The best free OSINT tools are the ones you will still have installed in six months. Most lists pad to fifty links; this one is twelve, each chosen because it does one job well without a card, and each described from its own page or repo on 2026-09-05 rather than from memory. OSINTsearch leads the list for the identifier pivots, username, email and phone, because its free plan runs the full 770 platform sweep. The rest cover the ground around that: username scripts, email and phone checks, infrastructure mapping, history and metadata.
I built OSINTsearch, so read that ranking with the bias in mind. I also run everything else here, and the order within each group is the order I reach for them. Where a project states a count I quote it; where it does not, I say what it does and stop.
How I chose
Three tests. Free means free: a real free plan or an open source license, not a trial. Maintained means the page or repo shows recent activity or, where it does not, I say so. And each tool has to return something you can act on: a URL, a record, a field, a snapshot. I skipped tools that only wrap another tool on this list.
The list splits into two groups. The first six take a person's identifier and return accounts. The last six take a domain, a file or a query and return context. Beginners should start with the first group and the beginner's kit; investigators who already have a handle will find the second group is where cases get proven.
The best free OSINT tools for usernames, emails and phones
1. OSINTsearch, free plan
Best for: one paste that covers all three pivots. The search takes a username, email or phone and streams live results from 770 username endpoints, 203 email modules and 24 phone modules. Returns: a card per hit with profile URL, display name, avatar, bio, user id, joined date and outbound links where the platform exposes them, plus the identity block that clusters them. Price: Free is 15 full sweep searches a week, no card, quotas resetting Monday 00:00 UTC. Starter at $20 adds CSV and JSON export and breach names and dates; details on the pricing page. Scope: the free plan shows every field but does not export, so it is for reading what exists on screen before deciding what to keep. The scripts below give you raw output at zero cost; OSINTsearch gives you the depth per hit and the sweep without the upkeep.
2. Sherlock
Best for: learning how username checking works. The repo's line is "Hunt down social media accounts by username across 400+ social networks." Install with pipx install sherlock-project. MIT. Returns: a URL per platform where the handle resolves. Scope: presence only, one rule per site, which is what makes it the right first tool. The Sherlock alternative post covers what to add when you outgrow it.
3. Maigret
Best for: the biggest free site list and the best reports. Maigret will "collect a dossier on a person by username from 3000+ sites," defaulting to the 500 highest by traffic, and it "performs recursive search using discovered usernames and other IDs." Reports in HTML, PDF, XMind, JSON, CSV and TXT, plus a graph view. pip install maigret, MIT. Scope: it is a username tool; email and phone stay with the entries below.
4. WhatsMyName
Best for: the cleanest dataset. WhatsMyName is "a community-maintained dataset that lets you find out if a username exists across hundreds of websites," 700+ sites in one JSON file, created in 2015 by Micah Hoffman to cut false positives. The browser version at whatsmyname.app is free. CC BY-SA 4.0. Scope: a data file and a checker, deliberately minimal, which is why other tools import it.
5. Holehe
Best for: a silent email existence check. Holehe "checks if an email is attached to an account on sites like twitter, instagram, imgur and more than 120 others" and "does not alert the target email." pip3 install holehe, GPL v3. Scope: a used flag per service and nothing more, which is the point. The best email OSINT tool post ranks it against the hosted options.
6. PhoneInfoga
Best for: the number's shape. It is an "information gathering framework for phone numbers" that returns country, area, carrier and line type, then tries VoIP providers and phone books through external sources. CLI, Docker and REST API. GPL v3. The repo is marked "stable but unmaintained," so pin a version. Scope: it describes the number; confirming which apps a number is registered on is what the OSINTsearch phone modules do.
Six for infrastructure, history and metadata
7. SpiderFoot
Best for: automating the wide net. "SpiderFoot automates OSINT for threat intelligence and mapping your attack surface," with over 200 modules and targets that include IPs, domains, subnets, ASNs, email addresses, phone numbers, usernames, names and Bitcoin addresses, behind an embedded web UI. MIT. Scope: breadth over depth per hit; it is the map, not the dossier.
8. theHarvester
Best for: passive discovery on a domain. It gathers hostnames, emails, IPs, URLs, ASNs, names and breach records from 59+ sources including certificate transparency logs and code repositories. The project asks that you "run it only against targets you own or have explicit permission to test." Scope: domain first; it produces the addresses that the identifier tools then check.
