Free OSINT tools and frameworks: 2026 toolkit guide

This toolkit is a practitioner's reference, not a marketing listicle. Each entry states what a tool actually does, when to reach for it, and where it breaks down, rather than ranking tools against each other. Free and open-source OSINT tools change constantly: they get discontinued, paywalled, or abandoned without notice, sometimes mid-investigation. Two changes documented in this edition alone made previous editions of similar toolkits inaccurate within months of publication.

Entries are grouped by investigative task, not alphabetically, so the toolkit stays useful as individual tools come and go. Where Signal & Shadow has already published a full walkthrough for a category, this toolkit links out to it rather than duplicating that depth here.

Turning a search engine into a structured reconnaissance tool starts with operators, then moves to indexes built specifically for exposed infrastructure.

Google Hacking Database (GHDB): A maintained index of dork queries for finding exposed files, login pages, and misconfigured services through standard search engines. Free, no login. Built for penetration testers but directly usable for reconnaissance on a domain or organisation.

Shodan: A search engine for internet-connected devices rather than web pages. Free tier allows unfiltered queries with a capped result count; filtered search, full history, and export require a paid plan. Surfaces exposed servers, cameras, and industrial systems tied to a target.

Censys: Continuous internet-wide scanning focused on hosts, services, and TLS certificates. Free tier includes a capped number of query credits. Shodan and Censys frequently return different results for the same target, so cross-check both rather than treating either as complete.

IntelTechniques Search Tools: Structured, pre-built search forms across people, email, phone, domain, document, and social categories. Free, no login. A faster starting point than writing dork strings from scratch for common lookups.

Full walkthrough: Shodan OSINT: finding exposed infrastructure behind a domain

These tools confirm where a username appears publicly. They do not confirm the accounts belong to the same person; that judgement is covered in the full walkthrough linked below.

WhatsMyName: Browser-based, checks 700+ community-maintained sites with no install. The fastest first pass; does not extract profile data.

Sherlock: Free, open-source command-line tool covering roughly 400 sites. Requires Python. Good for scripted or batch username sweeps.

Maigret: A Sherlock fork covering 3,000+ sites and extracting profile metadata rather than just confirming a hit. Free and open source, but slower to run and produces larger output than Sherlock.

Full walkthroughs: Cross-platform username attribution with AI, Sherlock OSINT: cross-platform username pivoting beyond WhatsMyName, Email OSINT: trace an address to accounts and infrastructure, and Email account enumeration: tools beyond Holehe

Email intelligence tools not covered in the full walkthroughs above:

Have I Been Pwned: Free breach-exposure lookup covering billions of leaked credential records. No login required for a single address check; API access for bulk queries requires a paid key. The standard first check for whether an address appears in known breach data.

Epieos: Free email-to-account resolver, particularly strong on Google account artifacts (linked Maps reviews, calendar, Google Photos exposure) that other enumeration tools miss. No login required for basic lookups.

Holehe: Free, open-source, command-line. Checks roughly 120 platforms via password-reset response behaviour. Requires Python. Covered in depth in the full walkthroughs below.

Link analysis tools turn a list of entities into a visual graph, useful once an investigation has enough data points to show a structure rather than a single lead.

Maltego: Visual link-analysis platform built around transforms that pull data from external sources into a graph. The free Basic plan (formerly Community Edition) is capped, roughly 24 results per transform and around 200 data credits a month, and requires a registered Maltego ID.

Gephi: Free, open-source graph visualisation and analysis software. No caps, no account required. Steeper learning curve than Maltego for a first-time user, but no ceiling on graph size or export.

This category has thinned considerably. CrowdTangle, the platform-owned tool most investigators relied on for Facebook and Instagram monitoring, was shut down by Meta in August 2024. Treat any toolkit that still lists it as current without checking the rest of that toolkit.

Junkipedia: A free, journalist and researcher-built replacement covering Facebook, Instagram, TikTok, Telegram, and several fringe platforms including Gab and GETTR. Free tier interface is less polished than CrowdTangle's was, and dataset coverage is narrower, but it remains the primary no-cost option for cross-platform account tracking.

Google Alerts: Free keyword monitoring across indexed news and web content. Basic and slow to update relative to purpose-built social listening tools, but a genuine no-cost starting point for tracking a name or topic over time.

Full walkthrough: Telegram OSINT: investigate channels, groups and users

Free satellite tooling has consolidated hard in the last two years, and several older toolkit entries are now dead ends. EO Browser and Sentinel Hub Playground, both widely cited in older OSINT guides, were shut down in February 2025. Their free functionality moved to Copernicus Browser; their paid functionality moved to Planet Insights Platform. Any toolkit still pointing to EO Browser or Sentinel Hub Playground by name is out of date.

Copernicus Browser: The current free successor to EO Browser. Browses and downloads full-resolution Sentinel-1, -2, -3, and -5P imagery. Account registration is optional but unlocks saving and a personal workspace. No access to commercial high-resolution imagery; radar data support is less developed than optical.

NASA Worldview: Free, daily-updated imagery focused on active environmental events: fire, flood, dust, snow, atmospheric conditions. An event-monitoring tool rather than a general satellite map viewer.

USGS EarthExplorer: Free archive access for historical and long-term change analysis, including the full Landsat record. Slower and less visual than Copernicus Browser, but the deeper historical archive of the two.

GitHub hosts dozens of curated OSINT tool lists. Most are forks of forks, several years stale. The two below were confirmed actively maintained, with commits and releases in 2026, as of the verification date on this toolkit; check the commit history yourself before relying on any repository not listed here.

jivoi/awesome-osint: A long-running curated list spanning search engines, dorking tools, breach checkers, username tools, and infrastructure recon. Actively maintained, with tagged releases through April 2026. The broadest general-purpose starting point on this list.

lockfale/OSINT-Framework: The source repository behind the interactive OSINT Framework directory site, organising roughly 700 tools by data type. Actively maintained. Useful specifically for identifying which tools exist for a data type you have not worked with before, distinct from a walkthrough of any one tool.

OSINT Navigator: AI-powered meta-search across a curated database of tools drawn from 17 independent OSINT toolkits, built by Indicator Media. Free without an account, rate-limited to a set number of queries per day; sign-in raises the limit. Useful for finding which tool exists for an unfamiliar task rather than replacing a walkthrough of any single tool.