OSINT Tools: Free and Paid Tools by Investigation Task

What Are OSINT Tools?

Software and services that find, collect, organize or preserve publicly and commercially available information so an analyst can answer a specific question.

The US intelligence community defines open-source intelligence as intelligence derived exclusively from publicly or commercially available information that addresses specific requirements (IC OSINT Strategy 2024–2026). The tools are the collection and analysis layer under that definition. They do not decide what is relevant, true or lawful to use; the analyst does.

In practice, OSINT investigation tools come in five forms: lookup scripts that check one identifier against hundreds of sites, public registries and databases, recon frameworks that chain data sources, commercial platforms with licensed data and sales-led pricing, and analysis and capture software for link charts, evidence and alerts.

Tool directories such as the OSINT Framework and Bellingcat's Online Investigations Toolkit list hundreds of resources. This page is narrower: a working OSINT toolkit by task, with representative tools in each group and links to our individual reviews in the OSINT tool reviews hub. If you only want zero-cost options, see the separate guide to free OSINT tools.

OSINT Tools List at a Glance

Ten investigation tasks, each with free and paid options; the right mix depends on the question, the jurisdiction and how the result will be used.

People and Username Search Tools

Username tools check whether a handle exists on hundreds of sites; people-search platforms add licensed records and identity resolution, at a price.

People often reuse a handle across sites. Username checkers query each site and report where a profile appears to exist; paid platforms resolve emails, phones and names into one identity using data free scripts cannot reach.

Enterprise identity platforms such as Pipl (identity resolution for fraud and investigations teams, pricing not public) and Skopenow (entity reports and link analysis for qualified organizations, free trial, pricing via sales) sit at the top of this category.

Caution. A matching username is a lead, not an identity. Common handles produce false positives, and a missing result does not prove an account does not exist. If the search supports a hiring or tenancy decision in the US, consumer reporting rules may apply (see legal limits). For a verified answer, see our username investigation service.

Email and Phone Number Lookup Tools

Email and phone tools show which services an identifier is registered with and whether it appears in known breaches; results are signals that need corroboration.

OSINT Industries, listed above, is the common paid option for email and phone pivots. Caution. Tools that probe password-recovery pages or reuse your logged-in session interact with live services, so platform terms and rate limits apply, and the session belongs to you. Never use a client's or subject's credentials. Our email address and phone number investigations explain what a verified check covers.

Company, Ownership and Sanctions Research Tools

Official registries and open datasets are the backbone of company research; paid tools add coverage, history, matching and alerts.

Commercial risk platforms such as Babel Street add multilingual identity matching and vendor risk intelligence (Babel Street). Caution. Registry coverage and ownership disclosure vary widely by country, and a name in a leak database is not evidence of wrongdoing. Commercial use of non-commercial datasets breaches their license. For ownership questions that registries do not answer, see company investigations and due diligence.

OSINT Tools for Domains and Internet Infrastructure

Domain and infrastructure tools map subdomains, hosts, certificates, exposed services and page behavior, mostly through passive lookups.

Caution. Passive lookups read data others have already collected. Active scanning or vulnerability testing of systems you do not own requires written authorization. Public urlscan.io scans are visible to anyone, so never submit a URL that reveals your client or case. Related services: website and domain investigations and red team OSINT reconnaissance.

Image Verification and Geolocation Tools

Reverse image search, metadata readers, video verification plugins and satellite imagery let an analyst test where and when a photo or video was taken.

Caution. Uploading a sensitive image to an online service shares it with that service. Face-search services raise separate privacy and biometric-data issues and are outside this catalog. When an image is evidence in a dispute or a news decision, see geolocation verification and image and video verification.

Social Media Investigation Tools

Commercial social media platforms search, collect and chart public posts and accounts at scale; free scripts exist but often depend on logged-in scraping.

Caution. Platforms restrict automated collection in their terms, and data protection regulators have told social media companies and scrapers that publicly accessible personal data is still protected (joint statement on data scraping, 2023). Do not create fake profiles to see private content. Our social media investigations work only with lawfully accessible material.

Dark Web and Data Leak Search Tools

Leak and dark web search tools index paste sites, breach data and Tor services so you can see whether an identifier or company has been exposed.

Caution. Never buy stolen data or log in with leaked credentials. Minimize and secure any leaked personal data you handle, and expect malware and scams on dark web sites. For ongoing coverage see dark web monitoring and leaked credential monitoring.

Link Analysis and Case Management Software

Link analysis tools turn hundreds of findings into a graph of people, companies, accounts and infrastructure, so connections and gaps become visible.

ShadowDragon Horizon and Skopenow, covered above, also include link analysis modules. A graph is only as good as its inputs: record the source and date of every node, and keep unverified links visually distinct from confirmed ones.

Web Capture and Evidence Preservation Tools

Capture tools save what you saw, with the URL, time and page content, so a finding can be checked and defended after the page changes or disappears.

The Berkeley Protocol on Digital Open Source Investigations sets out preservation and documentation practices used by international investigators. When captured posts may go to court, see social media evidence capture.

OSINT Monitoring and Alerting Tools

Monitoring tools repeat searches on a schedule and alert you to new mentions, page changes or events, from free alerts to analyst-grade platforms.

ShadowDragon Horizon Monitor and Maltego Monitor (Enterprise plan) also fit here. Caution. The recon toolkits bundled with some dashboards can scan ports and vulnerabilities; use them only on systems you are authorized to test. For alerts reviewed by analysts, see OSINT monitoring.

