This section is different from the rest of the guide. We are not talking about search engines or operators here. We are talking about dedicated research tools — websites and tools built specifically to aggregate, cross-reference, and surface information about people, businesses, phone numbers, addresses, emails, and identities. Most of these are completely free. Most people have never heard of them. All of them are used by professional investigators, journalists, law enforcement, and security researchers every single day.
Every tool is flagged by geographic coverage: 🇺🇸 = US-focused | 🌍 = International | 🌐 = Global with regional strengths noted
Free tier limitations are noted honestly — no sugarcoating what is paywalled and what is genuinely free.
Firstly, please remember I am putting you on game here. The first writing of this is 27 March 2026. These sites may be taken down, change, or become useless with time. More will pop up, that is where research and collaborations come into play. The power of these tools is not in running one search on one site. It is in cross-referencing — taking what one site returns and verifying, expanding, and connecting it using three or four others.
Think of it like a puzzle. One piece tells you almost nothing. Ten pieces from different boxes that all fit together tell you the whole picture. Every data point you find becomes a new search seed for the next tool.
The cross-reference workflow:
- Start with your seed — name, email, username, phone, or address
- Run it through the most relevant tools in this section
- Every new data point becomes a new seed for the next search
- Cross-reference anything significant across at least two independent sources before treating it as confirmed
- Document everything as you go — investigations get messy fast
These aggregate public records, voter registration, property records, court records, and other publicly available data into searchable profiles. No hacking. No illegal access. All of this is public record data that these sites have compiled and made searchable.
URL: fastpeoplesearch.com
What it returns for free:
- Full name and aliases
- Current and previous addresses with move-in dates
- Phone numbers (landline and cell)
- Age and approximate birth year
- Relatives and household members
- Associated names
What makes it special: FastPeopleSearch is one of the most generous free people search tools in the US. Full address history, phone numbers, and relative connections with zero payment and zero account required. This is the first stop for any US-based people search.
Pro tip — the relatives section: The relative connections are often more valuable than the direct results. They let you confirm identity by checking whether listed relatives match other known information. They also expand your investigation to the target's network — family members, roommates, and long-term associates who share address history.
Limitation: US only. Data is thinner in states with restricted public records like California and New York. Florida and Texas return the richest data due to open records laws.
URL: truepeoplesearch.com
What it returns for free:
- Full name and aliases
- Current and historical addresses
- Phone numbers
- Age
- Associated people
- Email addresses (inconsistent but when present, valuable)
The reverse address search: This is one of the most underused features on any free tool. Enter an address and get every person associated with it — current residents, previous residents, and people who have used it as a mailing address.
Use case: You have a suspected home address for a target. Run it through TruePeopleSearch reverse address to confirm whether the target's name appears, who else lives there, and who previously lived there. Previous residents can sometimes be family members or associates worth investigating.
URL: thatsthem.com
What it returns for free:
- Full name
- Address
- Phone number
- Email address — one of the only free tools that returns this
- Vehicle information (sometimes)
- IP address associated with the record (occasionally)
Why this tool is in a category of its own: ThatsThem returns email addresses and vehicle information for free. Almost no other people search tool does this without payment. The IP address associations are historical and not always current but are useful for cross-referencing with other data points.
Multiple search methods:
- Name + location
- Phone number (reverse lookup)
- Email address (reverse — find the person behind an email)
- IP address (find records associated with an IP)
- VIN number (vehicle history)
The reverse email search is particularly powerful — enter an email address and get a real name and physical address. This is the bridge between an online identity and a real-world one.
URL: radaris.com
What it returns for free:
- Name and location
- Some address history
- Social media profile links
- Business associations
- Professional licenses (doctors, lawyers, contractors)
What makes it different: Radaris connects people to businesses they are associated with — not just as employees but as owners, officers, and registered agents. For investigating business owners and executives this surfaces corporate connections that pure people search tools miss completely.
