The OSINT Framework is a free, centralized, web-based directory of open-source intelligence tools, organized into 33 categories by the data an investigation starts with. Created by Justin Nordine, it lists 1,170 tools and runs no searches of its own.
The OSINT Framework is a free, web-based directory of open-source intelligence tools, created by security researcher Justin Nordine, that sorts those tools into a clickable tree by the type of data you start with: a username, an email address, a domain, an image or a phone number. It does not run searches itself. It points you to the tool that does, which makes it a map of OSINT tooling rather than a tool.
This guide covers what the framework contains, which tools inside it professional investigators use most and how to work through it step by step.
What is the OSINT Framework? An overview
Justin Nordine, a security researcher who holds SANS GIAC certifications, created the OSINT Framework in December 2015 and published its source on GitHub under the MIT license. The site at osintframework.com reads one data file and renders it as an expandable tree.
The framework is used in criminal investigations, corporate security, fraud and financial investigations, cybersecurity, security research, investigative journalism and law enforcement. In each field it does the same job: it tells the investigator which tool reads which open source, from websites and social platforms to public records and breach data.
Unlike individual OSINT tools that focus on one data type, such as IP lookups or email tracing, the OSINT Framework works as a roadmap. It connects you to tools across 33 categories and saves the time you would otherwise spend hunting for them.
That spread beyond infosec is why the category list now runs from sanctions screening to disinformation checks.
The OSINT Framework is maintained, not grown: 335 commits in 2026 to 22 October against a tool count that has stayed near 1,180 since 2018. Source: github.com/lockfale/OSINT-Framework commit history.
What the OSINT Framework is not
The OSINT Framework does not run searches itself, and you do not have to install it. It is a directory: every node in the tree is a link to an external tool, and that tool does the searching, scraping or lookup.
The site runs in any browser at osintframework.com with no installation.
Some linked tools do need to be installed: the (T) marker flags a tool that must be installed and run locally, and 211 of the 1,170 entries carry it as of October 2026. The (R) marker flags registration, (D) flags a Google dork and (M) flags a URL you edit by hand.
Treat the framework as a map of where to look. Collection, validation and analysis stay with you, which is why the methodology section below matters more than the tool list.
Craig Silverman, who has covered verification for more than a decade, puts the same point about tools this way:
The OSINT framework’s modular design lets you explore categories that match one data type, such as username checks, domain name hunting or location-based data, and tailor the approach to the case in front of you.
3. Accessibility
The framework is free to use and open source under the MIT license, so anyone can use it for educational or professional purposes. That lowers the cost of entry for small agencies and independent analysts and lets them uncover important information in an ethical manner.
4. Up-to-date information
Community pull requests keep the OSINT framework current. The GitHub history shows 334 commits since 1 March 2026, including a March 2026 reorganization that added categories for cloud infrastructure, compliance and risk intelligence, disinformation and media verification and mobile OSINT, reflecting the latest technological trends.
5. Integration ready
Many of the tools it links to can be incorporated into broader intelligence platforms or workflows, such as threat intelligence feeds, SIEM systems or automation scripts, which makes it useful in complex investigative environments. This flexibility lets you combine open-source data with internal sources or other intelligence disciplines for deeper analysis.
OSINT Framework categories
The OSINT Framework organizes its tools into 33 top-level categories. Each category targets one data type or investigative focus, such as usernames, email addresses, domains or IP addresses. Most split further into subcategories.
The categories are displayed in a tree-like structure. You expand a branch to reach subcategories and linked tools, which also surfaces aliases, patterns and pivots you may not have considered at the start.
The table below lists every category in the live framework, the number of tool links in each one and two verified examples. Counts come from the framework’s data file on 29 October 2026.
<!– OSINT Framework categories table, v2 for the ShadowDragon text module. Everything below is ONE line on purpose: the editor converts line breaks inside
Tools = number of tool links in the category branch of the framework's data file. "Added 2026" marks categories introduced in the framework's March 2026 reorganization. Every example was checked against the data file on the count date; tool links point at the URL the framework uses.
OSINT Framework tools: the best picks by investigation type
The best OSINT Framework tools are the ones that answer the question your case starts with. The framework lists 1,170 tools, and most investigators use fewer than forty of them regularly.
The picks below are grouped by the identifier you hold at the start of an investigation. Every tool named here is present in the framework as of 29 October 2026; (T) means it installs locally and (R) means it needs an account.
Username and people search
Start with WhatsMyName Web and Namechk to find where a handle is registered, then run Sherlock (T) when you need the full list of hits from the command line. ThatsThem and PeekYou cover the People Search Engines category for US subjects.
