Identity Investigation
57 toolsTools for tracing people online — username search, email OSINT, phone lookup, social footprint mapping, and identity correlation across platforms.
Pricing
Min Rating
Top-Rated Tools
ExifTool
4.5/5The definitive open source tool for extracting hidden metadata from images, video, and documents.
freeSherlock
4.5/5Hunt usernames across 400+ social networks simultaneously with no API keys or accounts required.
freeHave I Been Pwned
4.4/5The fastest way to confirm whether an email address appears in known data breaches — free, accurate, and maintained by a single researcher who vets every dataset.
freemiumAwesome OSINT
4.3/5A massive, investigator-friendly directory for finding the right OSINT tools before you waste time using the wrong ones.
freeHunchly
4.3/5Automatic web capture and evidence management for OSINT investigators
paidOSINT Framework
4.3/5Navigate from target data type to relevant tools in seconds — an interactive tree that mirrors how investigators actually work, not how tools are alphabetically organized.
freeComparisons & Buyer Guides
Best Privacy Tools for OSINT Investigators (2026)
VPNs, password managers, and identity tools that protect investigators while they work. Reviewed for OPSEC utility, not consumer marketing claims.
Best VPNs for OSINT Investigators (2026)
The best VPNs for OSINT work — IP separation, malicious domain blocking, and anonymous browsing sessions for professional investigators.
Maltego vs OSINT Industries (2026)
Maltego vs OSINT Industries compared for identity investigation and OSINT link analysis. Which tool is right for your workflow?
NordVPN vs Surfshark for OSINT (2026)
NordVPN vs Surfshark compared for OSINT investigators. Covering Threat Protection, Alternative ID, privacy jurisdiction, speed, and price.
Best AI Tools for OSINT Investigators (2026)
Independent comparison of the best AI tools that make OSINT investigators faster — AI search, voice transcription, report writing, data extraction, and presentation tools.
Best OSINT Tools (2026): The Complete Independent Guide
Independent comparison of the best OSINT tools across every category — identity investigation, network reconnaissance, dark web monitoring, social media, training, and more. No vendor sponsorship.
Guides & Techniques
Business and Corporate OSINT: Corporate Structures, Shell Companies, and Directors
Business and corporate OSINT is the process of moving from a company name to a defensible picture of directors, ownership, subsidiaries, and related entities using registry records and filings. Its value is not just finding a company entry, but linking official records across jurisdictions so control patterns, shell-company indicators, and real-world activity can be assessed without drifting into speculation.
US Government Records OSINT: Property, Court, Vital, License, and Campaign Finance
US government records OSINT is the practice of working directly from official federal, state, county, and city sources to build defensible profiles of people, businesses, and relationships. Its value is not just finding a name in a database, but linking records across jurisdictions so property ownership, legal activity, occupational history, family events, and political ties form a verifiable timeline.
Username Enumeration Techniques Across Platforms
Username enumeration techniques help investigators locate accounts tied to a handle across social, professional, gaming, and niche platforms. The real value is not just collecting profile URLs, but validating which accounts actually belong to the same person through systematic comparison, confidence scoring, and cross-platform corroboration.
npi-registry-osint-healthcare-provider-intelligence
The NPI Registry is CMS's public lookup and bulk dataset for every US healthcare provider and covered organization with a National Provider Identifier. For investigators, it is a high-value source for linking clinicians to clinics, surfacing shared control signals, and tracing healthcare network expansion across states.
osint-for-journalists
This guide walks investigative journalists and general reporters through practical OSINT workflows for source verification, image authentication, corporate research, and geolocation confirmation. It covers the core tools and methods used in modern newsrooms, with a focus on documentation discipline and operational security. Designed for reporters with no prior OSINT background who need a reliable starting framework.
osint-for-law-enforcement
This guide explains how law enforcement can use open source intelligence in investigations, from suspect identification and social media research to location verification and dark web monitoring. It focuses on practical workflows, evidentiary discipline, and operational security considerations that matter in real investigative environments.
osint-for-private-investigators
This guide shows how private investigators can use open-source intelligence to verify identities, trace locations, research assets, and document digital evidence. It also covers the legal boundaries that matter most in PI work, including DPPA, FCRA, licensing, and evidence preservation standards.
