ThatsThem Reverse Email Lookup: What the Free Result Shows Now, and Where to Go Next

A ThatsThem reverse email lookup is still the first thing a lot of people try when an unknown address lands in their inbox, and for good reason: it is free, it needs no account, and a result renders from a bare URL. What that result contains has changed. I loaded two email result pages on 2026-09-05 in a normal browser, copied the page text field by field, and this post describes exactly what is visible now, what sits behind the Reveal buttons, and where those buttons lead.

Then I cover the part ThatsThem does not try to do. A directory lookup maps an address to a US public-records identity. It does not tell you which platforms that address is registered on right now, and that second question is often the one that matters when you are triaging a sender or building a profile. OSINTsearch answers it with 203 email modules and shows every field on the free plan, so the two make a natural pair.

What a ThatsThem reverse email lookup shows for free now

ThatsThem's email landing page frames the product as "Reverse Email Lookup / Find Out Who Owns an Email FOR FREE", and the homepage calls it a "100% Free People Search". The result URL is predictable: thatsthem.com/email/<address>. There is no login, no card and no trial funnel of any kind.

For a common address, [email protected], the header read "Found 21 results" with "Last updated 4 months ago." Each record card carried the same set of labels. Here is the shape of the first card, with every value replaced by a placeholder because the record belongs to a private individual:

Lives in [city], [state]
Born [two-year range] ([age] years old)
PHONE NUMBERS:
[area code]-[exchange]-
[8 entries, every one cut after the exchange]
Reveal complete phone numbers now
CURRENT ADDRESS:
[street name, house number removed]
[city], [state] [ZIP]
Uncover full current and past addresses now
EMAIL ADDRESSES:
[first letter]@[domain]
[21 entries; only the queried address shown in full]
Search for all social and dating profiles now

So the free view today gives you a full name, city and state, a birth-year range with a derived age, the street name and ZIP with the house number removed, the area code and exchange of every phone with the last four digits removed, the domain and first letter of every linked email, and a count of associated social profiles. For a public figure's address the page returned one record: the name, the queried email, and a "Reveal 1 social profile now →" link.

Where the Reveal buttons go

This is the detail most older guides miss. ThatsThem has no checkout of its own, and no ThatsThem price was presented anywhere in the flow. Every "Reveal complete phone numbers now →", "RUN FULL BACKGROUND SEARCH" and "VIEW PREMIUM REPORT" control on the result pages is labeled "Sponsored By". The landing page source contains affiliate banner elements with ids like spokeo-email_search_v103 linking to spokeo.com.

In plain terms: the masked fields are not a ThatsThem upsell. They are the point where a free directory hands you to a paid third-party people-search site. I walked that funnel separately in the Spokeo email search alternative post.

What ThatsThem does well

ThatsThem does several things better than most of the category:

• Genuinely free and account-free. No signup, no card, no trial. That is rare and it makes the site ideal for a thirty-second triage of an unknown sender.
• A stable, shareable URL scheme. thatsthem.com/email/<address> is easy to teach, bookmark and cite in a report.
• Freshness stamps on every record. "Last updated just now." and "Last updated 4 months ago." are data-quality signals most competitors never surface.
• The masked view is still decision-useful. Name, city, age band, ZIP, area code and a count of linked emails is often enough to confirm or kill a hypothesis for free.
• Depth per identity within US records. Multiple historical phones, many linked addresses and address history clustered under one name is real aggregation work. The site says its data comes from "more than 50 sources each of which is updated monthly".
• A plain FCRA notice in the site-wide footer, not buried in terms.

Directory record versus live accounts

Here is the boundary. ThatsThem takes an email and returns a compiled record about a US person: legal name, age, address history, phone history. It has four search types, name, address, phone and email. Username is not one of them, and platform coverage is not what it sells.

A live social search asks a different question: where is this address registered right now. Each of OSINTsearch's 203 email modules sends the address to a platform's own signup or account endpoint, silently, and reads the answer. The result is a list of accounts, not a records file, and it is current at the moment of the scan rather than stamped "4 months ago". The guide on what's behind the email walks through the three classes of answer a module can give.

Running the same address through OSINTsearch

Paste the address into the search and the email modules run in parallel. What comes back falls into three shapes. Registration confirmations are the bulk of it: Gravatar, GitHub, WordPress, a specific forum, a learning platform, a regional news site, each one a yes that the address has an account there, with a profile URL where the platform has one.

The second shape is masked recovery hints. Where a large provider shows a partial recovery phone or backup address in its own account flow, the module returns it exactly as the platform publishes it, something like +1 •••-•••-4821 or j••••@gmail.com. Read those next to ThatsThem's truncated phones and the two masks cover each other: ThatsThem gives you the area code and exchange, the platform hint gives you the last four digits, and together they often confirm a single number without either side revealing it.

The third shape is the pivot. The local part of an address, the string before the @, is a username far more often than it is random. OSINTsearch runs it across 770 username endpoints and returns profiles with bios, avatars, outbound links and creation dates where the platform publishes them, plus an identity block that puts the avatars side by side so you can spot reuse. Instagram hits resolve by numeric id and expose former usernames, which is how a renamed or banned account stays findable.

{
  "input": "[email protected]",
  "registered": ["gravatar", "github", "wordpress", "..."],
  "masked_phone": "+1 •••-•••-4821",
  "pivot_username": "john.smith",
  "username_endpoints": 770
}

To give a sense of the depth per hit, the same pivot on a public figure's handle, davidbombal, scanned 770 endpoints in 29 seconds and returned 59 profiles on 2026-09-05: a YouTube channel created in 2008 with 3,100,000 subscribers, a verified Twitter account from 2009 with location England and a website, an Instagram account with its numeric id and 526,041 followers, a GitHub profile with 17 repos and the bio "Author, Instructor and YouTuber", and an identity block where 18 sources agree on the name. That is what a live search adds to a directory record.

Every field of that is visible on the free plan: 15 searches a week, full sweep, no card. Starter at $20 a month adds CSV and JSON export and breach names with dates, Pro at $49.99 adds deep search and full breach records. The matrix is on the pricing page. Nothing is stored beyond anonymous query metadata for abuse prevention, so your export is your only copy. For a wider survey of the category, see the best email OSINT tool roundup, and for the manual versions of each check, how to see behind an email address.

FAQ

Is ThatsThem reverse email lookup still free?

Yes. As of 2026-09-05 the result page renders with no account and no payment. What has changed is the masking: complete phone numbers, house numbers, full linked emails and social profiles sit behind Reveal links that are labeled Sponsored By and lead to a third-party paid service.

Does ThatsThem show social media accounts?

It shows a count, for example "Reveal 1 social profile now →", and the profiles themselves are behind the sponsored link. A live social search such as OSINTsearch returns the accounts directly, with the platform, the profile URL and whatever bio and avatar the platform publishes.

Will an OSINTsearch email lookup notify the owner?

No. Every module reads a platform's answer without sending the address anything, so no reset mail or login code is triggered by a search.

Two lookups, one address

ThatsThem tells you who, in US records, with the fields partly masked and the unmasking handed to a sponsor. OSINTsearch tells you where, across 203 email services and 770 username endpoints, with every field shown for free and the whole list exportable when you need it. Run the directory for the name, run the live search for the accounts, and let the masked hints from each side fill in the other's blanks.