01
What it is
OSINT is intelligence gathered from publicly available sources, such as websites, social media, public records and open data, using a defined and repeatable process rather than random searching.
The term covers a spectrum of activity, from a quick background check against public records to a multi week investigation drawing on satellite imagery, corporate filings and social media archives. What separates OSINT from casual searching is method: a defined question, a deliberate source strategy and verification before any finding is treated as fact.
Investigative journalists use OSINT to establish facts before publication. Corporate investigators use it for due diligence and fraud detection. Human rights researchers use it to document abuses from footage and metadata that would otherwise go unexamined. Law enforcement and intelligence analysts use it as one input among several, subject to the same evidentiary standards as any other source.
When to use this guide
- Starting an investigation and needing a working definition before choosing tools
- Explaining OSINT to a newsroom, client or colleague unfamiliar with the discipline
- Distinguishing OSINT from hacking, social engineering or unauthorised data access
- Building a repeatable process rather than searching ad hoc
- Evaluating whether a finding qualifies as OSINT-derived evidence
02
How is an OSINT investigation structured?
Every OSINT investigation follows the same underlying cycle, regardless of the technique or platform involved.
The tools below are starting points for building an OSINT practice, not a technique-specific stack. Each is free and requires no registration.
OSINT Framework: A free, browser-based directory of OSINT tools organised by category, including usernames, email addresses, domains, social media and geolocation. It does not collect intelligence itself; it points to the source or tool suited to a specific question. No registration required.
Google Advanced Search: A free structured search interface for narrowing results by site, file type, date range and exact phrase. It is the basis for search operator technique, sometimes called dorking, a foundational OSINT search method. No registration required.
Wayback Machine: A free archive of historical web page snapshots, run by the Internet Archive. Used to recover deleted or altered content and to establish when a page existed in a given state. No registration required.
Before you begin
Stop at the login
All tools referenced in this guide are free and require no login. If a source encountered later in an investigation asks for registration or payment, treat that as a deliberate escalation decision, not a default step.
Legal considerations
OSINT is the legal collection of publicly available information. It stops being OSINT the moment it requires bypassing access controls, using a false identity to gain access, or acquiring breached data. Data protection law, such as GDPR and equivalent regimes, still governs how findings are stored and used, regardless of jurisdiction.