International coverage: Canada, UK, and Australia with varying depth. One of the few people search tools with meaningful coverage outside the US.
URL: clustrmaps.com
What it returns for free:
- Address history mapped geographically
- Associated people
- Location pattern visualization
What makes it different: Clustrmaps visualizes address data on a map — showing not just where someone has lived but the geographic pattern of their movements over time. Patterns reveal things raw lists do not. Someone who has lived in five cities in three years tells a different story than someone with thirty years at the same address.
URL: webmii.com
What it returns for free:
- Aggregated web presence for a name
- Social media profiles
- News mentions
- Images associated with the name
- Web score (how much public presence a person has)
What makes it different: Webmii is not a records database — it is a web presence aggregator. It searches across the public web and social platforms for mentions of a name and pulls them together in one place. For finding someone's digital footprint rather than their physical records, Webmii is the starting point.
International strength: Works well globally since it searches the live web rather than US public records databases.
URL: pipl.com
Free tier: Very limited — mostly a paid professional tool
Why it is still listed: Pipl has one of the deepest people search indexes in the world — combining surface web, social media, and deep web data. The free preview confirms whether a substantial profile exists. For professional investigations where cost is justified, Pipl is the gold standard. Even the free preview is useful for confirming whether a target has significant indexed presence before committing to a paid search.
URL: lullar.com
What it returns for free:
- Social media profiles associated with a name or email
- Profile photos
- Cross-platform account connections
What makes it different: Lullar focuses specifically on connecting names and emails to social media accounts across platforms including lesser-known regional networks. It surfaces accounts on platforms that larger aggregators miss — particularly older and regional social networks.
URL: spydialer.com
What it returns for free:
- Registered name for a phone number
- Carrier information
- Line type (cell, landline, VoIP)
- Voicemail greeting playback
The voicemail feature is unique and powerful: SpyDialer can silently connect to a number's voicemail and play the greeting without the phone ever ringing. Voicemail greetings frequently contain the person's real name spoken in their own voice — direct identity confirmation from a phone number alone. Skip tracers and investigators use this technique regularly. Almost no other free tool offers it.
URL: freecarrierlookup.com
What it returns for free:
- Carrier name
- Line type (cell, landline, VoIP)
- Whether the number is ported
Why line type matters: VoIP numbers (Google Voice, Skype, Burner, TextNow) behave differently than real cell numbers in people search databases. A VoIP number is often a deliberate anonymization choice — knowing this upfront tells you the target may be privacy-conscious and that the number itself is unlikely to lead to real personal data.
A ported number means someone transferred their number from one carrier to another — common when people move or switch providers. Not always significant but worth noting.
URL: calleridtest.com
What it returns for free:
- Carrier and country
- Line type
- Number validity check
- International number support
Best for: International number identification. Handles non-US formats better than most reverse lookup tools.
URL: mrnumber.com
What it returns for free:
- Registered name (when available)
- Carrier
- Spam reports and reputation
- Community-reported information about the number
The community reports are the unique value. Spam databases and community-reported information about a number reveal how it has been used — whether it has been reported as a scam number, a business line, or a personal number with a name attached in user reports.
URL: sync.me
What it returns for free:
- Name associated with the number
- Social media profiles connected to the number
- Profile photo sometimes
What makes it different: Sync.me pulls from its contact-sharing app user base. People who install the app and allow contact syncing contribute their phone books to the database. This crowdsourced approach connects phone numbers to names and social profiles in ways traditional carrier databases cannot — particularly strong for mobile numbers that do not appear in traditional people search tools.
URL: numlookup.com
What it returns for free:
- Carrier name
- Line type
- Country of origin
- Owner name (sometimes)
Best for: International numbers. Strong global coverage for carrier and country identification on non-US numbers.
URL: skymem.info
What it returns for free:
- Email addresses associated with a domain
- Source URL where each email was publicly found
- No account required, no credit limit
What makes it different: Completely free with no limits. Returns emails with source attribution — you can see exactly where each email was found publicly. Smaller database than paid tools but genuinely unlimited and free with no registration.
