protected] is the usual one) and verify it before you send anything. Free manual methods still work when you have a name and an organization: search engine operators, WHOIS records, professional bios, and public code commits. Use whatever you find only for lawful purposes: outreach, identity verification in an authorized investigation, or account recovery with the owner's consent.
This guide walks the methods in the order a working OSINT analyst actually tries them, including the failure modes and legal lines most listicles skip.
What "legitimate" means in practice
Finding an email address is usually legal. What you do with it is the part that can go sideways. Legitimate uses: professional outreach, contacting a source, verifying that an account belongs to a specific person in an authorized investigation, fraud checks on your own users, reconnecting with someone you lost touch with. Not legitimate: harassment, stalking, doxxing, building spam lists. Anything tied to employment, tenancy, or credit is a different category entirely; those decisions require a consumer reporting agency operating under the FCRA.
Two more lines people skip. Scraping a platform against its terms of service can land you in civil trouble even when the underlying data is public. And if the person is in the EU or UK, GDPR applies to what you do with their data after you find it, regardless of how you found it.
Use the smallest method that answers the question. You do not need a full people-search stack to recover a conference speaker's press email.
Method 1: Derive the address from a company email pattern
Most organizations use one of a handful of patterns:
If you can find one employee's address from a press release, an email signature, or a conference PDF, you can usually infer the pattern for the whole domain. Domain-search tools (Hunter.io is the well-known one) will dump a sample of addresses that reveal the convention without you guessing. Confirm the domain handles mail first: dig +short MX company.com shows the mail servers, and dig +short TXT company.com often surfaces SPF/DKIM records naming the mail vendor, which tells you the domain is actively sending.
Small companies break the pattern more often than large ones. A 12-person shop on Google Workspace may have started with whatever Gmail defaulted to, then hired a Jane Smith who became jane.s@ because jane@ was taken. Universities and government agencies run their own conventions (initials, staff IDs). Subsidiaries sometimes sit on a different domain than the brand you searched. Don't spray twenty permutations at the mail server in one burst.
Verification services such as Hunter.io, NeverBounce, or ZeroBounce will tell you whether a guessed address exists without you sending anything. Watch for catch-all (accept-all) domains, where the mail server confirms every address. Treat a "valid" result from a catch-all domain as unverified. A single polite test email remains the ground truth when nothing else settles it.
Method 2: Search engine operators
Search engines still index a lot of contact information people published themselves. The operators that actually earn their keep:
"@company.com" "Jane Doe": any page pairing the person with the domainsite:company.com "@company.com": internal pages, team directories, footer contacts"Jane Doe" (email OR contact) filetype:pdf: conference programs, speaker sheets, whitepapers"jane.doe" OR "jdoe" "@company.com": pattern fragments across the open web
Once you have a candidate address, search it as a quoted string. Corroborating pages (a PDF, a bio, a Git commit) are how you tell Jane Doe at Acme from the other Jane Doe. filetype:xlsx and filetype:csv still surface old staff lists that nobody meant to leave online. Hyphenated surnames need both the hyphenated and unhyphenated forms in the query.
Run these on more than one engine. Google, Bing, and DuckDuckGo index differently, and DuckDuckGo's bang syntax (!g, !b) makes switching cheap. PGP key servers are an older but still occasionally productive variant: public keys often carry a real name and email, and keys.openpgp.org remains active as of writing.
Method 3: Social profiles and professional pages
People put emails in bios more often than you'd guess, and they usually do it on purpose for business:
- X/Twitter and Instagram bios (Instagram business profiles also expose a dedicated email button)
- Personal websites and portfolio pages, including the obvious
/contactguess - YouTube channel "About" tabs
- Conference speaker pages and podcast guest bios
- Linktree and similar bio-link pages
Check the GitHub profile "Email" field and the README of a personal repo before you start scraping anything. About.me, Mastodon profiles, and old Medium author pages still leak contact lines that the person cleaned off newer networks. Facebook is close to a dead end for this now; treat it as a last resort.
