Updated 8 October 2026: added OpenOSINT, Hunchly (paid), Blackbird, twscrape, Telethon, Bellingcat’s telegram-phone-number-checker, ShadowFinder, auto-archiver and octosuite, gau, waymore, waybackpack, yt-dlp, gallery-dl and DeFlock; removed Infoga (repo gone), InstaLooter and Creepy (defunct), Trape and Chiasmodon (phishing/credential-data tools); flagged unmaintained repos; fixed moved links (Censys, Telepathy, Moriarty, Metagoofil). OSINT MCP servers are covered in the AI-agent OSINT guide. Updated 11 October 2026: GeoSpy is now marked paid, because its site says it is for qualified government and enterprise organisations only. 16 Oct 2026 — added SingleFile and ArchiveWeb.page (page capture), the Trace Labs OSINT VM, Telegago (Telegram search) and WayTrace (Wayback domain history); added a top-10 table with a maintenance check and a section on the best no-install OSINT websites. 24 Oct 2026 — added GeoInfer (AI photo geolocation; 3 free searches a day, no account) to Geolocation & Image, after hands-on testing with photos of known locations. 26 Oct 2026 — added 1Lookup’s VoIP / line-type checker and HLR lookup to Phone Number OSINT: no-install options whose basic result needs no account (affiliate links, marked).
What Are the Best Free OSINT Tools in 2026?
The best free OSINT tools in 2026 are Shodan for device discovery, Sherlock and Maigret for usernames, theHarvester and Holehe for email and domain recon, VirusTotal for file and URL reputation, and ExifTool for metadata. All are genuinely free, and most are open-source. The ranked list below covers the 20 free OSINT tools that do the most investigative work without a paid licence, grouped so you can pick by task.
How we ranked these: we weighed how much investigative work each tool does for free, the breadth of public data it reaches, accuracy (low false positives), and how quickly a newcomer can get a result — favouring open-source and no-cost tiers. The pricing label on each entry reflects its public plans as of 2026.
Top 10 at a glance, checked for maintenance. We re-checked each tool on 16 October 2026: the date of the last push to its GitHub repository, or whether the website still works. A recent push shows the project is alive, not that every module still works.
| Tool | What it does | Runs as | Maintained as of Oct 2026 |
|---|---|---|---|
| Shodan | Searches internet-connected devices | Website (free account) | Yes — site live; it invites users to “create a free account” Shodan (read 16 Oct 2026) |
| Sherlock | Checks one username across many sites | Python CLI | Yes — last push 9 Sep 2026; not archived GitHub (checked 16 Oct 2026) |
| Maigret | Username search that builds a profile dossier | Python CLI | Yes — last push 9 Sep 2026; not archived GitHub (checked 16 Oct 2026) |
| theHarvester | Emails, subdomains and hosts from public sources | Python CLI | Yes — last push 10 Sep 2026; not archived GitHub (checked 16 Oct 2026) |
| OWASP Amass | Subdomain enumeration | Go CLI | Yes — last push 19 Jul 2026; not archived GitHub (checked 16 Oct 2026) |
| VirusTotal | Reputation of a file hash, URL, domain or IP | Website | Yes — its docs say search “is free and available to any user” VirusTotal docs (read 16 Oct 2026) |
| ExifTool | Reads and writes file metadata | Perl CLI / app | Yes — version 13.59, released 27 May 2026 ExifTool (read 16 Oct 2026) |
| WhatsMyName | Checks a username across hundreds of sites | Website + dataset | Yes — last push 16 Sep 2026; not archived GitHub (checked 16 Oct 2026) |
| DNSDumpster | Finds hosts related to a domain | Website | Yes — site live; calls itself a “FREE domain research tool” DNSDumpster (read 16 Oct 2026) |
| PhoneInfoga | Phone number recon: carrier, region, line type | Go CLI | No — its README says it is “stable but unmaintained” GitHub (checked 16 Oct 2026) |
The full ranked list of 20 follows, with what each tool costs.
- Shodan — the search engine for internet-connected devices. Maps exposed servers, webcams, databases, and industrial systems worldwide; the fastest way to see a target's external attack surface. Cost: Freemium (free account; deeper queries paid).
- Sherlock — checks a username across 400+ platforms in one command. The standard first step in any username investigation. Pair it with our username search. Cost: Free, open-source.
- Maigret — Sherlock's deeper successor. Checks 3,000+ sites and extracts profile details into a structured dossier. Slower but far more thorough. Cost: Free, open-source.
- theHarvester — pulls emails, subdomains, hosts, and employee names from 30+ public sources. The classic opening move for domain reconnaissance. Cost: Free, open-source.
- Holehe — takes an email address and silently checks 120+ sites for registration via password-reset flows. Feed results into our email lookup. Cost: Free, open-source.