URL: snov.io
What it returns for free (150 credits/month):
- Email addresses for a domain
- Name and job title for each
- Email verification
- Technology stack detection for the domain
The tech stack detection bonus: Snov.io identifies what software a company runs just from their domain. CRM systems, marketing platforms, analytics tools, hosting providers — this is technology fingerprinting without touching a single system.
URL: verifalia.com/email-verify
What it returns for free:
- Whether an email is valid and deliverable
- Mail server information
- Whether it is disposable or role-based
- Syntax validation
Best use case: Before building on an email address found through other research, verify it is real. A confirmed deliverable result means the mailbox exists and accepts mail — strong confirmation the address is genuine and active.
URL: emailrep.io
What it returns for free:
- Reputation score
- Breach database presence
- Associated social media flags
- Account age estimate
- Disposable email detection
The disposable detection matters: If a target is using Guerrilla Mail, Mailinator, or another temp service, Emailrep flags it immediately. This tells you the account was created for anonymity and the email itself will not lead to real identity data — saving you from chasing a dead end.
URL: thatsthem.com/reverse-email-lookup
What it returns for free:
- Full name behind the email
- Physical address
- Phone number
- Connected profiles
This is the bridge between online and offline identity. Most tools go name → email. This goes email → real person with address and phone. When it hits, it is one of the most direct free identity connections available anywhere.
URL: whatsmyname.app
What it returns for free:
- Which platforms a username is registered on
- Direct links to each found profile
- No install, fully web-based
- 600+ platforms checked
Best for: Fast web-based username sweep when you cannot or do not want to run local tools. Covers mainstream and niche platforms including gaming, forums, adult platforms, and regional social networks.
URL: namechk.com
What it returns for free:
- Username availability across 100+ platforms
- Taken = account exists, Available = does not
The investigative use: Available means no account. Taken means an account exists — even if the platform does not appear in other username search tools. Namechk covers platforms that Sherlock and WhatsMyName miss, particularly domain registrars and brand-focused platforms.
URL: usersearch.org
What it returns for free:
- Username search across social networks, dating sites, and forums
- Direct profile links
- Covers dating platforms specifically — rare in free tools
The dating platform coverage is the unique value. Most username search tools skip dating sites. Usersearch.org covers Tinder, OkCupid, PlentyOfFish, Badoo, and others. For investigations where romantic relationships or dating activity is relevant, this is the tool most guides do not mention.
URL: social-searcher.com
What it returns for free (limited searches):
- Real-time social media posts mentioning a keyword or name
- Sentiment analysis
- Post history and patterns
- Platform breakdown of mentions
What makes it different: Social Searcher monitors live social media rather than searching static profiles. For tracking current activity, monitoring mentions of a target in real time, or finding recent posts that have not been indexed by Google yet, Social Searcher finds content that search engines have not caught up with.
URL: aware-online.com/osint-tools
What it returns for free:
- Curated collection of OSINT search tools organized by category
- Username search, image search, email search, phone search
- Direct links to working tools with descriptions
This is a tool directory not a search tool itself — but it belongs here because it is one of the best-maintained free OSINT tool collections available and regularly updated with working tools as others go down.
URL: opencorporates.com
What it returns for free:
- Company registration records from 140+ jurisdictions
- Officers, directors, and registered agents
- Filing history
- Registered address
- Company status (active, dissolved, etc.)
Why this matters for OSINT: Company registration records are public and reveal the real people behind businesses. A shell company or LLC may have an anonymous brand name but its registration records contain the name of its registered agent, officers, and sometimes beneficial owners. OpenCorporates aggregates these records from 140+ jurisdictions in one searchable interface.
The officer search: Search by person name to find every company a person is an officer or director of — past and present. This maps the full corporate network of an individual even when they have tried to obscure their involvement through multiple entities.