LinkedIn is the richest professional source, but contact details are mostly visible to connections, and scraping them violates the platform's terms of service. Pivoting matters more than any single platform. If you found a username anywhere, a username search across hundreds of platforms at once often surfaces a profile you would never have guessed, sometimes with an email sitting in the bio.
Method 4: WHOIS and domain records
If the person owns a personal domain (a portfolio, a consultancy, a side project), the registration record may name their email outright. Reality check: since the 2018 GDPR-driven redactions, most gTLD registrations (.com, .org, .net) show a privacy proxy as of writing. Three workarounds:
- Historical WHOIS. Commercial archives record past registrations from before redaction. WHOIS XML API and ViewDNS both offer historical lookups.
- ccTLDs with different rules. Some country-code registries still publish registrant contact data.
- DNS records. The SOA record's RNAME field encodes an administrator email. Run
dig SOA example.comand read the first label, replacing the first dot with an @. Role addresses likehostmaster.example.comare common, but small organizations sometimes use a personal address there.
RDAP (the JSON successor to classic WHOIS) is worth a look on the same domains; it sometimes returns a different redaction set than the port-43 WHOIS you ran first. For a personal .blog or a cheap ccTLD the person registered at 2 a.m., historical WHOIS is the hit more often than the live record.
Method 5: Code hosting and technical trails
If your subject writes code, their email is often a few keystrokes away. GitHub exposes the author email of commits in public repositories through the events API:
curl -s https://api.github.com/users/<username>/events/public | grep '"email"'
The .patch view of a commit (https://github.com/<user>/<repo>/commit/<sha>.patch) carries the author line too. This is not an exploit. The data ships in every clone of the repository, but many developers do not realize their personal address travels with each push. If you clone the repo, git log --format='%ae %an' | sort | uniq -c is faster than clicking through the web UI.
Watch for users.noreply.github.com addresses. GitHub injects those when the author hid their email in account settings, and they tell you almost nothing. Keep looking. Package registries like npm and PyPI also display maintainer contact fields, though these are increasingly role addresses.
Method 6: Breach and stealer-log data
Breach corpora are the most misunderstood legitimate source. Every major breach contains email addresses paired with names, usernames, and account details, which makes them useful for two things: confirming that an address belongs to a specific person, and recovering an address you know exists but cannot recall.
The boundaries are strict. For your own address or your own organization's exposure, Have I Been Pwned is the standard free check. For checking another person's address within an authorized investigation (fraud response, incident attribution, verification work for a client), a breach lookup that correlates the address with identity data is the more complete instrument, and infostealer logs go further still, pairing the address with a machine, an IP, and often a named user profile from an infected host.
Combo lists give you email-plus-password pairs from old dumps. Stealer logs are a different artifact: they come off an infected endpoint and often include the browser profile, saved sessions, and a machine name. That extra context is why they resolve identity when a 2013 dump does not. Both are still someone else's data. Authorization or consent is the gate, not a nicety.
What you never do is harvest addresses from breaches to build mailing lists. That is unsolicited mail plus unlawful data processing, and it turns a legitimate capability into a legal problem in one step.
Method 7: Dedicated lookup tools
When manual methods stall (a common name, no clear employer, a privacy-conscious subject), dedicated tools check public records, social platforms, and breach datasets at once, in either direction: addresses linked to a person, or identities linked to an address.
Revealer's email lookup takes a name or an address and checks 800+ platforms, public records, and known breach datasets in one search. There is a free tier to start, paid self-serve plans from $12.99/mo on the pricing page, and an API if you are folding lookups into your own tooling. External options in the same space include Hunter.io (domain-pattern oriented), VoilaNorbert, Snov.io, and RocketReach; their pricing and free-tier limits change often, so check their sites rather than trusting a blog post, including this one.