How to Choose OSINT Investigation Tools

Start from the question and the jurisdiction, then compare coverage, total cost, maintenance and data handling before you buy anything.

1. Write the question firstOwnership questions need registries and sanctions data; account attribution needs username, email and social tools.
2. Check coverage for your jurisdictionsAsk vendors which countries and platforms they cover, and test known cases during a trial.
3. Count the full costAdd credits, seats, API add-ons and analyst time; a free script that needs a day of fixes is not free.
4. Check maintenanceCheck the last release and open issues; scripts break quietly when sites change.
5. Read the terms and data handlingConfirm where searches and results are stored, whether commercial use is allowed and what the license requires.

Building an OSINT Workflow, Step by Step

Good workflows move from requirements to collection, verification, capture, analysis and a sourced report, with one tool per job.

1. Set requirements and a lawful purposeRecord what you need to know, why, and your legal basis.
2. Prepare a clean environmentUse a dedicated browser profile or virtual machine and turn on capture before you start.
3. Collect broadly, then narrowRun identifier lookups and registry searches, then follow only the leads that answer the question.
4. Verify with a second sourceConfirm each key finding through an independent source.
5. Capture and logSave pages, timestamps and URLs as you go, with notes on how each item was found.
6. Analyze connectionsChart people, companies and accounts, marking confirmed and inferred links.
7. Report with sourcesState findings, confidence and limits, and cite every source so a reader can check the work.

OPSEC Basics for Online Investigators

Keep your identity, your client and your case out of the tools you use, and assume every lookup leaves a trace somewhere.

• Separate identities. Never research from personal social accounts. Some platforms show profile visitors, and logged-in tools act as you.
• Mind what online tools keep. Search terms, images and URLs may be stored or published by the service.
• Isolate unknown code. Run community scripts in a virtual machine or container, installed from the official repository.
• Protect the results. Encrypt case files, restrict access and delete what you no longer need.
• Use managed attribution where the risk justifies it. Commercial platforms offer it for sensitive research; a VPN alone does not hide behavior patterns.

Legal Limits No Tool Removes

Public does not mean free to use for any purpose: data protection, consumer reporting, platform terms and computer misuse laws still apply.

• Data protection. Under the GDPR, organizations that collect personal data from sources other than the person must generally tell that person, subject to exceptions (Article 14 GDPR). Have a legitimate purpose and keep only what you need.
• Employment and tenancy screening in the US. Information compiled by a third party for hiring decisions can be a consumer report under the Fair Credit Reporting Act, with notice and consent duties for the employer (FTC guidance).
• Platform terms and scraping. Regulators expect platforms to protect public personal data against unlawful scraping (joint statement).
• No intrusion. No hacking, no pretexting, no fake profiles to reach private content, no purchase of stolen data, and no locating people without a lawful purpose. Tools do not change any of these rules.

When to Hire Investigators Instead of Buying Tools

Hire help when the stakes are high, the subject spans several countries, the result must stand up in court or nobody has time to verify what tools produce.

Tools collect; people verify and decide. A team that runs one investigation a quarter rarely recovers the cost of licenses, training and upkeep. Outsourcing makes sense when a deal, a hire, a dispute or a threat depends on the answer and false positives would be expensive.

OSINT-S uses many of the tools above alongside licensed sources and manual research, with a senior analyst review before reporting. Focused checks start from 10 business days, comprehensive work can take up to about a month, and urgent delivery carries a 50% surcharge. Each engagement has a fixed quote after written scoping. Compare OSINT investigations, hiring an OSINT investigator and working with an OSINT agency, or see all of our OSINT services.

Sources and Notes

• ODNI: IC OSINT Strategy 2024–2026
• Sherlock repository (GitHub)
• Maigret repository (GitHub)
• Opsis: plans
• OSINT Industries: pricing
• Holehe on PyPI
• GHunt repository (GitHub)
• PhoneInfoga repository (GitHub)
• Epieos: pricing
• Have I Been Pwned: subscriptions
• GOV.UK: get information about a company
• SEC: EDGAR full-text search
• ICIJ Offshore Leaks Database
• OpenCorporates: plans and pricing
• OpenSanctions: licensing
• OSINT Combine: NexusXplore
• Babel Street: platform
• Shodan: pricing
• Censys: pricing
• theHarvester repository (GitHub)
• SpiderFoot repository (GitHub)
• urlscan.io: pricing
• TinEye: search limits
• WeVerify: InVID-WeVerify verification plugin
• Social Links: products
• ShadowDragon: Horizon platform
• Osintgram repository (GitHub)
• Intelligence X: product and pricing
• Liferaft: platform
• Maltego: pricing
• Lampyre: pricing
• Gephi
• Hunchly: pricing
• Webrecorder: ArchiveWeb.page
• Google Alerts
• ShadowBroker repository (GitHub)
• Bellingcat: Online Investigations Toolkit
• OHCHR: Berkeley Protocol on Digital Open Source Investigations
• GDPR Article 14
• FTC: using consumer reports, what employers need to know
• ICO and partners: joint statement on data scraping (2023)

Sources checked 10 October 2026. Tool descriptions, licenses and prices are as published by the vendor or repository on that date. OSINT-S has not run independent tests of these tools, has no affiliation with any vendor and does not resell tools. This page is a catalog, not a ranking.

Related pages

• Free OSINT tools
• OSINT tool reviews
• OSINT investigations
• Hire an OSINT investigator