The Email Address category holds 30 tools across five subcategories. Have I been pwned? answers whether an address appears in a known breach. Hunter and the Email Permutator pattern tools help you guess a corporate address format; ShadowDragon’s free email permutator does the same job without an account.
Epieos and Holehe (T) show which services an address is registered on. theHarvester (T) collects addresses tied to a domain for reconnaissance work.
Domains, IP addresses and cloud infrastructure
Domain Name is the largest category in the framework at 146 tools. DomainTools Whois and ViewDNS.info handle registration and DNS history, crt.sh exposes subdomains through certificate transparency logs and Shodan and Censys show what is listening on an IP address. Recon-ng (T) and SpiderFoot (T) automate the enumeration.
The Cloud Infrastructure category, added in the March 2026 reorganization, lists tools such as Public Buckets for exposed storage.
Images, video and media verification
Google Images reverse search is the first stop for a photo. ExifTool (T) reads metadata where a platform has not stripped it. For verification, FotoForensics runs error level analysis and the InVID-WeVerify plugin breaks video into keyframes you can reverse search. ShadowDragon’s free image forensics tool covers error level analysis in the browser.
For geolocation, SunCalc checks shadow angles against a claimed time and place and Wikimapia names features that commercial maps leave unlabeled.
Social networks and messaging
Twitter Advanced Search still supports date, location and account operators. Social Searcher runs keyword searches across several networks at once. Fedifinder maps an account to the fediverse. Telegago (T) and the Google CSE for Telegram links reach public Telegram channels.
Twilio Lookup returns carrier and line type, Phone Validator confirms whether a number is live and True Caller crowdsources a caller name. PhoneInfoga (T) chains several of these checks from the command line.
Ahmia indexes onion services that opt in. OnionScan and the Hunchly Hidden Services Report help you discover and document them. For blockchain tracing, Blockchair covers several chains and Etherscan covers Ethereum. Running these from a Tor Browser (T) session is standard practice.
Threat intelligence and malware
AlienVault OTX supplies free indicators, MITRE ATT&CK names the techniques and Exploit DB records the public exploits. VirusTotal and Hybrid Analysis analyze suspicious files. The Cyber Threat Intelligence category holds 62 tools, which puts it among the five largest in the framework.
OpSec, evidence capture and AI detection
Tor Download (T) and the DNS leak test belong in every analyst’s setup. Archive.is preserves a page at a point in time and Forensic OSINT (T) captures evidence with hashes. The AI Tools category, added in June 2024, lists detectors such as GPTZero and Hive for checking whether text or images were machine generated.
Every tool above is a point solution. ShadowDragon® SocialNet® pulls the social, username and email pivots into one graph. Horizon® adds link analysis and monitoring on top. The best OSINT tools comparison ranks the commercial options side by side.
How to use the OSINT Framework
To use the OSINT Framework, start from the identifier you already hold, open the matching top-level category at osintframework.com and work down the tree to the tool that answers the next question. If you hold a username, open the Username branch; an email address opens Email Address; a photo opens Images / Videos / Docs.
Each tool result becomes a new identifier, and each new identifier sends you back into the framework. The thirteen steps below show how to use the OSINT Framework inside a defensible investigative process.
Creating a secure workspace is also critical. Protect the environment from threats and make sure it supports operational security, so your activity is not detected and no data leaks.
2. Define intelligence requirements
Start by defining what information you need to gather. This keeps the investigation focused and aligned with its objectives.
Outline the purpose and goals of the research. Set the scope, including what is and is not relevant.
Identify the key questions you want to answer: the who, what, when, where, why and how of the subject. These questions shape the collection strategy and keep the effort on track.
3. Identify relevant open sources
Browse the OSINT Framework categories that match your objective. Drill into subcategories to find more specific tools and data sets.
Determine which types of open sources, such as websites, databases, social media platforms or public records, may hold the information. Prioritize them by relevance, reliability and accessibility to keep collection efficient.
4. Develop a data collection plan
With the sources chosen, create a structured plan for collecting information. Identify the tools that fit the case, keeping in mind that both free and paid tools may offer unique capabilities.
Choose appropriate techniques for data collection, such as manual searches or API-based access, and set a timeline and frequency for how often data should be gathered. Make sure the plan adheres to all legal and ethical standards.
5. Collect data
Begin collecting data with the selected tools and methods. Follow the instructions for each tool so that you gather data effectively and securely.
Retrieve information from the prioritized sources and store it in a secure, organized way that supports easy access and later analysis. As you collect, record metadata to preserve the context and traceability of each item. That record is vital for validation and reporting.