A dedicated tool is the right call when you have a common name and no employer, or when you need the reverse direction (address in, identity out) and you would otherwise spend an afternoon stitching screenshots. It is the wrong call when a single site: query already produced a speaker email on a conference PDF.
Comparing the methods
| Method | Cost | Effort | Works best when | Main limitation |
|---|---|---|---|---|
| Company pattern + verify | Free–low | Low | You know the employer | Catch-all domains; small firms break patterns |
| Search operators | Free | Medium | Subject has any public footprint | Buried results; query-dependent |
| Social and professional bios | Free | Low | Freelancers, creators, founders | Requires them to have published it |
| WHOIS / DNS records | Free–low | Medium | Subject owns a domain | Redaction on most gTLDs |
| Code hosting trails | Free | Low | Developers, technical staff | Not everyone commits publicly |
| Breach and stealer-log data | Low–paid | Low | Verifying an address–identity link | Authorization or consent required |
| Dedicated lookup tools | Freemium | Very low | Common names, thin footprints | Coverage varies by provider |
Verify before you act on it
Two failure modes burn people. The first is a wrong address. Same-name collisions are common, and an email that looks right plus a green verification checkmark is still not proof it belongs to your subject. Cross-check with a second identifier: a username, a phone number, a location. A people search on the name can confirm age, location, and associated identifiers so you know you have the right Jane Doe before you send anything.
The second is over-verifying. Running thousands of SMTP checks against one domain looks like reconnaissance, trips rate limits and abuse alarms, and can get your IP blocked. Verify the addresses you actually need, not the entire pattern space.
SMTP VRFY has been disabled on serious mail servers for years. The verifiers you pay for are doing a RCPT TO probe (and sometimes a catch-all test) behind a UI. Greylisting and greylisting-like tarpits will lie to you for a few minutes and then tell the truth; if a result flips from invalid to valid on a second pass, believe the second pass. None of that substitutes for a second identifier.
When to escalate to deeper tooling
Some questions need more than one lookup. Reverse email search (starting from an address and asking who owns it) gets markedly more productive when the tool follows the address recursively: the same address registered on a forum years ago, tied to a username, which appears in a breach with a real name, which matches a public record. That is what AI Deep Search does: agent-driven, recursive people intelligence that follows identifiers across sources instead of returning a single flat list. You get the person plus the chain of evidence, not a pile of unranked matches.
For teams doing this at volume, the same capability is available through the API for building into existing investigative workflows. Read the docs before assuming the web interface is the only way in. Adjacent pivots (username, phone, breach monitoring) live in the OSINT toolkit.
Revealer is a public-records and OSINT search platform, not a consumer reporting agency; its results must not be used for employment, tenant, or credit decisions.
Frequently asked questions
Is it legal to find someone's email address?
Usually yes. Most methods use information the person published or that exists in public records. Legality turns on use: outreach and authorized investigation are fine; harassment, doxxing, and mass unsolicited mail are not, and data-protection laws like GDPR can apply once you process the address.
What is the fastest free way to find an email?
Search for "@company.com" "person's name" if you know the employer, or check their social bios and personal site. Pattern guessing plus a verifier covers most business cases in under five minutes.
Can I find an email address from just a name?
Yes, but expect noise. A lookup that checks public records, social platforms, and breach datasets at once filters far better than a plain web search, especially for common names. Then verify with a second identifier before acting.
How do I find out who owns an email address?
Run a reverse email lookup: it returns the identities, usernames, and profiles linked to that address across public sources. Recursive AI search improves the result by following the address across linked identifiers.
Is it legal to use breach data to find someone's email?
Checking your own address is unambiguously fine. Checking someone else's requires a lawful basis, typically an authorized investigation or fraud response. Using breached addresses for marketing lists is not lawful.
Can I use these methods for employment or tenant screening?
No. Those decisions require reports from a consumer reporting agency governed by the FCRA. Revealer is not a consumer reporting agency and must not be used for those purposes.