OSINT for beginners is the practice of collecting and connecting publicly available information (usernames, emails, phone numbers, breach records, public documents) to answer a specific question, usually some version of "who is behind this online identity?" You don't need paid tools or special access to start. Free tools like Sherlock, Maigret, Holehe, and Have I Been Pwned cover the three core techniques: username enumeration, email-to-account discovery, and breach lookups. One repeatable workflow ties them together. This guide walks through that workflow end to end: what OSINT is, how to set up the starter stack in an afternoon, how to run a first investigation on lawful footing, and where a unified engine like Revealer earns its keep.
What OSINT is — and what it isn't
Open-source intelligence is the discipline of finding, collecting, and analyzing information from publicly available sources to answer a defined question. The "open source" refers to the source, not the software: a public profile page, a county court docket, a company registry filing, a documented data breach, an archived forum post. If an anonymous member of the public could reach it with a browser, it's fair game for collection.
What OSINT is not: anything that requires access you weren't granted. Logging into someone's account with a leaked password is unauthorized access, not intelligence work. Circumventing a paywall, pretexting your way past a support agent, or planting malware are not OSINT techniques; they're crimes with extra steps. Draw that line on day one. People who skip it spend the rest of the year explaining themselves.
OSINT is not a toolbox. It's a method. Tools rotate every year. What you're actually here to learn is the loop: start with one identifier, find what it connects to, verify, repeat.
The core skill: pivoting on identifiers
Nearly every OSINT investigation is a walk across an identifier graph. A username appears on a forum. The forum profile lists a display name and an avatar. The avatar reverse-image-searches to an older account that uses a real name. The real name plus a city surfaces a public record. The record lists an address associated with a phone number. Each hop turns one identifier into another.
Two rules make this reliable:
- A single hit is a lead, not a finding. Usernames collide constantly. Short handles like
mike88belong to thousands of unrelated people. Treat every match as a hypothesis until a second, independent source confirms it. - Log every hop. Platform, URL, what you saw, date and time you saw it. Profiles get deleted and edited. A source you didn't record is a source you can't defend later.
People who internalize those two habits outperform the ones with forty installed tools and no notes. I've watched both.
The beginner tool stack
Four free tools cover most first-year investigations. Each does one job well.
| Tool | What it does | Input | Cost | Weak point |
|---|---|---|---|---|
| Sherlock | Checks hundreds of sites for a username and reports live account URLs | Username | Free, open source | Username-only; common handles return noise |
| Maigret | Username search across a larger site list; extracts IDs, links, and profile details into a report | Username | Free, open source | Full runs are slow; some sites false-positive |
| Holehe | Tests whether an email is registered on roughly 120 platforms via their account-recovery flows | Free, open source | Email-only; coverage shifts as sites change | |
| Have I Been Pwned | Checks an email or username against documented data breaches | Email or username | Free lookups; paid API | Shows breach exposure, not account maps |
Site counts drift, so treat the numbers below as "as of writing" and check the repo before you rely on a specific platform.
Sherlock is the classic first tool: a Python CLI that queries several hundred sites in parallel and prints every URL where the username produced an account. Coverage changes as sites come and go; the current site count lives on their repository.
Maigret began as a Sherlock fork and outgrew it. Larger site list (thousands of sites as of writing) plus extraction. It pulls account IDs, profile links, and sometimes names and locations off the pages it finds, then writes an HTML report. If you install only one username tool, install this one.
Holehe answers a narrower question with precision: is this email address registered as an account on a given platform? It works through each site's password-recovery flow, so a positive result is strong evidence an account exists. Roughly 120 supported sites as of writing.
Have I Been Pwned (HIBP) is the reference public breach index. Enter an email address or username and it lists the documented breaches that included it, along with the data classes exposed per breach (email, phone, dates of birth, and so on). Individual searches are free; the API is a paid product (check their site for current terms).
What these four don't do: phone-number lookup, name-and-address records search, cross-identifier correlation, or monitoring a target over time. That gap is why people eventually pay for a consolidated platform.
Set up the stack in an afternoon
The three CLI tools are Python packages. On macOS or Linux:
python3 -m venv osint-env && source osint-env/bin/activate
pip install sherlock-project maigret holehe
Then the basic invocations:
sherlock some_username
maigret some_username
holehe [email protected]
On Windows, the same commands work inside WSL. Native installs usually behave, but WSL saves headaches with dependencies. HIBP needs no install. It's a website.
Two notes before your first run. These tools generate real traffic to real sites, so leave them at default speed rather than cranking aggressive parallel loops; you want reliable results, and the sites you're querying did not volunteer to be load-tested. Also expect false positives. Some sites return "account found" for any input string. When a hit matters, open it in a browser and confirm the account actually exists before you log it.
If pip complains about build tools on a fresh Mac, install Xcode command-line tools and retry. Don't start googling Docker for this.
Your first workflow: one username, six steps
Here's the method as a six-step loop you can reuse. Practice it on yourself first (your own usernames and emails). You already know the ground truth for your own accounts, which makes this the fastest way to learn what real signal looks like without touching anyone else's data.
