Open-Source Intelligence Platform

Free OSINT Tools & Open-Source Intelligence Platform

A hands-on, continuously re-tested directory of the internet's best free OSINT tools — for domain recon, username search, breach checks, and image forensics. Every listing is installed and run by an analyst before it earns a place here.

Browse Free Tools See the Workflow
60+ tools hands-on testedUpdated August 2026Zero paid placements
Scroll

60+

tools hands-on tested

8

recon categories covered

0

paid placements accepted

2026

last full review — August

Manually Verified

Every listing installed & run by an analyst, not scraped from a press kit.

No Pay-to-Rank

Placement and ordering are never influenced by sponsorship.

Rolling Re-Tests

Free-tier limits and detection accuracy get re-checked on a schedule.

Source-Cited

Claims link to primary documentation, not secondary blog summaries.

Recon Surface

Filter the Directory by Category

Eight investigation surfaces, from identity to infrastructure. Select one to filter the featured tools list below to exactly what you need.

Field-Tested Toolkit

Featured Free OSINT Tools

No marketing copy — just what each tool actually does well, where it breaks, and when we'd reach for it. Every entry below is a genuinely free OSINT tool or has a workable free tier.

Sherlock

Username enumeration across 400+ sites

CLI

A Python CLI that hits hundreds of social platforms with a candidate username and infers existence from HTTP status codes and response text. It is fast, dependency-light, and the standard first move in a username pivot.

Field Note

Expect false positives on sites that return HTTP 200 for a "user not found" page instead of a proper 404 — Sherlock flags these as hits unless the detection string is well maintained. Always open a handful of top results manually before you trust the list; treat the output as a shortlist, not a verdict.

Best for
A fast first pass when you only have a handle and need to know where to look next.
Pricing
Free & open source (MIT)
Identity · Full review Visit

Maigret

Deep username OSINT with profile extraction

CLI

Maigret checks a much larger site list than Sherlock (3,000+) and goes further per hit — pulling bio text, avatar URLs, linked accounts, and IDs it finds on the profile page, then rendering a readable HTML or PDF report.

Field Note

It is noticeably slower and noisier than Sherlock because it actually parses page content instead of just checking status codes — which is exactly why it's worth running as a second pass on your shortlist rather than your only tool. Recursive search (following extracted links to search again) is powerful but can spiral scope fast; cap the depth on your first run.

Best for
Turning a confirmed username hit into a structured profile with linked identifiers.
Pricing
Free & open source (MIT)
Identity · Full review Visit

theHarvester

Emails, subdomains & employee names from public sources

CLI

Queries search engines, PGP key servers, certificate transparency logs, and other passive sources to compile subdomains, email addresses, and employee names tied to a target domain — no direct interaction with the target required.

Field Note

Results depend heavily on which modules still have working, unrate-limited access — some search-engine modules break silently when a provider changes its markup or throttles scraping, so run with -b all and check the module output for errors, not just empty results. Pair with crt.sh for a more reliable subdomain baseline.

Best for
Quickly seeding an email and subdomain list before a deeper Amass sweep.
Pricing
Free & open source (GPL-3.0)
Domain Recon · Full review Visit

Amass

In-depth attack surface & subdomain mapping

CLI

OWASP Amass combines DNS enumeration, scraping, certificate transparency, and dozens of third-party API integrations into one graph-based attack-surface mapping tool. Its intel and enum subcommands are the workhorses for building a domain asset inventory.

Field Note

The passive-only mode is quiet but thinner; the active mode adds brute-force DNS resolution and zone-walking, which is more complete but detectable and heavier on the target's DNS infrastructure — know which mode you are running. It genuinely benefits from API keys (SecurityTrails, Shodan, Censys) in your config file; without them you are seeing a fraction of what it can find.

Best for
Building a full subdomain and asset inventory before a domain-wide review.
Pricing
Free & open source (Apache-2.0)
Domain Recon · Full review Visit

SpiderFoot

Automated OSINT across 200+ modules

CLI / Library

A reconnaissance automation engine with both a local web UI and a CLI, SpiderFoot runs a target (domain, IP, email, or username) through 200+ modules and correlates the results into a browsable entity graph.