Nico Dekens made the point about collection tools in an interview with CloverDX:
“Google is nothing more than a door. Now you have to visit all those results to see if they may contain information that is valuable or not.”
– Nico Dekens, Senior SANS Instructor and Senior VP of Engineering at ShadowDragon. CloverDX, Behind the Data, August 2026
The same applies to every link in the framework: the tool opens the door, and the collection record is what you build on the other side.
6. Process and organize data
Once the data is collected, process and organize it. Start by cleansing the data. Remove duplicates, false positives, irrelevant material and noise.
Organize the cleaned data into categories or themes that reflect the intelligence requirements. Use tagging, labels or keywords to make it searchable for deeper analysis.
7. Analyze data
With the data organized, begin the analysis phase. Use analytical tools and techniques to connect the dots and extract insights. Look for patterns, trends and correlations.
Map relationships between individuals, organizations or locations. For textual data, assess tone and sentiment to understand the underlying message. Where it applies, analyze geographic data to detect hotspots or regions of interest. Use charts, graphs and maps to visualize findings.
8. Validate and corroborate findings
To ensure accuracy and reliability, cross-reference findings by comparing data from multiple sources. Evaluate each source for credibility and bias.
When possible, consult subject matter experts who can validate the insights and offer deeper interpretation. This step builds a foundation of verified intelligence.
Bellingcat founder Eliot Higgins described the standard his team applies:
“At its core, our process is about rigorous triangulation, often involving a multitude of diverse sources.” – Eliot Higgins, founder and creative director of Bellingcat. Thought Economics, July 2023
Triangulation is the habit that separates OSINT from simply finding something online.
9. Report and disseminate findings
Compile the analysis into a structured report. Include an executive summary, the methodology, key findings and actionable recommendations, with charts and maps as visual aids.
Tailor the format and content to the audience, whether executives, analysts or law enforcement personnel. Share the report securely with stakeholders to protect the integrity of the data and methods.
10. Continuous monitoring and feedback
OSINT requires ongoing attention. Set up systems to monitor the chosen open sources for updates or new developments.
Collect feedback from stakeholders on how well the findings met their needs and where to refine. Use it to adjust methods and stay responsive to changing intelligence requirements.
11. Ethical and legal compliance
Throughout the process, maintain strict adherence to legal and ethical standards. Make sure every activity complies with laws, regulations and the terms of service of each platform you use.
Avoid collecting or sharing personally identifiable information (PII) without proper consent. Transparency in methods and sourcing reinforces ethical integrity and public trust.
Collaborate with other teams or organizations when appropriate to validate findings and share insights. Integration deepens understanding and gives a more complete intelligence picture.
13. Iterative improvement
Treat the OSINT process as a living system. Regularly evaluate the effectiveness of your tools, techniques and workflows.
Stay informed about new tools and best practices. Invest in training to keep your skill set sharp.
Police and law enforcement agencies use OSINT to gather intelligence on suspects through social media profiles, public databases and geotagged content. It aids in mapping criminal networks, identifying associates and uncovering hidden connections.
Investigators also use OSINT in missing persons and human trafficking investigations, tracing individuals by compiling data from social networks, public records and other sources.
Corporate security and due diligence
Companies use OSINT to monitor competitors by analyzing public job postings, press releases and executive movements. It assists in brand protection by detecting counterfeit products, domain squatting and impersonation attempts.
During mergers and acquisitions, OSINT supports due diligence with insight into a target company’s web presence, reputation and legal status. ShadowDragon’s guide to OSINT background checks walks through the method.
Financial fraud detection
Financial institutions and investigators use OSINT to trace illicit financial activities and identify hidden assets or fraudulent entities. OSINT also aids in profiling potential money laundering cases by tracking patterns and connections through available data.
Cybersecurity and threat intelligence
Cybersecurity professionals use OSINT to uncover vulnerabilities in public-facing systems, such as misconfigured servers or exposed credentials. It helps monitor threat actors by tracking their digital footprints, including domain registrations, IP activity and social media behavior.
OSINT also supports phishing investigations by analyzing suspicious URLs, email headers and domain spoofing attempts.
During a security incident, OSINT tools help analyze malicious activity and gather intelligence about potential perpetrators.
Ethical hacking and penetration testing
Ethical hackers and penetration testers use OSINT during reconnaissance to gather as much information as possible about a target system or organization: employee names, exposed subdomains, outdated software and infrastructure details from public sources.
By simulating the techniques of malicious attackers, ethical hackers highlight vulnerabilities that might otherwise go unnoticed and help organizations strengthen their security posture.
