Free OSINT Tools

Comprehensive collection of free OSINT tools for digital research and investigations, threat intelligence and information gathering from open sources. All five free OSINT tools run in the browser with no signup, no install, no usage cap.

View Checklist Generator

Blog

Checklist Generator

The Checklist Generator is a free tradecraft assistant that generates crisp, printable OSINT pivot lists, so every step of a case is written down before collection starts.

Try tool

View Digital Image Forensics

Blog

Digital Image Forensics

The Image Forensics Tool is a free, digital image forensics tool for detecting photo manipulation. It runs error level analysis (ELA), reads image metadata and compares two images side by side. ELA resaves the image at a known JPEG quality and maps the difference, so edited areas with a different compression history stand out. Uploaded files are processed locally and never leave your machine.

Try tool

View Email Permutator

Blog

Email Permutator

The free Email Permutator generates plausible email candidates from names and usernames. It includes org-mode corporate formats, locale packs (RU, UA, PL, TR, NL and EN), transliteration variants, nicknames, validity checks and confidence scoring.

Try tool

View Google Dork Assistant

Blog

Google Dork Assistant

Google dorks for OSINT are advanced search queries that surface publicly indexed documents, profiles and pages a standard Google search buries. The Google Dork Assistant is a free Google dork generator that turns a plain-language research goal into a precise dork. Each result comes with an operator-by-operator explanation.

Try tool

View Open Sources Toolkit

Blog

Open Sources Toolkit

The Open Sources Toolkit is a free tradecraft assistant for exploring and pivoting through OSINT sources, using curated tools, categories and quick search.

Try tool

How to choose free OSINT tools for an investigation

To choose free OSINT tools for an investigation, match the tool to the identifier you hold and the question you need answered.

A name or username goes to the Email Permutator to enumerate candidate addresses.
A research goal with no obvious source goes to the Google Dork Assistant, which writes the advanced search for you.
A photo whose provenance matters goes to Digital Image Forensics for error level analysis and metadata.
A case with many pivots goes to the Checklist Generator so no step gets skipped.
When you do not know where to look, the Open Sources Toolkit lists curated sources by category.

Investigators who choose free OSINT tools this way spend less time on tooling and more time on OSINT techniques that produce evidence.

Nico Dekens, Senior SANS Instructor and a ShadowDragon contributor, put the same point more bluntly on Maltego’s Pivot Podcast:

“The biggest tool I use is my brain.”
– Nico Dekens, Senior SANS Instructor and ShadowDragon contributor, former Dutch law enforcement. The Pivot Podcast (Maltego), May 2023

The free OSINT tools above shorten the mechanical steps so that judgment, not tooling, decides the case.

Which free OSINT tools work online without installing anything

Free OSINT tools that work online without installing anything include all ShadowDragon® tools on this page: the Google Dork Assistant, Email Permutator, Digital Image Forensics, Checklist Generator and Open Sources Toolkit.

Each OSINT tools runs online in a standard browser with nothing to install and no account to create. Digital Image Forensics processes uploaded photos locally, so files never leave the machine.

That matters on locked-down government and corporate workstations, where IT blocks desktop software and Python packages but allows a browser. It also matters on a clean research virtual machine that is wiped after each case.

OSINT tools for social media investigations

Free OSINT tools for social media work best as pivots rather than as scrapers.

The Email Permutator turns a known name into candidate addresses that can be checked against account recovery flows on major platforms.
The Google Dork Assistant builds site: and inurl: queries that surface public profiles and posts a normal search buries.
The Open Sources Toolkit groups username, image and social media sources in one place.

ShadowDragon® documents the full five-step method in its guide to OSINT social media search. The SocialNet® API covers the collection depth that free tools cannot reach.

Free OSINT tools for Android and mobile

Free OSINT tools for Android need no app when they are browser based. Every tool on this page loads in Chrome or Firefox on an Android phone or tablet.

Digital Image Forensics runs its error level analysis on the device, which keeps case photos off third-party servers. Field investigators use the Google Dork Assistant and Checklist Generator on mobile during interviews and site visits, then move to a desktop for link analysis.