Field Note

Run the "footprint" or "investigate" presets before you ever enable "all modules" — an unscoped full run against a domain can take hours and generates a wall of low-value data that is genuinely tedious to triage. The free/OSS edition covers the vast majority of modules; SpiderFoot HX is the hosted, paid version with extra correlation and cloud infrastructure.

Best for
Automating breadth-first recon when you need coverage across many data types at once.
Pricing
Free & open source (MIT) — HX cloud tier is paid
All-in-One · Full review Visit

Maltego CE

Visual link-analysis for entity relationships

GUI

Maltego's free Community Edition brings its signature graph-based link analysis — entities, transforms, and relationship mapping — to a capped but genuinely usable desktop client, ideal for visualizing how people, domains, and infrastructure connect.

Field Note

CE caps you at 12 results per transform and requires a free account registration to activate, which surprises people expecting a no-signup download. The transform hub also mixes free community transforms with paid ones (like premium breach or social APIs) — read the pricing on each transform before running it, since some silently require credits.

Best for
Visually mapping how multiple entities (people, domains, IPs) relate once you have raw data.
Pricing
Free (Community Edition, capped) — paid tiers unlock more transforms & results
All-in-One · Full review Visit

Shodan

Search engine for internet-connected devices

Web

Shodan continuously scans the public internet and indexes service banners, so instead of searching web page content you search what is actually listening on a port — webcams, industrial control systems, exposed databases, routers, and more.

Field Note

The free account gives you a small monthly query credit and hides some filters behind a paid membership — budget your queries and use `filter:` syntax precisely rather than broad searches that burn credits fast. Banner data can be stale by days or weeks; always confirm a finding is still live before acting on it.

Best for
Discovering exposed services and misconfigured infrastructure tied to an IP range or org.
Pricing
Free tier (limited credits) — paid membership for full filters & volume
Infra Search · Full review Visit

Censys Search

Certificate & host data at internet scale

Web

Censys indexes hosts and TLS certificates across the entire IPv4 space and a large slice of IPv6, making it especially strong for pivoting from a certificate (SAN, issuer, fingerprint) to every host that shares it.

Field Note

The free tier's query allowance is tighter than Shodan's and resets monthly — I default to Censys specifically for certificate-based pivots (shared SANs are a genuinely reliable way to cluster infrastructure) and use Shodan for general banner/service search, rather than treating them as interchangeable.

Best for
Pivoting from a TLS certificate to every other host that reuses it.
Pricing
Free tier (limited queries) — paid plans for higher volume & API access
Infra Search · Full review Visit

Have I Been Pwned

Check an email or domain against known breach corpora

Web

The de facto reference breach-notification service. It checks an email address against hundreds of aggregated breach datasets and also supports domain-wide monitoring for verified domain owners.

Field Note

The public web lookup is free and needs no account; the k-anonymity Pwned Passwords API is also free and safe to use for checking password hashes without ever sending the full password. Programmatic email lookups via the official API now require a paid key — plan around that if you are automating checks rather than doing one-off manual lookups.

Best for
The fastest sanity check on whether an email has appeared in a known breach.
Pricing
Free web lookup — paid API key required for programmatic/bulk queries
Breach Data · Full review Visit

holehe

Which sites is this email address registered on?

CLI

holehe checks an email address against dozens of platforms' "forgot password" or account-creation endpoints to infer whether an account exists — without ever logging in, since most sites leak this via subtly different response behavior for registered vs. unregistered addresses.

Field Note

Sites change their signup/reset flows often enough that modules break silently — a "not found" result can just as easily mean the module is stale as it can mean no account exists, so cross-check anything you plan to rely on. It is genuinely useful as a fast triage step before a manual per-platform check.

Best for
Quickly narrowing which platforms to check manually once you have a target email.
Pricing
Free & open source (GPL-3.0)
Breach Data · Full review Visit

crt.sh

Certificate transparency log search

Web

A free web front-end over the public Certificate Transparency logs. Search a domain and get every certificate ever issued for it and its subdomains — which, because CT logging is mandatory for public CAs, is one of the most reliable passive subdomain sources available.