URL: efts.sec.gov/LATEST/search-index?q=%22search+term%22
What it returns for free:
- Full text search of all SEC filings
- 10-K annual reports, 10-Q quarterly reports, proxy statements
- Executive compensation, insider holdings, business descriptions
- Names, addresses, and relationships disclosed in filings
Why this is underused: SEC filings are some of the most information-rich public documents that exist — and they are fully searchable for free. Executive names, home addresses (sometimes), compensation, related party transactions, and business relationships are all disclosed in filings. EDGAR's full text search lets you find any name, address, or company across millions of filings instantly.
URL: bizapedia.com
What it returns for free:
- State business registration records
- Registered agents
- Officer names and addresses
- Filing dates and history
What makes it different from OpenCorporates: Bizapedia focuses on US state-level registrations with deeper detail per filing than OpenCorporates for US entities. It also has a people search that goes the other direction — search a person's name and find every business they are registered with across all US states.
URL: judyrecords.com
What it returns for free:
- Court records from 100+ million US cases
- Civil, criminal, traffic, family, and bankruptcy cases
- Party names, case numbers, filing dates, outcomes
Why court records matter for OSINT: Court filings contain sworn testimony, addresses, financial information, relationships, and disputes that people would never voluntarily make public. A civil lawsuit between business partners reveals details about both parties that no social media profile or public records database contains. Judyrecords searches across jurisdictions simultaneously — no need to check each court system individually.
URL: pacer.gov
Cost: 10 cents per page — essentially free for light use
What it returns:
- Federal court records (district, bankruptcy, appellate)
- Full case documents including complaints, motions, and judgments
- Party names, attorney information, and filing history
Why federal records specifically: Federal cases involve more serious matters — federal criminal charges, large civil disputes, bankruptcy, and federal regulatory actions. The detail in federal filings often exceeds what state court records contain. PACER is the authoritative source for federal court records and at 10 cents per page is effectively free for targeted searches.
URL: offshoreleaks.icij.org
What it returns for free:
- Panama Papers data
- Pandora Papers data
- Paradise Papers data
- Offshore Leaks original data
- Names, entities, addresses, and connections in offshore financial structures
Why this database is significant: The Panama Papers, Pandora Papers, and Paradise Papers represent the largest financial document leaks in history. The ICIJ (International Consortium of Investigative Journalists) built a searchable database from this data. Searching a person or company name here reveals offshore accounts, shell companies, and financial structures that would otherwise be completely opaque.
Used by investigative journalists, law enforcement, and compliance professionals globally. Completely free.
URL: realtor.com
What it returns for free:
- Property ownership records
- Purchase history and prices
- Property tax records
- Square footage, lot size, year built
- Owner name (for non-LLC owned properties)
The ownership record use case: Property records are public in the US and reveal the legal owner of every piece of real estate. If a target owns a home, their name is in the public property records. If they own it through an LLC, the LLC name appears — which then leads to OpenCorporates for the officer records behind the LLC.
Direct access — search "[county name] assessor property search"
What they return for free:
- Legal owner name
- Mailing address (sometimes different from property address)
- Purchase price and date
- Tax assessment value
- Parcel maps
Why go to county assessors directly: Third-party aggregators like Realtor.com and Zillow sometimes lag behind or have incomplete ownership data. The county assessor's office is the original source — going directly returns the most current and complete ownership information available.
URL: vehiclehistory.com
What it returns for free:
- Basic vehicle history from VIN number
- Title history (states where titled)
- Odometer readings
- Accident reports (partial)
- Recall information
The title history use: A vehicle titled in multiple states over time shows geographic movement. Combined with address history from people search tools, vehicle title history can confirm or contradict a target's claimed residence history.
URL: breachdirectory.org
What it returns for free:
- Whether an email appears in known breach data
- Partial password hash preview
- Which breach the data came from
What makes it different from HIBP: BreachDirectory shows partial password information — not the full password but enough to confirm the data is real and assess password patterns. This is used in security audits to demonstrate credential exposure to clients without fully exposing the credentials.