Journalism and investigative reporting
Journalists use OSINT to fact-check claims, verify sources and track the spread of misinformation. Satellite imagery, reverse image search and metadata analysis let reporters geolocate events and authenticate visual content.
OSINT also uncovers hidden links between individuals, organizations or financial activities. Researchers draw on public data to support studies in sociology, political science and economics.
Competitive intelligence
Businesses use OSINT to gain insight into competitors’ strategies, customer sentiment and market trends by analyzing social media, news and financial reports. Organizations also use it to track emerging technologies and industry developments that inform R and D efforts.
Humanitarian work and crisis response
OSINT supports disaster response and humanitarian efforts by offering real-time data from social media, public feeds and satellite imagery. It helps map conflict zones, assess infrastructure damage and track population displacement.
Organizations use OSINT to identify needs on the ground and allocate resources more effectively.
Personal security and privacy audits
Individuals use OSINT to audit their digital footprint and understand what personal information is publicly accessible. That awareness helps prevent identity theft, social engineering attacks and unwanted data exposure.
By identifying exposed contact details, photos or social media activity, you can take steps to secure your online presence and reduce the risk of personal data being used maliciously.
Limitations and challenges of the OSINT Framework
Despite its usefulness, the OSINT Framework comes with several limitations and challenges that affect the accuracy and efficiency of its outcomes.
Registration and subscription requirements
Some OSINT tools require registration or paid subscriptions, which can be costly for smaller organizations or independent analysts. The framework flags 23 entries with the (R) marker for registration, and several more offer only partial results without payment.
Managing multiple subscriptions also adds overhead for renewals, licensing compliance and cost control.
Data overload
One of the main challenges of the framework is the volume of data it opens up. Sifting through large datasets for relevant and accurate information takes time, and the noise can bury the intelligence.
Targets may have strong privacy settings
OSINT techniques are limited by privacy settings on platforms such as social media, where users restrict access to posts and connections. Even well-designed search strategies may return little.
VPNs and privacy-focused browsers further obscure digital footprints, making identities harder to trace or verify. Analysts adapt by exploring alternative data sources or methods.
Verification and accuracy
The reliability of OSINT data is a constant concern. Because the information comes from public sources, it may be outdated, incomplete or deliberately false. Verifying it takes time and expertise, and it is not optional.
Legal and ethical concerns
OSINT work raises legal and ethical issues. Data may be publicly available and still carry privacy rights or terms-of-service restrictions on its use. Know the laws and ethical standards in each jurisdiction you touch to avoid legal consequences.
Dependency on third-party services
The OSINT process often relies on external platforms and services for data access and analysis. This dependency introduces potential vulnerabilities, such as platform outages, changes in API policies, or sudden service discontinuations.
When key OSINT tools or data aggregators go offline or restrict access, intelligence operations can be disrupted. Additionally, reliance on third-party services may raise concerns about data security, especially if sensitive queries or results are stored or processed externally.
Limited access to the deep web
OSINT is largely confined to the surface web, while a significant share of valuable data sits in the deep web or behind credentials. Analysts can miss critical information that is not open to the crowd.
Language and cultural barriers
Data exists in many languages and contexts. Language barriers slow collection and analysis, and cultural differences change how information should be read.
ShadowDragon®’s platform includes multi-language support to reduce that friction.
Rapidly changing information
With the nature of using real-time live data, information can become outdated quickly or can be deleted. The dynamism of online data can lead to intelligence that’s only temporarily accurate, necessitating continuous monitoring and updates, which can be resource-intensive.
Resource intensiveness
Though OSINT tools automate parts of the data-gathering process, significant human intervention is often needed for analysis and decision-making. This can lead to high resource consumption in terms of time, manpower, and technological investment.
Technology challenges
The framework relies on technology for collection and analysis. Access to sophisticated tools is often necessary to use it well, which is a barrier for some organizations because of cost or technical expertise.
Risks of OSINT misuse
OSINT can be a valuable tool, but it also carries the risk of misuse for malicious purposes like surveillance, fraud, or identity theft. Even ethical analysts may unintentionally cross legal or moral lines, such as sharing sensitive data or violating terms of service.
Misuse of OSINT can lead to reputational and legal consequences, undermining trust in OSINT practices. Clear ethical guidelines and governance are essential to prevent these risks.
Alternative OSINT resources
The closest alternatives to the OSINT Framework are other curated directories.
Awesome OSINT on GitHub is a single long list maintained the same way as the framework.
IntelTechniques publishes free search forms that supplement Michael Bazzell’s book, and OSINT Combine hosts free tools such as the WhatsMyName web app.
Each one lists tools rather than running them.
One layer down sit the tools that do the work.
