OSINT tools list: useful resources for open-source research

Open-source intelligence, or OSINT, is the process of gathering and assessing information from publicly available sources. It can support journalism, security work, due diligence, academic research and investigations into matters of public interest. The tools below can help organise that work, but they do not replace careful verification or sound judgement.

“Publicly available” does not automatically mean that information can be used for any purpose. Research should respect privacy, platform terms and applicable law. In the UK, relevant requirements may include the UK GDPR and Data Protection Act 2018, as well as laws concerning harassment, stalking and unauthorised access to computer systems.

General search and archived web pages

• Google, Bing and DuckDuckGo: General-purpose search engines for finding websites, documents and news. Search operators, such as quotation marks for an exact phrase or site: to narrow results to a particular domain, can make searches more precise. Use them to locate relevant public material, not to access restricted information.
• Internet Archive Wayback Machine: Lets users view snapshots of some websites captured over time. Archived pages can help establish what a site displayed on a particular date, although snapshots may be incomplete or absent.
• Google Alerts: Sends notifications when new search results match selected terms. It can be useful for monitoring public news or changes to an organisation’s online presence.

UK public records and company research

• Companies House: Provides public information about UK-registered companies, including filing histories, registered offices and officers. Entries should be checked against other sources, as filings can be late, incomplete or incorrect.
• The Charity Commission registers: The Charity Commission for England and Wales, the Scottish Charity Regulator and the Charity Commission for Northern Ireland each provide information about charities registered in their respective jurisdictions.
• Financial Conduct Authority (FCA) Register: Helps users check whether a financial services firm or individual is authorised or registered in the UK.
• The Gazette: The official public record for statutory notices, including certain insolvency, company and legal notices.

Domain names, DNS and internet infrastructure

• ICANN Lookup and Nominet WHOIS: Provide registration information for domain names where it is available. Privacy protections mean that registrant details may be limited or hidden.
• crt.sh: Searches publicly logged TLS certificates and can help identify subdomains associated with a domain. It is a source for research, not permission to test or access any systems found.
• DNSdumpster: Offers a visual overview of publicly observable DNS information linked to a domain.
• SecurityTrails: Provides domain and DNS history features, with availability depending on the account or plan.

Internet-connected devices and exposure checks

• Shodan: Search engine for information about internet-connected devices and services. Use it for authorised security research and high-level exposure checks; never attempt to access or interfere with systems without permission.
• Censys: Provides information about internet hosts, certificates and services. As with Shodan, findings should be treated as leads and handled within an authorised scope.
• Have I Been Pwned: Allows people to check whether an email address appears in known data breaches. Check only addresses you own or are authorised to assess, and follow the service’s guidance.

Social media and username research

• Platform-native search: Search functions on platforms such as LinkedIn, Reddit, Instagram and X can help find public posts, profiles and statements. Results and visibility vary by platform and user settings.
• Sherlock: An open-source tool that checks whether a username appears on a range of websites. A match is not proof that accounts belong to the same person; usernames can be reused or coincidental.
• Maltego: A visual investigation platform that can help map relationships between entities, such as domains, organisations and public profiles. Some data sources and features require a subscription.
• SpiderFoot: An open-source platform for automating searches across a range of public data sources. Configure it carefully and use it only for legitimate, authorised research.

Images, video and location clues

• Google Lens and TinEye: Reverse-image search services that can help find other appearances of an image online. A result may identify a similar image rather than the original, so check the source and context.
• ExifTool: A utility for inspecting metadata in image and other file formats. Many platforms remove metadata when files are uploaded, and metadata can be edited, so it should not be treated as conclusive evidence.
• InVID-WeVerify: A collection of tools and techniques for examining online video and images, including extracting keyframes and conducting reverse-image searches.
• OpenStreetMap: A collaborative map that can help identify publicly mapped features and compare locations. Mapping data may be incomplete or outdated.
• SunCalc: Shows the position of the sun at a given place and time. It can help assess a location or time claim when combined with other reliable evidence.