For the same reason, the tools also work on iOS and ChromeOS.

Free tools vs the OSINT Framework

The OSINT Framework is a free, volunteer-maintained web directory that organizes hundreds of open source intelligence tools by the data type you start with, such as username, email address, domain or social media. The OSINT Framework links out to tools but does not run any of them.

The free OSINT tools on this page are the opposite: five utilities ShadowDragon® built and hosts, each solving one task in the browser.

Use the OSINT Framework to discover sources for an unfamiliar data type, then use these tools to act on what you find.

We explain the directory in detail in its OSINT Framework guide.

Limitations of free OSINT tools

Free tools have limitations when conducting open source intelligence investigations and research.

They cannot verify, correlate or preserve what they find. A dork returns pages, a permutator returns candidates and an ELA map flags regions worth a second look. Each output still needs a human to confirm it against a second source and to record how it was found.

Free OSINT tools also lack audit logs, case management and cross-platform correlation, which matter the moment findings reach a prosecutor, a compliance officer or a board.

The Horizon® platform picks up where free tools stop, with Identity for rapid triage, Investigate for link analysis and Monitor for ongoing collection.

Eliot Higgins, founder of Bellingcat, gave Chatham House the test every lead has to pass:

“Simply, it is a question of whether the information available in the piece of evidence supports the claim being made.”
– Eliot Higgins, Founder, Bellingcat. The World Today, Chatham House, December 2022

A free tool produces the piece of evidence. Only the investigator can say whether it supports the claim.

Frequently Asked Questions

Can ChatGPT perform OSINT?

ChatGPT can do parts of OSINT and help automate investigations, such as planning a search strategy or summarizing collected material, but ChatGPT is not an OSINT tool and cannot replace one. Large language models do not run live searches reliably, invent sources and cannot show how a result was found, which rules their output out as evidence.

Use ChatGPT to draft queries, then run the actual OSINT collection with purpose-built tools such as the Google Dork Assistant and verify every claim against a primary source.

What are the top 10 OSINT tools?

The top OSINT tools for professional investigators in 2026 include Maltego, Shodan, SpiderFoot, theHarvester, Recon-ng, Have I Been Pwned, ExifTool, Google dorks and the OSINT Framework directory.

We compare 24 free and paid options in its best OSINT tools guide. The five free OSINT tools on this page cover the search, email, image and checklist steps that sit at the start of nearly every case.

How do you use OSINT to find someone?

Follow these steps to use OSINT to find someone. Each step turns the identifier you have into the next one.

Start with one confirmed identifier. A full name, an email address, a username or a photo. Write down where it came from before you search.
Turn the name into candidate email addresses. Run the name through the Email Permutator and keep the formats that match the person’s employer or region.
Turn the email into a username. Most people reuse the part before the @ sign. Search that string on its own and note every platform where it appears.
Turn the username into public profiles. Build site: and inurl: queries with the Google Dork Assistant to surface profiles and posts a plain search buries.
Turn the profile photo into other appearances. Run a reverse image search on the profile picture to find the same image on other accounts or sites.
Log every pivot as you go. Record each step in the Checklist Generator so a colleague or a court can retrace how you got from the first identifier to the last.

We explain how to find a person with OSINT in its OSINT background check guide. Only collect what the law and your mandate allow.

Is there a free OSINT password finder?

No free OSINT tool should hand you someone’s password. Using leaked credentials is a crime in most jurisdictions.

What investigators can do lawfully is check whether an email address appears in a known breach, using a service such as Have I Been Pwned, then record the breach date and source as context.

ShadowDragon® free tools do not query breach data.

Are these OSINT tools really free?

Yes. All of our tools are free to use with no account, no trial clock and no usage cap.

ShadowDragon® publishes them for the investigative community and keeps its commercial products, Horizon® and SocialNet®, separate.

Do the tools upload my files or store my data?

Digital Image Forensics does not upload your files. It processes images inside the browser, so photos stay on your machine.

The other free OSINT tools send only the text you type in order to generate a result and store no case data. The ShadowDragon® Trust Center documents the data handling policy.