🛠️ OSINT Tools Directory — Programs, Scripts & GitHub Repos

What Are the Best Free OSINT Tools in 2026?

The best free OSINT tools in 2026 are Shodan for device discovery, Sherlock and Maigret for usernames, theHarvester and Holehe for email and domain recon, VirusTotal for file and URL reputation, and ExifTool for metadata. All are genuinely free, and most are open-source. The ranked list below covers the 20 free OSINT tools that do the most investigative work without a paid licence, grouped so you can pick by task.

How we ranked these: we weighed how much investigative work each tool does for free, the breadth of public data it reaches, accuracy (low false positives), and how quickly a newcomer can get a result — favouring open-source and no-cost tiers. The pricing label on each entry reflects its public plans as of 2026.

1. Shodan — the search engine for internet-connected devices. Maps exposed servers, webcams, databases, and industrial systems worldwide; the fastest way to see a target's external attack surface. Cost: Freemium (free account; deeper queries paid).
2. Sherlock — checks a username across 400+ platforms in one command. The standard first step in any username investigation. Pair it with our username search. Cost: Free, open-source.
3. Maigret — Sherlock's deeper successor. Checks 3,000+ sites and extracts profile details into a structured dossier. Slower but far more thorough. Cost: Free, open-source.
4. theHarvester — pulls emails, subdomains, hosts, and employee names from 30+ public sources. The classic opening move for domain reconnaissance. Cost: Free, open-source.
5. Holehe — takes an email address and silently checks 120+ sites for registration via password-reset flows. Feed results into our email lookup. Cost: Free, open-source.
6. OWASP Amass — the most complete free subdomain enumeration tool, combining DNS, scraping, APIs, and ML. Complements our domain OSINT. Cost: Free, open-source.
7. VirusTotal — checks files, URLs, domains, and IPs against 70+ antivirus engines and adds passive DNS, WHOIS, and reputation data. The default for malware and link analysis. Cost: Freemium (free lookups; API tiers paid).
8. ExifTool — reads and writes metadata across 400+ file formats, surfacing GPS coordinates, timestamps, and device fingerprints. The industry standard for file forensics. Cost: Free, open-source.
9. SpiderFoot — automates broad reconnaissance across 200+ modules with a clean web GUI. Best when you want results without chaining tools manually. Cost: Freemium (open-source free; hosted HX paid).
10. Censys — the leading Shodan alternative for attack-surface visibility: asset discovery, certificate tracking, and network insights, with daily scans. Cost: Freemium (~250 free queries/month).
11. PhoneInfoga — the leading free phone-number recon tool. Identifies carrier, region, line type, and VoIP footprint. Works alongside our phone lookup. Cost: Free, open-source.
12. WhatsMyName — a browser-based username enumerator across 732 community-vetted sites. No install, low false-positive rate — the easiest entry point for non-technical investigators. Cost: Free.
13. Have I Been Pwned — checks an email or password against billions of breached records. The canonical breach reference. See our breach exposure tools. Cost: Free.
14. DeHashed — goes beyond Have I Been Pwned, searching leaked credentials, names, addresses, and phone numbers across breach datasets. Cost: Freemium (preview free; full results paid).
15. GHunt — investigates the public surface of a Google account from an email or document ID: profile, reviews, and linked services. Cost: Free, open-source.
16. DNSDumpster — maps a domain's DNS records, subdomains, and hosting infrastructure into a clear visual, free and instant. A fast first pass before Amass. Cost: Free.
17. ProjectDiscovery suite (subfinder · httpx · nuclei) — three free Go tools that chain into a pipeline: subfinder -d target.com | httpx | nuclei to discover subdomains, probe live hosts, and scan with community templates. Cost: Free, open-source.
18. Google Earth Pro — for geolocation and visual verification: historical satellite imagery, a timeline slider, distance measurement, and 3D terrain to confirm where a photo was taken. Cost: Free.
19. Maltego (Basic plan) — the standard for visual link analysis. The free Basic plan maps relationships between people, domains, and infrastructure, with capped monthly credits. See the Maltego section below. Cost: Free tier (paid upgrades).
20. Recon-ng — a modular, scriptable recon framework with a marketplace of data modules. Suits analysts who want repeatable, automatable workflows. Cost: Free, open-source.

