Lists of the best paid OSINT tools tend to be written by people who never opened the pricing page. On 2026-09-05 I fetched every vendor's own site and wrote down what it says. Where a price is listed, it is here. Where a vendor only says "contact sales", I say that and stop. I build OSINTsearch, so it goes first.
The ranking is by what you get for the money on the question most investigators bring: who is behind a username, an email or a phone number. Tools that answer other questions well rank lower on that criterion only, and each gets a plain statement of what it is best for.
How the best paid OSINT tools were ranked
Four things were counted for each tool: input, what a hit contains, the entry tier list price, and where its scope ends. The last one is not a complaint; a breach archive is not supposed to return a bio.
| Rank | Tool | Inputs | Entry paid tier | Best for |
|---|---|---|---|---|
| 1 | OSINTsearch | Username, email, phone | $20/mo, 50 searches a week | Depth per hit, dossier, export |
| 2 | Fingerprint.to | Username, email, phone | $30/mo, 500 tokens | Fast streamed sweeps |
| 3 | Revealer.us | Username, email, phone | $12.99/mo, 25 social lookups a day | Breach and stealer log correlation |
| 4 | osint.industries | Email, phone, username, name, crypto wallet | £19/mo, 30 credits | Email first casework with cloud cases |
| 5 | Maltego | Any entity, via transforms | €3,000/yr (free Community Edition) | Link analysis across many sources |
| 6 | Shodan | IPs, hostnames, filters | $49 one time, or $69/mo Freelancer | Internet connected devices |
| 7 | Intelligence X | Email, domain, IP, phone, wallet, more | €2,500/yr Researcher | Leaks, pastes and darknet archives |
| 8 | Social Links | Face, name, phone, email, alias | Book a demo | Agency scale investigation platform |
| 9 | Pipl | Email, phone, name, address, username | Contact sales | Enterprise identity and fraud signals |
1. OSINTsearch: depth per hit at a flat monthly price
Best for: turning one identifier into a full, exportable picture of the public accounts behind it. A search fans out to 997 endpoints, 770 for usernames, 203 for email and 24 for phone, and streams back every account as a normalized profile: user id, display name, bio, location, follower counts, creation date, picture and, where a platform exposes them, former usernames, last-active dates and a banned or deleted flag. Bios and outbound links are parsed, and the export closes with an identity block naming the probable person, the probable country and every username variant seen, with the platforms that agree on each.
Price: Free gives 15 searches a week, the full sweep with full unmasked results and no card, so you see the data before paying anything. Starter is $20 a month for 50 searches a week and adds CSV and JSON export and breach name and date. Pro is $49.99 a month for 500 a week and adds full breach records and deep search at four depths. Enterprise is custom with API access and team seats. Quotas reset Monday 00:00 UTC; the pricing page has the unit costs for deep search.
Scope: it is a social search, not a device index or a breach archive. Nothing is stored after the export, so download the file when the scan ends.
2 to 4: the hosted social search tools
Fingerprint.to. Best for a fast, streamed first pass. It takes a username, email or phone, says it searches public profiles across 700+ platforms, and shows results in real time with filtering, sorting and export. Profiles carry bios, follower counts, join dates, locations and linked accounts. Price: $0 to start with a monthly allowance, Pro at $30 a month for 500 tokens with history and exports, Max at $100 for 2,500 tokens with deep search. Scope: username, email and phone only, with no breach index. Head to head numbers are in OSINTsearch vs Fingerprint vs Revealer.
Revealer.us. Best for social accounts and breach exposure in one report. It searches public sources and breach datasets for an email, username or phone, says it covers 800+ platforms, and its AI Deep Search follows reused handles. Price: a free tier with preview results, Starter at $12.99 a month for 25 social and 50 breach lookups a day, Basic at $29.99 with 150 social lookups a day and unlimited breach lookups, Pro at $79.99 with 500 a day and a REST API. It is the cheapest paid entry here. Scope: quotas are daily, and the deepest per-profile fields are where OSINTsearch spends its effort instead.
osint.industries. Best for email-led casework with storage attached. It searches email, phone, username, name and crypto wallets, and every plan includes cloud cases and storage. Price: Basic at £19 a month for 30 credits, Intermediate at £49 for 100 credits with API access and PDF and Word reports, Advanced at £99 for 300. Credits do not expire monthly. Scope: a credit is a search, so the price per lookup is higher than the flat quota tools; the trade is case management. The osint.industries alternative post does the per-lookup math.