Shodan is a search engine for internet-connected devices rather than web pages. It indexes IoT devices, webcams, servers, routers and industrial control systems and returns metadata such as open ports, software versions and location, which makes it standard for infrastructure reconnaissance and vulnerability assessment.
SpiderFoot automates collection. It supports over 200 modules for scanning domains, IPs, emails and usernames, runs from a web interface or an API and suits both preliminary reconnaissance and deeper investigation.
ShadowDragon® replaces the directory with a workspace. Horizon® combines collection from proprietary and open data sources with modules for link analysis, social media monitoring and real-time data collection, so the pivots you would make by hand through the framework happen inside one graph.
The OSINT Framework is the fastest way to find the right free tool for the identifier in front of you. Its 33 categories and 1,170 links make it the standard starting point for investigators, analysts, journalists and researchers.
As investigations grow, the work shifts from finding tools to connecting what they return.
That is where ShadowDragon® takes over. Horizon® adds link analysis, social media monitoring and threat monitoring on top of the collection the framework points you to, so you move from data discovery to actionable intelligence without leaving one workspace.
The stated intention is to help people find free OSINT resources. Some linked tools charge for full results.
The framework marks registration-only tools with (R), and the README notes that paid tiers exist, but you can reach at least part of most tools without paying.
Is the OSINT Framework legal?
Using the OSINT Framework is legal. The directory links to publicly available tools and sources, and browsing it breaks no law.
Legality depends on what you do with the tools: stay with publicly accessible information, respect each platform’s terms of service, do not log into accounts you do not own and follow the privacy laws that apply in your jurisdiction, such as the GDPR in the EU.
Law enforcement and corporate investigators should document authorization and purpose before collection.
Do I need to install the OSINT Framework?
No. You do not need to install the OSINT Framework. It runs in a browser at osintframework.com.
If you want an offline copy, clone the GitHub repository and open it locally, which some teams do inside an air-gapped investigation environment.
Who created the OSINT Framework?
Security researcher Justin Nordine created the OSINT Framework in December 2015. He started it from an information security point of view and opened it to contributions from other fields.
Volunteers still add tools through GitHub pull requests, and the repository shows merges as recent as 22 October 2026.
What is the difference between the OSINT Framework and an OSINT tool?
The OSINT Framework is a directory. An OSINT tool performs a search, lookup or analysis.
The framework tells you that Have I been pwned? answers whether an email address appears in a breach; Have I been pwned? gives the answer.
Commercial platforms such as ShadowDragon® Horizon® combine many tools and the link analysis between their results in one place, which is the step the framework leaves to you.
Can AI tools replace the OSINT Framework?
Not yet. Large language models answer from training data and cannot query live sources such as breach databases, court records or blockchain explorers without tooling behind them.
The framework’s AI Tools category lists detectors such as GPTZero and Hive for checking machine-generated content, which is how most investigators use AI in OSINT today: for verification and summarization, with every claim checked against a primary source.
Who uses the OSINT Framework?
Investigators, analysts, cybersecurity professionals, law enforcement, journalists, researchers, and ethical hackers use the OSINT Framework to gather and analyze public data for investigations and threat analysis.
How does the OSINT Framework help in cybersecurity?
The OSINT Framework helps cybersecurity teams identify potential threats, uncover data leaks, monitor digital footprints, and gather intelligence to strengthen security postures.
How do I know which OSINT tool to use?
Each tool in the OSINT Framework is categorized by function (e.g., email lookup, social media analysis, etc.). Choose tools based on your investigation goals and the type of data you’re trying to uncover.
How can I ensure my privacy while using OSINT tools?
Use a VPN, avoid logging into personal accounts, and consider using virtual machines or sandboxed environments to minimize tracking and protect your identity.
How does the OSINT Framework stay updated?
The framework is maintained by contributors in the open-source community who regularly add, remove, or update links to ensure the tools listed are current and reliable.
Post Author
Nico Dekens – aka “Dutch OSINT Guy”
Senior VP of Engineering and Chief Innovator
Nico Dekens is an experienced all-source intelligence analyst and the founder of Dutch Osint Guy Intelligence Services, specializing in Open Source Intelligence (OSINT), online Human Intelligence (HUMINT), and digital investigations. With a deep passion for intelligence gathering, analysis, and online investigations, Nico has dedicated over 20 years to the field, including extensive experience within Dutch law enforcement.
Throughout his career, he has worked on a wide range of cases, from high-profile homicide and international narcotics investigations to tracking stolen art, gang violence, and online extremist networks. He has also conducted covert virtual HUMINT operations and counterterrorism investigations.
Nico Dekens – aka “Dutch OSINT Guy” 