9. Wayback Machine
Best for: what a page said before it changed. The Internet Archive's Wayback Machine serves dated snapshots of URLs, which is how you read a bio that was edited, a profile that was deleted, or a handle that was renamed. Scope: it archives what was crawled, so a profile that never drew a crawl has no snapshot. Pair it with the old usernames guide.
10. Google search operators
Best for: finding the page that no scanner lists. Google's own help page documents exact match quotes, site:, the minus sign for exclusion, before: and after: for dates, and filetype:. A query like "handle" site:reddit.com after:2024-01-01 is often the fastest route to a forum post. Scope: it only finds what is indexed, and each result is a candidate to be proven, never a confirmation.
11. ExifTool
Best for: what a file says about itself. Phil Harvey's ExifTool is "a platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files," covering EXIF, GPS, IPTC, XMP and maker notes across more than 300 formats. Version 13.59 as of May 2026, free. Scope: most social platforms strip metadata on upload, so it shines on originals, documents and files from anywhere other than a feed.
12. Shodan, free account
Best for: the infrastructure behind a domain or IP. Shodan calls itself "the world's first search engine for Internet-connected devices," and its billing page says "all Shodan accounts come with a free API plan." A one-time $49 Membership adds 100 query and 100 scan credits a month. Scope: devices and services, not people; it enters a social case when a personal domain or self-hosted service turns up in a bio.
The comparison table and the coverage chart
| Tool | Input | Returns | Free tier | Runs |
|---|---|---|---|---|
| OSINTsearch | Username, email, phone | Profiles with fields, identity block | 15 full sweeps a week | Hosted, no account |
| Sherlock | Username | Profile URLs | MIT | Local |
| Maigret | Username | Dossier, reports, graph | MIT | Local |
| WhatsMyName | Username | Presence per site | CC BY-SA 4.0 | Local or browser |
| Holehe | Used flag per service | GPL v3 | Local | |
| PhoneInfoga | Phone | Country, carrier, line type | GPL v3 | Local, Docker |
| SpiderFoot | Domain, IP, email, name | Linked entities | MIT | Local, web UI |
| theHarvester | Domain | Emails, hosts, names | Open source | Local |
| Wayback Machine | URL | Dated snapshots | Free | Browser |
| Google operators | Query | Indexed pages | Free | Browser |
| ExifTool | File | Metadata | Free | Local |
| Shodan | Domain, IP | Exposed services | Free API plan | Browser, API |
pipx install sherlock-project maigret holehe
sherlock handle --print-found
maigret handle --top-sites 500 --html
holehe [email protected] --only-used
exiftool -a -G1 photo.jpgA free workflow that holds up
- Paste the handle into OSINTsearch for the full sweep and note the platforms, ids and joined dates on the cards.
- Run Maigret or Sherlock on the same handle. Each tool has its own pool; two runs give a fuller picture than one.
- Run Holehe on any address you hold and PhoneInfoga on any number, then confirm registrations with the OSINTsearch email and phone modules.
- Pull Wayback snapshots of the profiles that matter and search operators for the forum posts scanners never list.
- Run ExifTool on any original file, and Shodan or SpiderFoot on any personal domain that appears in a bio.
When a case is worth money, the free plan is where you see whether the sweep found enough to justify Starter's export and higher quota. If you are weighing paid tools, the best paid OSINT tools post is the companion to this one.
FAQ
What is the best free OSINT tool for usernames?
For depth per hit, the OSINTsearch free plan, because its cards carry bios, ids and joined dates rather than a bare URL. For a local script, Maigret for the site list and reports, Sherlock for learning the model.
Are free OSINT tools legal to use?
Reading public pages is generally lawful; purpose decides the rest. Consent, a client's authorization or a legitimate investigation are the safe bases. Employment, tenancy, credit and insurance decisions are off limits for every tool on this list.
Do I need to install anything?
Not to start. OSINTsearch, whatsmyname.app, the Wayback Machine, Google operators and Shodan all run in a browser. The scripts need Python or Docker and an afternoon.
Why run two username tools on the same handle?
Every tool checks its own pool of sites with its own detection rules. Overlap confirms a hit; the difference shows you what each pool covers. Two runs is the cheapest corroboration there is.
Twelve tools, zero dollars
The best free OSINT tools in 2026 are a hosted sweep for the three identifier pivots, three username scripts, one email and one phone checker, and six that give a case its context. Install them, run them on yourself, and keep the ones you still open in six months.
