OSINT Tool Directory

This directory catalogs the open-source intelligence tools we consider worth learning — every entry is still active, legitimate, and in use by working investigators. Tools are grouped by investigation type (people, corporate, digital infrastructure, geospatial, documents, financial, and cross-cutting frameworks) and tagged by skill level and cost. Use the filters below to narrow by category, skill level, or pricing, or search by name and description. Entries with a linked tutorial offer a step-by-step walkthrough on OSINT Academy; the rest link directly to the tool's homepage. For context on how these fit together, start with the methodology guides.

Free: No account or payment required for the core functionality.
Freemium: Useful free tier; advanced features behind a paid plan.
Paid: Paid subscription or per-query cost required.
Beginner: Usable on day one with no prior tooling knowledge.
Intermediate: Assumes comfort with basic OSINT workflows.
Advanced: Command line, scripting, or domain expertise expected.

Internet Archive's time machine for the web — retrieve historical captures of deleted or altered pages.

On-demand web snapshot service that preserves pages Google and the Wayback Machine sometimes miss.

Look up domain registration records — registrant, registrar, name servers, and historical ownership.

Programmatic WHOIS, DNS, and reverse-WHOIS data for bulk domain investigation.

Free DNS recon that maps a domain's subdomains, MX, and hosting infrastructure.

Search engine for internet-connected devices — exposed services, IoT, industrial systems.

Certificate-transparency-driven internet scan data that complements Shodan.

Advanced Google search operators that surface documents, directories, and data the open web has quietly published.

Link-analysis platform that graphs relationships between people, domains, emails, and documents.

Open-source reconnaissance automation that queries hundreds of data sources against a target.

Command-line tool for collecting emails, subdomains, and hosts from public search engines.

Platform-agnostic methods for verifying identities, claims, and timelines across social networks.

Python tool that hunts a username across 400+ social networks in seconds.

Web-based username enumeration across hundreds of sites, no install required.

Username search across 3,000+ sites with profile data extraction and HTML reports.

Find and verify professional email addresses tied to a company domain.

Reputation lookup for a single email — profiles, breaches, domain signals.

Check whether an email, phone, or password has appeared in a known data breach.

Commercial search across breach data for emails, usernames, names, and IPs.

Email and phone enrichment that reveals which services a subject has registered on.

The largest open database of companies — 200M+ entities across 140+ jurisdictions.

US Securities and Exchange Commission filings — 10-Ks, 8-Ks, proxies, insider trades.

The UK's free official registry of companies, directors, and persons with significant control.

How to work with national corporate registries to trace ownership across jurisdictions.

OCCRP's investigative search engine across leaked documents, registries, and sanctions lists.

Searchable database behind the Panama Papers, Paradise Papers, Pandora Papers, and more.

Aggregated German and European company data with ownership network visualization.

Free Law Project's archive of US court opinions, dockets, and oral arguments.

Official US federal court records system — dockets, filings, and opinions.

How to draft, file, and track federal and state public-records requests.

File, track, and publish public-records requests with a community of other requesters.

Host, annotate, and full-text search investigative documents — run by MuckRock.

The industry-standard command-line tool for reading and editing file metadata.

Techniques for pulling hidden authorship, location, and device data from files.

Bulk metadata extraction from documents discovered on a target domain.

Russian search engine with the strongest reverse-image and face-match results.

Reverse-image search focused on finding the earliest known copy of an image.

Google's visual search — strong at objects, buildings, text, and landmarks.

How to combine Yandex, TinEye, Google Lens, and Bing to verify or trace an image.

Browser extension for verifying videos and images across social platforms.

Desktop satellite and historical-imagery viewer — free since 2015.

Browse Sentinel, Landsat, and MODIS satellite imagery for any point on Earth.

Query OpenStreetMap for every feature of a given type inside any bounding box.

Calculate the sun's position and shadow direction at any location and time.

Russian mapping platform with better street-view and imagery coverage across Eastern Europe.

Crowdsourced map layer that tags buildings, military sites, and landmarks.

Near-daily 3m-resolution imagery of the entire Earth — free tier for journalists and researchers.

Consolidated, searchable dataset of global sanctions, PEPs, and enforcement lists.

US Treasury's official search of the SDN and consolidated sanctions lists.

Block explorer for Ethereum — trace wallets, tokens, and smart-contract interactions.

Unified explorer across 20+ blockchains with cross-chain search.

Long-running Bitcoin block explorer — quick wallet and transaction lookups.

Community-reported database of scam and fraud crypto addresses.

The canonical tree-view directory of OSINT resources, maintained since 2014.

Bellingcat's curated, opinionated toolkit — the gold-standard working investigator's list.

Michael Bazzell's collection of search utilities for people, usernames, and documents.

Modular Python framework that structures OSINT collection like Metasploit structures exploits.

Tool tutorials

Hands-on walkthroughs for the tools worth learning first.