Search for Someone’s Personal Email Address using OSINT

Search for Someone’s Personal Email Address using OSINT
Search for Someone’s Personal Email Address using OSINT
Search for Someone’s Personal Email Address using OSINT
Search for Someone’s Personal Email Address using OSINT
Search for Someone’s Personal Email Address using OSINT

Nowadays, almost everybody who uses the internet has an Email address. People use either a personal or business email address to send and receive emails, create social media accounts, do business, and many more…

In this article, I would like to give you a brief overview of what tools and websites can you use to find someone’s personal email address. This is by no means a comprehensive guide, since email OSINT methodology and resources may change over time.

This article focuses only on finding the target’s email address and not their business email. There will be another article on finding companies’ email addresses.

The importance of Emails in OSINT

One of the most critical pieces of information you can get about someone during an OSINT search is their personal email address. By having the target personal Email address, you can find their:

  1. Social Media accounts
  2. Leaked Data from compromised databases (Search for Someone’s Leaked Passwords Online)
  3. Online accounts
  4. Online reviews
  5. Usernames
  6. Any other email addresses associated
  7. Many more…

Anything you find online has to be documented in a file because you don’t know when this piece of information will help you further in your OSINT investigation.

A Simple Google Search

The first thing I like to do when searching for someone is to Google him/her. A simple Google search will most of the time return the target’s social media accounts.

Once you find their social media accounts, pay close attention to the usernames they use because sometimes usernames are the same or similar to their email addresses.

Google Search

Forgot My Password

Almost all websites have a form to reset the user password. Password reset forms can be used to enumerate users to see if they are registered on a website or not.


Facebook’s “Forgot Password” form allows you to see the first and last part of a Facebook user email address. Everything in the middle will be replaced with stars (Have a look at screenshot 3)

Your job is to guess what the stars are. Most of the time, it will be the user first and last name.

Screenshot 1: Facebook profile username

Screenshot 2: the user FB username
Screenshot 3 Finding an Email Address on Facebook

Browser Extensions

There are some extensions that you can use right away on your browser to find someone’s email address. I find this to be one of the quickest ways to find someone’s email address.

Contact Out

The first extension is called Contact Out. Contact Out use crawlers that scan the internet looking for emails and phone numbers.

The cool thing about Contact Out is that it’s FREE. You are allowed to search for up to 40 emails a month for Free!

If you want to search for more than 40 email addresses, then you have to have a monthly/yearly subscription.

This extension only works with LinkedIn accounts. This means if your target doesn’t have a LinkedIn account, then this extension is useless.


Another cool and FREE extension for Chrome is GetProspect.

“GetProspect LinkedIn email extractor visits the targeted profiles on LinkedIn and extracts the data from them: name, location, company details, summary. Based on the extracted company domain and company email pattern, GetProspect finds and verifies the email address”


GetProspect is not as powerful as Contact Out since it only shows you the current email the target use, unlike Contact Out which shows you all previous emails the target used with his/her LinkedIn account.

Again, this extension only works with LinkedIn accounts.


I would consider SignalHire is one of the most powerful browser extensions to find someone’s email address. It supports both Firefox and Chrome, and it works on LinkedIn, Facebook, GitHub, Twitter, and MeetUp.

You can find anyone’s data only by name, position or location. The only issue though is that it’s a paid extension. The only free thing you can use is their Find the Lead feature that allows you to search for someone’s LinkedIn profile by email.

Search for Someone’s Personal Email Address [Video]

Here is a video I made on my YouTube channel that summarizes everything explained in this article and more. I hope you enjoy it.


Links to the websites are in CyberSudo’s OSINT Toolkit.

Get a Free Ethical Hacking Kit:

  1. CyberSudo’s OSINT Toolkit
  2. 25% OSINT Masterclass Discount
  3. Hacking Radio Frequency mini-course
  4. Hacking Wi-Fi on OSX mini-course

OSINT Playlist

Saad Sarraj

I am a CyberSecurity and Ethical Hacking/Penetration Testing passionate. I am also a TryHackMe Top 1% CTF Player.

Leave a Reply

Your email address will not be published. Required fields are marked *