Research frameworks and learning resources

• OSINT Framework: A directory of OSINT resources arranged by topic. It is a starting point for discovering tools, rather than a guarantee that every listed service is safe, current or suitable.
• Bellingcat’s Online Investigation Toolkit: A collection of resources and guidance for researching and verifying online material, particularly in open-source investigations.

How to use OSINT tools responsibly

1. Define the purpose and scope. Record what question the research is intended to answer and what sources are appropriate.
2. Use lawful, authorised sources. Do not bypass access controls, impersonate people to obtain information or attempt to enter systems without permission.
3. Verify important findings. Seek confirmation from independent sources and distinguish direct evidence from inference.
4. Keep a research record. Note the source, date accessed, search method and any limitations. Preserve material in a way that does not alter the original where possible.
5. Minimise personal data. Collect only what is necessary, store it securely and avoid publishing sensitive details about private individuals.
6. Review the risks. Consider whether sharing a finding could expose someone to harm, and seek appropriate legal or professional advice when the stakes are high.

Choosing the right OSINT tools

The best OSINT toolkit depends on the task. Search engines and public registers may be enough for basic fact-checking, while specialist tools can help organise larger research projects. No tool proves a claim on its own: responsible OSINT relies on clear methods, source verification and respect for people’s privacy.

Exploring OSINT Tools: Top Choices, Best Free Options, and Future Trends

1. Is there a free OSINT tool?
2. Which tool is used for OSINT?
3. Are OSINT tools free?
4. What is the best OSINT tool in 2026?
5. What is the best OSINT tool for Kali?
6. What are the top 10 OSINT tools?

Is there a free OSINT tool?

Yes, many OSINT tools are free to use, including general search engines, the Internet Archive’s Wayback Machine, Companies House, OpenStreetMap and reverse-image search services such as TinEye. Some specialist tools also offer free versions with limited features, while charging for advanced searches or higher usage limits. Always check a tool’s terms and use it lawfully; free access does not guarantee that information is complete, accurate or suitable for every purpose.

Which tool is used for OSINT?

There is no single tool used for OSINT; the right choice depends on what you are researching. Search engines such as Google and Bing can help find public webpages, while Companies House is useful for checking UK company records. Tools such as TinEye can help trace images, and Maltego can organise links between publicly available information. Treat results as leads rather than proof, verify important findings with reliable sources, and use tools lawfully and respectfully.

Are OSINT tools free?

Many OSINT tools are free to use, including search engines, public registers and some open-source software. Others offer a limited free version alongside paid plans, or charge for access to specialist data and features. Check each provider’s pricing, terms and privacy policy, and remember that free results may be incomplete or out of date. Use tools only for lawful, authorised research and verify important findings with reliable sources.

What is the best OSINT tool in 2026?

There is no single “best” OSINT tool in 2026, as the right choice depends on the research question. For visualising relationships between public information, Maltego may be useful; for automating searches across public sources, SpiderFoot is an option; and for checking internet-connected devices, Shodan is designed for authorised security research. General search engines, the Wayback Machine, reverse-image search and UK public registers can be more suitable for straightforward verification. Treat tool results as leads rather than proof, verify important findings independently and use each tool lawfully and responsibly.

What is the best OSINT tool for Kali?

There is no single “best” OSINT tool for Kali Linux; the right choice depends on the research task. SpiderFoot can help automate searches across public sources, while Maltego is useful for mapping relationships between entities, and tools such as ExifTool can inspect file metadata. Check each tool’s official documentation for installation and compatibility, as availability in Kali’s repositories can change. Use OSINT tools only for lawful, authorised research, and verify findings with reliable sources.

What are the top 10 OSINT tools?

There is no definitive ranking, as the best OSINT tools depend on the research task, but a useful top 10 includes Google and Bing for web searches, the Wayback Machine for archived pages, Companies House for UK company records, Maltego and SpiderFoot for organising public-source research, Shodan and Censys for assessing publicly visible internet infrastructure, TinEye for reverse-image searches, ExifTool for inspecting file metadata, and Have I Been Pwned for checking whether an email address appears in known data breaches. Treat results as leads rather than proof, verify important findings with reliable sources, and use each tool lawfully and with respect for privacy.