1. Write the question and the lawful basis. One sentence each. "Is the marketplace seller who contacted me the same person as in the photos they sent?" is a good question. "Who is this person and where do they live?" with no attached purpose is not. Fraud triage on your own transaction, verifying a counterparty, locating a lost contact, and security research are legitimate drivers. Save the sentence. It's your scope limiter for everything that follows.
2. Baseline sweep. Run the username through Sherlock and Maigret. Log results in a plain spreadsheet: platform, URL, match confidence, date checked, and (most important) any new identifiers the hit exposes.
3. Pivot. Mine every hit: display names, bio text, avatar images (run them through a reverse image search), location tags, linked accounts. Each new identifier gets its own column. This step is where investigations are actually won; the tools only fetch pages. Rerunning Sherlock five times will not assemble the graph for you.
4. Expand on email. If an email surfaces, run Holehe to see which platforms hold an account for that address, and check HIBP for breach history. Breach data classes tell you which services the address touched. Treat that as mapping, never as a reason to go looking for passwords.
5. Records pass. With a probable real name and location, shift from social platforms to public records. This is where a single-query service pays for itself: Revealer's people search takes a name or address and checks 800+ platforms and public-record sources in one pass, and the reverse phone lookup does the same for a number. The standalone email lookup and username search pages point the same engine at a single identifier, which is useful when that's all you have.
6. Verify and close out. Apply the two-source rule to anything you plan to act on, write up findings with source URLs and access dates, and label each conclusion verified, probable, or excluded. Then delete what you no longer need. You've been handling someone's personal data; cleanup is part of the discipline, not an afterthought.
Where a unified platform fits
The CLI stack teaches you the mechanics, and you should run it by hand at least once. Each tool is still single-identifier, single-pass, and uncorrelated. Nobody should have to install Python just to answer "does this email exist anywhere."
That's the actual case for a consolidated engine. One Revealer search (email, username, phone number, name, or address) checks 800+ platforms, public records, and known breach datasets, including infostealer-log data. AI Deep Search automates the pivot loop itself, following identifiers recursively across sources the way step 3 above does by hand. If you're wiring this into a product or a security team's workflow instead of running one-off searches, the API documentation and breach monitoring are the relevant pieces; pricing runs from a free tier through paid self-serve plans at $12.99/mo to custom Enterprise arrangements, with card and crypto both accepted.
How I actually split the work: free CLI tools for learning and quick one-off username checks; a platform when I need breadth (phone, name, address, records), correlation across identifiers, or monitoring over time.
The legal lines, stated plainly
- Public sources only. If reaching the data requires credentials you weren't given, it's out of scope. No exceptions for "just checking."
- Purpose matters. Legitimate drivers include fraud triage, verifying counterparties, locating lost contacts, security research, and journalism with editorial review. Stalking, harassment, and doxxing are not investigations. They're crimes that happen to use search.
- Public-records research is not a consumer background check. What OSINT tools and people-search platforms surface is public-source data. An employment, tenant, or credit decision requires a regulated consumer report from an FCRA-compliant consumer reporting agency. Revealer is not a consumer reporting agency and must not be used for those decisions.
- Minimize. Collect only what your written question requires, protect it while you hold it, delete it when the question is answered.
Five beginner mistakes that waste afternoons
- Installing forty tools before running one. Tool lists feel like progress. One complete workflow run beats a bookmarked directory every time.
- Treating a username hit as identification. Common handles match thousands of people. Confirm with a second, independent identifier before you act on anything.
- Capturing evidence without context. A screenshot with no URL and timestamp is nearly worthless a week later. Log at collection time, not from memory.
- Ignoring false positives. Some sites report an account for any input string. Verify the hits that matter in a browser, by eye.
- Searching without a question. Undirected searching collects noise and creates exposure you don't need. The one-sentence scope from step 1 is what keeps the work defensible.
Frequently asked questions
What is OSINT in simple terms? OSINT (open-source intelligence) is collecting and analyzing publicly available information (social profiles, public records, breach data, archived pages) to answer a specific question, such as who runs an online account or whether a seller is who they claim to be.
Do I need to code to do OSINT? No. HIBP and platforms like Revealer are web-based, and the CLI tools covered here (Sherlock, Maigret, Holehe) take two commands to install and none to read. Coding widens what you can automate, but it isn't the entry barrier.
Is using these tools legal? Running them is legal: they query publicly reachable pages. What matters is what you do with results. The same data supports fraud triage or enables harassment, and only one of those is lawful. Respect site terms of service, stick to public data, and never access an account you weren't authorized to use.
What's the difference between OSINT and a background check? OSINT is ad hoc research across public sources. A background check for employment, tenancy, or credit is a regulated consumer report that must come from an FCRA-compliant consumer reporting agency. Revealer is not a consumer reporting agency and its results are not for those purposes.
How much does it cost to start? Nothing. Sherlock, Maigret, and Holehe are free and open source, and HIBP's individual searches are free. Revealer has a free tier, with paid self-serve plans from $12.99/mo.
Where should an absolute beginner start? Run the six-step workflow against your own identifiers. You already know the correct answers for your own accounts, which makes it the fastest way to learn what genuine matches, false positives, and useful pivots actually look like.