Every tool here is free or has a meaningful free tier. Organized by data type. Usage notes focus on when to use each tool and what signals to look for — not just what it does.
The gold standard for privacy-focused OSINT workflows. Michael Bazzell's comprehensive browser-based tools for pivoting from usernames, emails, phone numbers, or names into public data.
Check if an email has appeared in known data breaches. Essential first step for digital footprint audits — breach exposure often surfaces associated accounts and real names.
Surfaces Google accounts and other services linked to an email address — passively. Does not notify the target. Useful for confirming identity or finding associated usernames.
Command-line tool that searches 300+ platforms for a given username simultaneously. Run it against your own accounts first — you'll find accounts you forgot existed.
Fast username/email lookup across social platforms. Lighter than Sherlock for quick lookups. Also accepts email addresses for cross-platform account discovery.
Username enumeration across hundreds of sites with a focus on accuracy over speed. The underlying data is open source and well-maintained by the OSINT community.
Multi-tool site for reverse WHOIS, DNS records, IP history, and hosting history. A single domain can have years of hosting changes and ownership transfers visible here.
Discovers and maps a domain's subdomains, DNS records, and host relationships visually. Excellent for understanding the full infrastructure footprint of an organization.
Search engine for internet-connected devices and TLS certificates. Identify server configurations, find certificate relationships, and discover infrastructure before it's documented.
Searches for internet-connected devices by banner, port, or software version. Primarily used to understand what's exposed on a network before an authorized assessment.
The Internet Archive's historical snapshots of web pages. Critical for documentation — evidence degrades. A site's previous content, contact pages, and staff listings may still be accessible here.
The regional internet registries (ARIN for North America, RIPE for Europe) provide authoritative IP address and ASN ownership data. More authoritative than third-party WHOIS lookups.
Browser extension designed for video and image verification. Pulls metadata, keyframes for reverse searching, and contextual checks in one click. Designed for journalists.
Uses Error Level Analysis (ELA) to detect areas of an image that may have been digitally altered. Free, browser-based. Not definitive, but a strong signal when patterns are consistent.
Consistently the most powerful reverse image search for finding manipulated or reused photos. Indexes different content than Google and TinEye — run all three for thoroughness.
Primary desktop tool for 3D terrain analysis and historical satellite imagery. The time slider makes it essential for verifying when a location photograph was taken and what the landscape looked like.
Identifies mountain ranges and peak profiles from photographs. Essential for geolocating images that include mountain skylines — including anywhere along the Colorado Front Range.
High-frequency satellite imagery for monitoring environmental and infrastructure changes over time. Free tier provides significant capability for open research and journalism.