5 to 7: the specialist platforms
Maltego. Best for visual link analysis across many sources. Maltego Graph draws entities and relationships, and transforms pull data from its hub and third party providers. Price: a free Basic tier with the Community Edition and 200 credits a month, Entry Standard at €3,000 a year with 10,000 credits and Hunchly, Professional at €7,500 a year for up to 5 users with unlimited Maltego Search and commercial data, and custom Enterprise. Scope: Maltego is a canvas; the social data on it comes from whichever transforms you license.
Shodan. Best for anything with an IP address. It indexes internet connected devices and their banners, and paid tiers add monitoring and scanning. Price: a one time $49 Membership with 100 query credits, Freelancer at $69 a month with 10,000 query credits and commercial use, Small Business at $359, Corporate at $1,099. Scope: Shodan does not know who a username belongs to and was never meant to. It is here because most investigations eventually touch infrastructure.
Intelligence X. Best for historical leaks, pastes and darknet content. It searches by email, domain, URL, IP, phone, crypto address and other selectors across paste sites including historical ones, Tor and I2P, Wikileaks and Cryptome, whois and web archives. Price: a free tier after a 7 day trial, Researcher at €2,500 a year for 200 searches a day, API at €7,000, Identity Portal at €10,000, Enterprise at €20,000. Scope: an archive of documents rather than a live scan of platforms, so it pairs with a social search.
8 and 9: enterprise platforms sold by demo
Social Links. Best for agencies and large security teams. SL Crimewall is an all in one investigation platform with over 1,500 search methods across more than 500 sources, from social media to the dark web, with graph, table and map views, image and text analysis, team dataspaces and PDF and CSV reporting; SL Professional runs inside Maltego and there is an OSINT API. Price: none listed; you book a demo or request a trial. Scope: procurement rather than a card checkout, right for a team of twenty and out of reach for a solo analyst.
Pipl. Best for identity verification and fraud decisions at enterprise scale. Pipl Search resolves identities from email, phone, name, address and username against a graph it describes as 5B+ identities across 150+ countries, and Pipl Trust returns a trust score with reason codes. Price: contact sales. Scope: built for authorization and onboarding workflows, so its output is a risk decision more than a list of live profiles.
Picking one, or two, for the job
If the question is "who is behind this handle, email or number", the first three tools answer it and the rest do not try to. OSINTsearch is the one to open first because each hit carries the most, the dossier does the correlation for you, and a full free sweep costs nothing to evaluate on the live search. Add Fingerprint when speed on a single pass matters, and Revealer when the case needs breach context in the same report. Each has its own platform pool; when a result has to be complete, run two.
The specialists earn their fee on other questions: Shodan for infrastructure, Intelligence X for what has already leaked, Maltego when the graph is the deliverable, Social Links or Pipl when there is a procurement process behind the request. Ranking them lower says nothing about their quality, only about which question this list scored.
For usernames specifically, the best username OSINT tools post ranks nine scripts and services by what a hit contains. To start at zero, the best free OSINT tools post covers the open source side.
FAQ
Which paid OSINT tool is the cheapest to start with?
Of the vendors that list a price, Revealer Starter at $12.99 a month is the lowest, then OSINTsearch Starter at $20, osint.industries Basic at £19 and Fingerprint Pro at $30. OSINTsearch is the only one whose free tier shows full results.
Do any of these tools have a real free tier?
Yes. OSINTsearch runs the full 997 endpoint sweep for free, 15 searches a week, with full results shown. Fingerprint and Revealer offer free searches, Maltego has a free Community Edition, and Intelligence X keeps a limited free tier after its trial.
Why is Shodan on a list about people search?
Because investigations rarely stay on one layer. A handle leads to a domain, a domain leads to a host, and Shodan is the paid tool for that host.
Can I use these tools for background checks on employees or tenants?
No. None of them is a consumer reporting agency, and OSINTsearch's terms exclude employment, tenancy, credit and insurance decisions outright.
Pay for the question you have
Every tool here is worth its price to someone. The mistake is buying the longest feature page and hoping it covers your question. Start with the identity search, add the specialist when the case crosses into its territory, and keep every export, because the export is the only thing you own when the subscription ends.