Field Note

Wildcard and SAN certificates mean you will see subdomains that were only ever used briefly, or internal names accidentally included on a public cert — worth cross-referencing against DNS to confirm what is still live. The site occasionally queues under load; the same data is available via a documented JSON API (`?q=domain&output=json`) if you are scripting it.

Best for
The single most reliable free source for passive subdomain discovery.
Pricing
Free, no account required
Domain Recon · Full review Visit

Wayback Machine

Internet Archive's historical snapshots of the web

Web

The Internet Archive's web archive holds snapshots of pages going back decades. For investigations it recovers deleted content, tracks how a page's claims changed over time, and via its CDX API lets you enumerate every URL ever archived under a domain.

Field Note

The CDX API (`web.archive.org/cdx/search/cdx?url=domain/*&output=json`) is the real power tool here — it returns every captured URL under a domain in one query, which is far faster than manually browsing the calendar UI for site-wide historical recon. Snapshot frequency varies wildly by site popularity, so absence of a capture is not proof a page never existed.

Best for
Recovering deleted pages or proving what a site said at a specific point in time.
Pricing
Free, no account required
Time Machine · Full review Visit

ExifTool

Read & write metadata in images, docs, and media

CLI / Library

Phil Harvey's ExifTool is the reference implementation for reading metadata out of virtually any file format — EXIF, IPTC, XMP, GPS coordinates, camera/device identifiers, editing software history, and document authorship fields.

Field Note

GPS EXIF data is the highest-value field for geolocation work, but remember most social platforms strip it on upload — you generally only find it in originals shared directly (email, messaging, cloud storage links) rather than social media posts. `exiftool -a -u -g1 file.jpg` surfaces hidden and duplicate tags that the default output quietly collapses.

Best for
Pulling GPS coordinates, device info, and authorship data out of a raw image or document.
Pricing
Free & open source (Perl Artistic License)
File Forensics · Full review Visit

Recon-ng

Modular, Metasploit-style recon framework

CLI

A CLI recon framework with a workflow deliberately modeled on Metasploit: workspaces, modules, and a marketplace you install modules from before running them against a target, storing results in a local database you can query and pivot on.

Field Note

Many modules wrap third-party APIs and need keys configured via `keys add` before they return anything — running a fresh install straight out of the box against a target will mostly produce empty results until you've set that up. The workspace/database model is genuinely good for keeping a multi-session investigation organized, more so than most single-shot CLI tools.

Best for
Keeping a long-running, multi-session investigation organized in one queryable workspace.
Pricing
Free & open source (GPL-3.0)
All-in-One · Full review Visit
Methodology

The Investigative Workflow We Actually Use

OSINT is a process, not a tool list. This is the six-step sequence we run on every investigation — scoping, passive collection, correlation, verification, authorized active recon, and reporting.

Step 01

Define Scope & Authorization

Write down what you are allowed to look at, and why, before opening a single tool.

Every real investigation starts with a scope note, not a search bar: what target (person, domain, org), what data you have a legitimate reason to collect, and whether you are staying strictly passive or have explicit authorization to go active. Skipping this step is the single most common way OSINT work drifts into a legal or ethical grey zone.

Step 02

Passive Footprinting

Pull from sources that never touch the target — search engines, certs, archives, usernames.

Run the low-noise sources first: crt.sh for certificate-issued subdomains, the Wayback Machine CDX API for historical URLs, and Sherlock or Maigret for username presence. None of this generates a log entry on the target's own infrastructure, which keeps your footprint invisible while you build a baseline.

crt.sh Wayback Machine Sherlock Maigret
Step 03

Correlate Identifiers

Turn a scattered list of handles, emails, and subdomains into one connected picture.

This is where holehe and theHarvester earn their keep — feeding email addresses back through service checks and pulling in employee names or additional subdomains you missed. Drop everything into a link-analysis view (Maltego CE, or even a plain spreadsheet) so relationships between entities become visible instead of buried in separate tool outputs.

holehe theHarvester Maltego CE
Step 04

Verify & Eliminate False Positives

The step most beginners skip — and the one that separates a lead from a finding.