Ready to start? Browse the full tools directory below, generate advanced queries with the Dork Generator, and widen coverage with the Search Engine Directory.

What Are the Most Important OSINT Tools in 2026?

OSINT tools have evolved from simple scripts into reconnaissance platforms used by 82% of cybersecurity professionals (SANS 2024 OSINT Survey). The global OSINT market is projected to reach $29.19 billion by 2029 (MarketsandMarkets). This directory catalogs the most actively maintained tools by category.

Reconnaissance Frameworks

Full-stack recon frameworks like SpiderFoot, Maltego, and Recon-ng automate the process of gathering intelligence from hundreds of data sources simultaneously. SpiderFoot scans IPs, domains, emails, and usernames across 200+ modules with a web GUI. Maltego provides powerful visual link analysis — mapping relationships between entities that would be invisible when examining data separately. reconFTW chains together 50+ tools to perform comprehensive domain reconnaissance in a single command.

Username & Social Media OSINT

Sherlock and Maigret are the two dominant username enumeration tools. Sherlock checks 400+ platforms quickly and simply. Maigret goes deeper — checking 2,500+ sites and extracting profile data to build comprehensive dossiers. WhatsMyName provides a web-based alternative. For platform-specific analysis, Instaloader downloads Instagram content with metadata, Toutatis extracts private Instagram data via API, and Osintgram provides a full Instagram reconnaissance toolkit.

Email & Phone Intelligence

Holehe checks whether an email is registered on 120+ platforms by probing password reset functions. theHarvester gathers emails, subdomains, and hosts from 30+ public sources. GHunt provides offensive Google account investigation. For phone numbers, PhoneInfoga scans international numbers for carrier, location, and VoIP data, while Ignorant checks phone number registration across platforms.

Domain & Infrastructure

OWASP Amass — part of the OWASP (Open Worldwide Application Security Project) suite — performs deep subdomain enumeration using DNS, web scraping, APIs, and machine learning. Subfinder handles passive subdomain discovery. httpx probes discovered hosts for status codes, titles, and technology detection. Nuclei scans for vulnerabilities using community-maintained templates. Shodan and Censys index internet-connected devices globally, revealing exposed servers, webcams, and industrial systems. These tools are often chained together: subfinder | httpx | nuclei.

Metadata, Geolocation & Scraping

ExifTool, created by Phil Harvey, is the industry standard for extracting metadata from over 400 file formats from images, PDFs, and documents — including GPS coordinates, timestamps, and device information. Metagoofil extracts metadata from documents found on target domains. FOCA maps network infrastructure from document metadata. For geolocation, Creepy gathers location data from social media, while GeoSpy uses AI to estimate photo locations. Web scraping frameworks like Scrapy and Playwright enable custom data extraction at scale.

Building an OSINT Workflow

Effective OSINT investigations chain multiple tools together. A typical workflow might begin with email enumeration (Holehe, theHarvester), expand to username discovery (Sherlock, Maigret), map the target's digital infrastructure (Amass, Shodan), extract metadata from discovered content (ExifTool, Metagoofil), and visualize connections (Maltego). Use the Dork Generator for advanced search queries, the Search Engine Directory for multi-engine coverage, and the News & Media Archives for journalistic sources.

Is Maltego Free? The Free Tier, Limits, and Best Free Alternatives

Yes — Maltego has a free tier. As of 2026 it is called the Basic plan (the former "Community Edition"), and it stays free with a registered Maltego ID. It is genuinely useful for visual link analysis, but it is capped: expect up to 24 results per transform, around 200 data credits per month, and limited access to data providers, with no breach data. Many free transform providers also cap pivots at roughly 15–20 requests per month, so heavy investigations quickly hit a wall.