- OWASP Amass — the most complete free subdomain enumeration tool, combining DNS, scraping, APIs, and ML. Complements our domain OSINT. Cost: Free, open-source.
- VirusTotal — checks files, URLs, domains, and IPs against 70+ antivirus engines and adds passive DNS, WHOIS, and reputation data. The default for malware and link analysis. Cost: Freemium (free lookups; API tiers paid).
- ExifTool — reads and writes metadata across 400+ file formats, surfacing GPS coordinates, timestamps, and device fingerprints. The industry standard for file forensics. Cost: Free, open-source.
- SpiderFoot — automates broad reconnaissance across 200+ modules with a clean web GUI. Best when you want results without chaining tools manually. Cost: Freemium (open-source free; hosted HX paid).
- Censys — the leading Shodan alternative for attack-surface visibility: asset discovery, certificate tracking, and network insights, with daily scans. Cost: Freemium (free account with 100 credits/month on the Censys Platform).
- PhoneInfoga — the leading free phone-number recon tool. Identifies carrier, region, line type, and VoIP footprint. Works alongside our phone lookup. Cost: Free, open-source.
- WhatsMyName — a browser-based username enumerator across 732 community-vetted sites. No install, low false-positive rate — the easiest entry point for non-technical investigators. Cost: Free.
- Have I Been Pwned — checks an email or password against billions of breached records. The canonical breach reference. See our breach exposure tools. Cost: Free.
- DeHashed — goes beyond Have I Been Pwned, searching leaked credentials, names, addresses, and phone numbers across breach datasets. Cost: Freemium (preview free; full results paid).
- GHunt — investigates the public surface of a Google account from an email or document ID: profile, reviews, and linked services. Cost: Free, open-source.
- DNSDumpster — maps a domain's DNS records, subdomains, and hosting infrastructure into a clear visual, free and instant. A fast first pass before Amass. Cost: Free.
- ProjectDiscovery suite (subfinder · httpx · nuclei) — three free Go tools that chain into a pipeline:
subfinder -d target.com | httpx | nucleito discover subdomains, probe live hosts, and scan with community templates. Cost: Free, open-source. - Google Earth Pro — for geolocation and visual verification: historical satellite imagery, a timeline slider, distance measurement, and 3D terrain to confirm where a photo was taken. Cost: Free.
- Maltego (Basic plan) — the standard for visual link analysis. The free Basic plan maps relationships between people, domains, and infrastructure, with capped monthly credits. See the Maltego section below. Cost: Free tier (paid upgrades).
- Recon-ng — a modular, scriptable recon framework with a marketplace of data modules. Suits analysts who want repeatable, automatable workflows. Cost: Free, open-source.
Ready to start? Browse the full tools directory below, generate advanced queries with the Dork Generator, and widen coverage with the Search Engine Directory.
What are the best OSINT websites (no install needed)?
The best OSINT websites run in your browser with nothing to install. Use WhatsMyName for usernames, DNSDumpster for domains, Shodan for exposed devices, VirusTotal for links and files, OpenCorporates for companies and the Wayback Machine for old pages. Max Intel’s own tools also run in the browser and need no account.
| Task | Website | What you get | Max Intel tool or guide |
|---|---|---|---|
| Check a username across sites | WhatsMyName | Free, browser-based, “no installation required” WhatsMyName README (read 16 Oct 2026) | Username search · guide |
| Map a domain’s hosts | DNSDumpster | Free; finds hosts related to a domain DNSDumpster (read 16 Oct 2026) | Domain OSINT |
| Find subdomains and certificates | Max Intel Subdomain Scanner | DNS, subdomains, certificates and tech in one view; free | Subdomain scanner |
| Find exposed devices and servers | Shodan | A “search engine for Internet-connected devices”; free account Shodan (read 16 Oct 2026) | IP lookup |
| Check a link, file hash, domain or IP | VirusTotal | Free search; anything you submit is added to its dataset and visible to its community, so never submit private data VirusTotal docs (read 16 Oct 2026) | Website legit checker |
| Look up a company | OpenCorporates | Company records from “over 140 government registries” OpenCorporates (read 16 Oct 2026) | Company OSINT |
| See old or deleted pages | Wayback Machine | Archived copies of a page by date | Wayback OSINT · guide |
| Reverse-search an image | Max Intel Reverse Image Search | Sends one image to Google Lens, Bing, Yandex, TinEye and more; free | Reverse image search |
| Build search operators | Max Intel Dork Generator | Advanced Google, Bing, Yahoo and Baidu queries without memorising syntax; free | Dork Generator · reference |
| Search many engines at once | Max Intel Search Engine Directory | One query, every engine in the list: pre-filled results links where the engine allows it; free | Search engines list |
To run one email, phone number or username through every relevant tool at once, use the Pivot Hub. Comparing paid all-in-one lookup services instead? See our Intelbase alternatives.