Automated tools optimize for recall, not precision: a Sherlock hit or a stale holehe result can easily be wrong. Manually open the profile, check the join date and posting history against your timeline, and require at least two independent sources before you treat a correlation as fact. If a claim only has one shaky source, it is a lead to chase, not a conclusion to write down.

Step 05

Active Recon — Authorized Only

Direct interaction with target infrastructure, gated strictly behind written authorization.

Amass's active mode, direct port/service probing, or anything that sends traffic the target can log is a different category of activity and needs explicit permission — a pentest scope, a bug bounty program, or written consent. Shodan and Censys stay useful here precisely because they are passive: someone else already did the scanning, so you can pivot on infrastructure without touching it yourself.

Amass Shodan Censys Search
Step 06

Document, Hash & Report

An unrecorded finding does not survive scrutiny. Capture it like it will be challenged.

Screenshot with a visible timestamp and URL bar, archive the live page with the Wayback Machine's 'Save Page Now', and SHA-256 hash any downloaded file the moment you get it — that hash is your proof the evidence was not altered later. Write the report with a source citation on every claim; 'trust me' does not hold up, a verifiable chain does.

Editorial Standards

Built by People Who Actually Run These Tools

OSINTPanel exists because most 'best OSINT tools' lists are written without ever opening a terminal. Our directory is maintained by a small research team that treats tool review as investigative work in its own right.

Last full review: August 2026 Next scheduled review: November 2026

Disclosure: OSINTPanel does not accept payment, free products, or any consideration in exchange for placement, ranking, or a favorable review.

E

Experience

Every tool is installed, configured, and run against real or synthetic targets before it is written up — not summarized from a landing page.

E

Expertise

Write-ups are grounded in actual investigative workflow: passive vs. active recon, false-positive handling, and evidentiary standards.

A

Authoritativeness

We link to primary sources — official repos, vendor docs, RFC-level references — instead of secondary blog posts repeating each other.

T

Trustworthiness

No paid placement, no affiliate ranking bias, and outdated or broken tools get flagged or removed on a rolling review schedule.

Our Testing Checklist

  • Install the free tier exactly as a first-time user would — no vendor-provided demo accounts.
  • Run each tool against a controlled, consented target set to verify claimed capabilities.
  • Document actual rate limits, false-positive patterns, and any signup friction.
  • Cross-check every claim against the tool's own changelog or repository before publishing.
  • Re-test on a rolling schedule; deprecated or broken tools are flagged within the listing, not silently left inaccurate.
Frequently Asked

OSINT Tools & Open-Source Intelligence — FAQ

Straight answers about legality, cost, and how this directory is put together.

OSINT (Open-Source Intelligence) is the practice of collecting and analyzing information from publicly available sources — search engines, social media, public records, DNS data, and archived web pages — to build an accurate picture of a person, domain, or organization. It relies entirely on data that is legally and openly accessible, not hacking or unauthorized access.

Yes. Every tool featured in our core directory has a genuinely free tier or is fully open source under a permissive license. Where a tool also sells a paid enterprise tier (like Shodan or Censys), we clearly label the free-tier limits so you know exactly what you get before signing up.

Using OSINT tools to gather publicly available information is generally legal in most jurisdictions. However, what you do with that information, and how you gather it, matters: scraping behind logins, bypassing rate limits, or using findings to harass or stalk someone can violate terms of service or the law. Always confirm you have a legitimate purpose and check local regulations before investigating a real person or organization.

Start with Sherlock for username-based social media enumeration and crt.sh for domain/subdomain discovery via certificate transparency logs. Both are free, require no account, and return results in seconds, making them the fastest way to learn how OSINT correlation works before moving to heavier frameworks like SpiderFoot or Maltego CE.

Every tool is manually installed and run against real (consented or synthetic) targets by our editorial team before it is listed. We verify the free tier still works as advertised, note rate limits and false-positive behavior, and re-test tools on a rolling basis. We do not accept payment for placement or ranking.

Passive recon collects data without ever touching the target's systems — search engines, WHOIS, certificate transparency logs, cached pages, and breach databases. Active recon interacts directly with the target, such as port scanning or DNS brute-forcing, which is detectable and requires explicit authorization. Most OSINT investigations should start passive and only escalate with permission.