URL: intelx.io
What it returns for free (limited):
- Search across dark web, leaked databases, Tor, I2P
- Historical web archive search
- Telegram channel search
- Document and paste site search
Why this is in its own category: IntelligenceX is one of the only free tools that indexes dark web content alongside surface web content in a single searchable interface. The free tier is limited in results but gives you visibility into whether a target appears in dark web contexts — something no other tool in this section provides.
URL: dehashed.com
Free tier: Email search with limited results
What it returns:
- Breach database search across email, username, IP, name, address
- Password hashes from breach data
- Source breach identification
The multi-field search is the key feature: DeHashed lets you search by email, username, IP address, name, and physical address simultaneously across breach data. Finding a target's IP address in breach data is rare but when it appears it can connect an online identity to a physical location through ISP records.
URL: pimeyes.com
What it returns for free (limited searches):
- Facial recognition search across the public web
- Pages where a face appears
- Similarity score for each match
Why this is powerful: PimEyes is one of the most capable free facial recognition search tools available to the public. Upload a face and it searches across millions of indexed pages for appearances of that face. Used by journalists, investigators, and researchers to identify people from photos and find their online presence.
Free tier limitation: Limited daily searches and results are partially obscured — paid tier shows full results. Even the free preview confirms whether matches exist.
URL: facecheck.id
What it returns for free:
- Facial recognition search specifically across social media
- Matches with profile links
- Similarity scores
What makes it different from PimEyes: FaceCheck.ID focuses specifically on social media platforms rather than the broader web. For finding social accounts associated with a face it is often more targeted than PimEyes. Run both for comprehensive coverage.
URL: tineye.com
What it returns for free:
- Exact and near-exact image matches across the web
- Oldest known appearance of an image
- All indexed locations where the image appears
- Image modification history
The oldest appearance feature is unique: TinEye tracks when an image first appeared on the web. This dates accounts and identities — a profile picture that first appeared in 2015 on a photography site and later showed up as a social media profile picture in 2019 tells you something about the account's authenticity and the identity behind it.
All of these tools work best together. Here is the complete professional cross-reference workflow depending on your starting seed:
1. FastPeopleSearch → address history, phone, relatives
2. TruePeopleSearch → cross-reference address, reverse address
3. ThatsThem → email address and vehicle
4. Radaris → business associations
5. Webmii → web and social media presence
6. Judyrecords → court records
7. OpenCorporates → business registrations
1. SpyDialer → name + voicemail playback
2. FreeCarrierLookup → carrier and line type
3. Sync.me → social media connections
4. Mr. Number → community reports and spam history
5. ThatsThem reverse phone → full identity record
6. TruePeopleSearch reverse phone → address history
1. Thatsthem reverse email → real name and address
2. Skymem → other emails on the same domain
3. Snov.io → domain email enumeration
4. Verifalia → confirm the email is valid
5. Emailrep.io → reputation and breach presence
6. BreachDirectory → breach data with partial hash
7. Holehe (local) → platform registrations
1. WhatsMyName → fast web-based platform sweep
2. Namechk → additional platform coverage
3. Usersearch.org → dating site coverage
4. Maigret (local) → deep profile data pull from all found accounts
5. Social Searcher → live social media activity
1. Yandex Images → best facial recognition, VK coverage
2. PimEyes → broad web facial search
3. FaceCheck.ID → social media specific facial search
4. TinEye → image history and first appearance date
5. Google Images → mainstream web coverage
6. Bing Visual Search → additional index coverage
1. TruePeopleSearch reverse address → all associated people
2. ThatsThem reverse address → email and vehicle data
3. County assessor → legal owner and tax records
4. Realtor.com → purchase history and ownership
5. Judyrecords → court records for address occupants
6. FastPeopleSearch → cross-reference all found names
by SudoChef · Part of the SudoCode Pentesting Methodology Guide