Best OSINT Newsletters: Staying Current in Open Source Intelligence
The newsletters worth subscribing to if you want to stay current on OSINT techniques, tools, and investigations — from practitioner-focused weeklies to threat intelligence briefings.
Corporate and Financial OSINT: Investigating Companies, Ownership, and Money Flows
How to investigate corporations, beneficial ownership, financial relationships, and asset structures using open source tools — from SEC filings to corporate registry searches.
OSINT Companies Directory: Professional Intelligence and Investigation Firms
A directory of professional OSINT, threat intelligence, and investigation companies — from enterprise threat intelligence vendors to boutique investigation firms.
OSINT Training Platforms and Practice Resources
Where to actually learn OSINT — the courses, platforms, CTFs, and practice environments worth your time, from free beginner resources to professional certifications.
Phone Number OSINT: How to Research a Number Without Calling It
A workflow for extracting carrier data, owner identity, and social account linkage from a phone number using free and paid tools.
The Bellingcat Online Investigation Toolkit: What's In It and How to Use It
A breakdown of the Bellingcat Online Investigation Toolkit — the tools serious investigators actually use, with reviews of the paid options worth your budget.
How to Use an AI Agent to Audit and Lock Down Your Digital Footprint
AI agents can dramatically accelerate a personal privacy audit — drafting opt-out requests, tracking data broker removals, and guiding you through the process step by step. Here's how to use them safely.
Email OSINT: Find Anyone's Digital Footprint From an Email Address
A complete guide to email OSINT — breach lookup, service discovery, header analysis, and username derivation. Techniques used by professional investigators.
How to Protect Your Digital Footprint (What OSINT Reveals About You)
Most people don't know how much information is publicly available about them. This guide shows you what OSINT investigators can find — and what you can do to reduce your exposure.
What is OSINT? Open Source Intelligence Explained
A complete guide to open source intelligence — what OSINT is, how it's used, who uses it, and the tools and techniques that drive modern investigations.
More Identity Investigation Tools
OSINT Industries
Search engine for digital footprint — email, phone, username across 200+ sources
TinEye
Find where an image originated, when it first appeared online, and every modified version that shares its visual fingerprint — without relying on metadata or keywords.
GitFive
Pulls hidden GitHub identity clues into one workflow so investigators can pivot faster from a developer footprint.
iKy
An email-first OSINT tool that helps investigators turn one address into a broader profile, timeline, and set of defensible leads.
Nox-Framework
Automates identity pivots across a wide source set, but only pays off if you can control the noise.
Osint-D2
Correlates usernames, emails, aliases, and behavioral clues into a single investigative profile instead of stopping at surface-level account enumeration.
Proton Mail
End-to-end encrypted email under Swiss jurisdiction, designed so that Proton itself cannot read your messages.
ProtonVPN
Swiss-based VPN with open-source client and strong jurisdiction for journalists and investigators
Snoop
A username OSINT tool that helps investigators find profiles on CIS-region and Russian-language platforms global username checkers often miss.
Socid-Extractor
A focused OSINT utility for turning public profile pages into structured identity clues fast.
SpiderFoot
Map a target's full digital footprint automatically — domains, IPs, emails, names, and ASNs across 500+ sources.
Spyder OSINT
A GUI-based OSINT toolkit that lets investigators pivot across phone, IP, username, and domain lookups without juggling multiple separate tools.