Is Maltego worth it?

For mapping relationships between entities — people, emails, domains, infrastructure — Maltego's graph view is hard to beat, and the free Basic plan is a fine way to learn it. The catch is setup: many transforms require their own API keys (even on free tiers), so it is not an out-of-the-box solution. If you mainly need data collection rather than visual analysis, a lighter free tool will get you there faster.

Best free alternatives to Maltego, ranked

1. SpiderFoot — the closest free, open-source equivalent. Automates 200+ modules and visualises results in a web GUI, with no per-transform credit cap.
2. Recon-ng — modular, scriptable recon when you prefer a CLI workflow over a graph. Free and fully open-source.
3. Our OSINT tools directory — for targeted lookups (people, email, username, domain) without installing or registering anything, start here and pivot between tools.
4. theHarvester + Amass — chain these two free tools for the email/subdomain/infrastructure mapping that Maltego transforms typically perform.

How do you install Maltego?

Installing Maltego takes a few minutes and the free tier costs nothing:

1. Download the installer for your operating system (Windows, macOS, or Linux) from the official Maltego website. On Kali Linux you can skip this — Maltego ships pre-installed.
2. Launch Maltego and create a free Maltego ID when prompted.
3. Choose the free Maltego Basic product (the former Community Edition) to start without paying.
4. Let the client download its entity and transform data, and you are ready to build your first graph.

How do you use Maltego in Kali Linux?

On Kali Linux, Maltego is included by default — launch it from the Applications menu under Information Gathering, or run maltego in a terminal. You still sign in with a free Maltego ID and select the Basic plan; everything after that is identical to other platforms. Kali is popular for Maltego because the other tools you will pivot into (theHarvester, Recon-ng, Amass) are already installed alongside it.

How do you use Maltego? (the basics)

To run a first investigation: create a new graph, drag an entity (such as Domain, Person, or Email Address) from the palette onto the canvas, and enter your target value. Right-click the entity and run a transform — Maltego queries a data source and draws the results as connected entities on the graph. Keep pivoting from the new entities (a domain reveals subdomains, an email reveals breaches or accounts) to expand the picture. On the free Basic plan, expect up to 24 results per transform and a monthly credit cap, so start with your most important pivots first.

Is OSINT Legal? Is It Legal to Look Someone Up Online?

Yes — using OSINT to collect publicly available information is legal in most countries, because it relies on data anyone can lawfully access: public records, social profiles, WHOIS, and news. What you do with that information is where the law draws lines. Accessing non-public data — hacking, stolen credentials, or paywalled and private systems — is illegal, and a pattern of targeted attention that makes someone fear for their safety is stalking or harassment regardless of how public the underlying data was.

Is Google dorking illegal?

Using search operators is legal — you are querying a public search engine. It becomes illegal if you knowingly access data you are not authorised to, such as exposed databases, private documents, or login pages that dorking surfaces. Looking is generally fine; accessing or downloading protected data is not.

Is it illegal to find someone's address or phone number?

No. Looking up publicly listed contact information is legal. It crosses the line when the information is used to harass, stalk, intimidate, or show up uninvited — the act, not the lookup, is what is unlawful.

Is facial recognition search legal?

It varies. Facial recognition is broadly legal at the US federal level but restricted by state biometric laws such as Illinois' BIPA, and the EU's GDPR and AI Act limit it heavily. See our face-search guidance for the practical limits.

When does OSINT become stalking?

When it shifts from gathering public information to a sustained pattern of targeting a specific person that would make a reasonable person fear for their safety, or to covert monitoring of their movements. Intent and effect matter more than whether each individual data point was public.

This is general information, not legal advice; laws vary by jurisdiction.