Top 10 Free OSINT Tools in 2026 (That Actually Work)

Every few months somebody hits me up asking for "the best OSINT tool." That's the wrong question. There's no single tool that does it all — anyone selling you that is selling you something else too. Real OSINT work is a stack: a handful of free tools, each good at one job, chained together. I've been running these on actual engagements, not just reading about them in a listicle. Here are the ten I actually reach for, what they're for, and how to get running in under five minutes each.

1. Shodan

Shodan indexes internet-connected devices — servers, cameras, industrial control systems, exposed databases — searchable by IP, org name, or service banner. It's the search engine for things nobody meant to expose to the internet.

Real use case: On a recon phase, I ran a Shodan query against a client's org name and found two exposed RDP endpoints and a MongoDB instance with no auth — all before touching their network directly. That's the whole point of passive recon: findings with zero packets sent to the target.

2. Maltego CE

Maltego turns scattered OSINT data points — domains, emails, social handles, IPs — into a visual relationship graph. The free Community Edition caps transform runs but it's more than enough to map a small-to-mid org.

Real use case: I fed Maltego a target domain and a couple of employee names and it surfaced a personal email address linked to three other domains the same person owned — one of which was an unsecured side project hosted on the same server as company infrastructure. That kind of lateral connection is exactly what a spreadsheet can't show you.

3. theHarvester

theHarvester automates collection of emails, subdomains, names, and IPs from public sources — search engines, PGP key servers, cert transparency logs — in one command.

Real use case: First command I run on almost every engagement. Within a minute I've got a list of employee email formats I can use to guess names, plus subdomains I hadn't found yet through DNS enumeration alone.

4. Recon-ng

Recon-ng is a modular recon framework built like Metasploit — modules for different data sources, all feeding a shared workspace database so results compound as you go.

Real use case: When a target's footprint is large — multiple domains, subsidiaries, acquisitions — Recon-ng's workspace model keeps everything organized in one place instead of ten different tool outputs I have to manually cross-reference.

5. SpiderFoot

SpiderFoot automates OSINT collection across 200+ data sources and correlates the results automatically, flagging things like exposed credentials, open ports, and breach data in one pass.

Real use case: I use SpiderFoot's web UI for client-facing exposure reports — it's the tool I point at a domain when I want a broad first-pass sweep before I go deep with anything else. The automatic correlation catches things I'd miss doing it manually at 11pm.

6. OSINT Framework

Not a tool — a curated directory (osintframework.com) of hundreds of free OSINT resources organized by category: usernames, emails, phone numbers, geolocation, and more. It's the map, not the vehicle.

Real use case: When I hit a data type I don't work with often — say, tracing a phone number or a cryptocurrency wallet address — this is where I start. It saves the "what tool even does this" step that eats time on unfamiliar engagements.

7. Amass

Amass performs in-depth subdomain enumeration and network mapping by combining DNS brute-forcing, certificate transparency logs, and dozens of public APIs.

Real use case: Amass consistently finds subdomains theHarvester misses — forgotten staging environments, regional subdomains, old marketing microsites still pointed at active infrastructure. It's slower than most tools on this list, but the depth is worth the wait time.

8. Metagoofil

Metagoofil pulls public documents (PDF, DOCX, XLSX, PPTX) from a target domain and extracts metadata — usernames, software versions, internal file paths, and author names embedded in the files.

Real use case: Metadata from a single leaked PDF once gave me an internal software version number and the exact Windows domain name a company used — both things nobody would have handed over in a phone call. Document metadata is a consistently underrated leak source.

9. Creepy

Creepy is a geolocation OSINT tool that aggregates location data from social media posts and images to plot a target's movement patterns on a map.

Real use case: Used mainly in physical security assessments and executive protection engagements — mapping where a public figure posts from regularly is the first step in evaluating their real-world exposure, not just their digital one.

10. Photon

Photon is a fast, lightweight web crawler built specifically for OSINT — it extracts URLs, emails, social media links, files, and subdomains from a target site as it crawls.

Real use case: When I need a quick site-wide sweep for exposed emails, API keys accidentally committed into JS files, or forgotten endpoints, Photon does it in the time it takes to make coffee. It's not exhaustive, but it's fast, and fast matters when you're triaging a large scope.

Chaining It Into a Recon Workflow

No single tool above is the point. The point is the order you run them in and how each output feeds the next tool's input. Here's roughly how I chain them on a real engagement:

• Start wide with SpiderFoot or the OSINT Framework — get a broad first-pass map of what's out there before committing time anywhere specific.
• Enumerate infrastructure with Amass and Shodan — build the full subdomain and exposed-service picture.
• Pull people and email data with theHarvester and Metagoofil — document metadata and harvested emails give you the human layer.
• Crawl with Photon — catch anything sitting in plain sight on the live site itself.
• Visualize with Maltego — once you have enough data points, the graph is what reveals connections a spreadsheet never will.
• Organize it all in Recon-ng — if the scope is big enough to need a persistent workspace instead of loose output files.

None of this requires a budget. It requires discipline and a system. Most people fail at OSINT not because they don't know the tools — it's because they run one tool, get a partial answer, and stop. The value is in the chain, not any single link in it.