TCM Security OSINT Course
Practical OSINT training for investigators and security professionals
Arkham Intel
On-chain intelligence platform that deanonymizes blockchain addresses and maps crypto fund flows
Brand24
Real-time social media monitoring and brand intelligence for OSINT investigators
NordVPN
Encrypted tunnel and threat protection for OSINT investigators working in hostile environments
ShadowDragon
Social media intelligence and OSINT automation for law enforcement and enterprise
Social Analyzer
Search a username across 1000+ social networks with confidence-scored results and structured JSON output — a material step above binary found/not-found enumeration.
Social Links
Enterprise OSINT platform with 500+ data sources and 1,700+ investigative methods for social media, dark web, and blockchain investigation
Surfshark
VPN with built-in identity monitoring and anonymous browsing identity tools
Ubikron
The OSINT browser extension that runs 200+ enrichments from any web page
Babel Street
Global multilingual intelligence platform for government, law enforcement, and enterprise
MacPaw
Mac software suite for system cleanup, file management, and operational hygiene
NordPass
Password manager with breach monitoring built for secure credential hygiene
BeenVerified
Consolidate criminal records, address history, and associate data on US subjects in a single report — with broader court record coverage than most consumer people-search competitors.
Intelligence X
A search engine and permanent data archive that indexes dark web content, full breach records, historical WHOIS, and deleted documents — content that disappeared from the public web still lives here.
Maigret
Username OSINT tool that checks 2,500+ sites, extracts profile data from hits, and automatically pivots to linked identifiers found in discovered accounts.
OpenPlanter
Autonomous AI investigation agent that resolves entities across corporate registries, campaign finance, lobbying disclosures, and government contracts — surfacing non-obvious connections with evidence citations.
Proton Pass
End-to-end encrypted password manager with built-in email aliasing for investigators who need compartmentalized identities and Swiss-jurisdiction credential storage.
theHarvester
Passively harvest emails, subdomains, and hostnames from public sources before you touch a single target system.
Dehashed
A breach credential database with 14+ billion records, searchable by email, username, phone, IP, domain, and hash.
DeleteMe
Delegate the multi-day work of data broker opt-outs to a service that repeats the process quarterly — so re-populated listings get caught, not just the first pass.
Hide My Name
Budget VPN with wide server coverage for basic IP separation during investigations
mailcat
A nickname-to-email discovery tool that helps investigators turn known handles into likely email addresses without contacting the subject.
Mitaka
A browser extension that turns highlighted indicators into instant OSINT and threat intelligence lookups without breaking analyst flow.
O&O SafeErase
Certified secure disk wiping for investigators who need to sanitize devices before disposal or reuse
PhoneInfoga
Validate, format, and enumerate phone numbers from public sources before you invest time in manual investigation.
SEON
Fraud detection and digital identity verification using OSINT-based enrichment
Spokeo
Consolidate address history, phone, email, and associate data on US subjects in a single report before you start working individual sources.
FaceCheck.ID
Reverse face search engine that finds where a face appears across social media and the public web
Hunter.io
Email address lookup and verification tool that searches publicly indexed sources for addresses associated with a domain
PimEyes
Facial recognition search engine that finds where a face appears across the web
NordProtect
Identity theft protection and dark web monitoring from Nord Security
Proton Drive
End-to-end encrypted cloud storage under Swiss jurisdiction for investigators who can't trust iCloud or Google Drive with case files.
WhatsMyName
Takes a username and checks whether an account exists on 500+ platforms via HTTP pattern matching — no login, no scraping, no cost.
Wondershare Recoverit
Data recovery software for investigators recovering deleted files, drive evidence, and mobile data
Epieos
Submits an email or phone number and returns linked social accounts, Google profile data, and carrier information without touching the target platforms directly.
Maltego
The gold standard for visual link analysis and OSINT pivoting
Telusion (Tossable Digits)
Virtual US phone numbers with real carrier attribution, usable for account registration, covert contact, and operational separation.
GHunt
Queries Google's internal APIs from the command line to extract account metadata from a Gmail address — name, photo, linked services, Maps reviews, and more — for free.
Social Catfish
People search and reverse lookup platform focused on online identity verification and catfish detection