How to Find Someone's Email Address (2026)

You can find someone's email address for free by combining three legal paths: look for the public address they already shared (LinkedIn, website, social media), deduce the email pattern of the company where they work, and validate the hypothesis with free tools. None of these "breaks" any secret; all of them start from data that is already open.

Is Finding Someone's Email the Same as Reverse Lookup?

No. Finding someone's email starts from the name, the company, or a profile to reach the address, this is the direct path. Reverse lookup does the opposite: it begins with a known email and tries to discover who owns it, on which sites they signed up, and whether it leaked. They are opposite operations and require different techniques.

This guide covers the direct path: you know who the person is and you want their email. If your case is the inverse, you already have the address and want to identify the holder, go straight to the reverse email lookup guide, which covers HIBP, Gravatar and profile cross-referencing.

How to Find the Email on LinkedIn and Social Media?

The simplest and most legal way to find someone's email is to look where the person published it themselves. Professionals often expose the address on LinkedIn (the "Contact info" section), in an Instagram bio with an email button, on a GitHub profile, on a personal website, and in comment and forum signatures.

On LinkedIn, open the profile, click "Contact info" and check whether the email is listed, many users leave it visible to connections. On Instagram business accounts, the "Email" button on the profile reveals the address without you having to follow them. On GitHub, old commits sometimes carry the email in the author field.

When the person uses the same handle across several services, it pays to map those profiles first with username OSINT and then cross-reference with techniques to find their social media accounts, often one of the profiles exposes the email the others hide.

How to Use Google to Find an Email?

Google finds emails that are published on any indexed page, and search operators make this precise. Combining the person's name with quotation marks, the site: operator, and the company domain filters the noise and surfaces addresses hidden inside internal pages, PDFs and lists.

Some useful operators for this sweep:

• "First Last" email, forces a search for the exact name alongside the word email.
• "First Last" "@company.com", looks for the address on the company's specific domain.
• site:company.com "First Last", scans only the company site for the person.
• site:company.com filetype:pdf, finds documents with signatures and contact lists.
• "Name" (email OR contact OR "reach me"), broadens to personal contact pages.

These operators are the foundation of any email-based OSINT investigation. It is worth repeating the search on Bing and Yandex: each engine indexes different pages, and Yandex tends to expose results Google omits.

How to Deduce a Corporate Email From a Name?

In a professional context, email is rarely random: companies adopt a fixed formation pattern. Discovering the pattern of a single employee lets you deduce the address of any other, simply by applying the name to the same format. It is the most reliable method when the person has not published their email.

The most common corporate patterns follow a few variations on first and last name. The table below shows the typical formats for "Mary Smith" at the example company example.com:

To discover which pattern a company uses, find the email of any employee (website, contact page, LinkedIn) and replicate the format. Tools like Hunter.io already do this automatically: they report the dominant pattern of a domain and the confidence score of each hypothesis.

Which Free Tools Find Emails?

Several tools locate and validate emails on a free tier, starting from the name and the domain. They scrape public pages, deduce the pattern, and test deliverability. The best-known ones offer free monthly searches before charging, enough for occasional investigations.

• Hunter.io: given the domain, it shows the email pattern and lists public addresses with a confidence score. Free plan with monthly searches.
• Gmail / Google Contacts suggestions: when you type a name into a new email, Google autocomplete sometimes suggests addresses already known to your network.
• Voila Norbert / FindThatLead: they take name plus company and return the likely email with verification.
• RocketReach / Apollo: B2B databases with free credits for professional profiles.
• Have I Been Pwned: it does not find the email, but it confirms whether a suspected address appears in breaches, useful for validating a hypothesis.

These platforms are part of the standard toolkit for anyone doing open-source investigation; see more options in our roundup of free OSINT tools. Remember that every tool works on public data, none "breaks into" a mailbox.

How to Confirm an Email Actually Exists?

Deducing an email from a pattern produces a hypothesis, not a certainty, validating it avoids burning the wrong guess. Verification checks whether the address accepts messages without you sending anything, by checking the mail server (the MX record) and the server's response to whether the mailbox exists.

In practice you have three confidence levels. Free verifiers (Hunter Verifier, NeverBounce trial, MailTester) classify the email as valid, risky, or nonexistent. A direct test, sending a short message and watching for a bounce, is the most conclusive, but only use it with a legitimate purpose and transparency about who you are.

What Does the Law Allow When Finding Someone's Email?

An email is personal data, and under privacy laws like GDPR, CCPA and LGPD, processing it requires a legal basis and a legitimate purpose. Collecting an address the person published for professional contact, with the goal of relevant communication, is supported. Scraping emails in bulk for spam, resale, or harassment has no legal basis and creates liability.

The dividing line is the purpose. Finding a supplier's email for a commercial proposal, a journalist's for a story, or a partner's during a due diligence are legitimate uses. Building lists for unsolicited blasts, or using the email to locate sensitive data without purpose, crosses the line.

Step by Step: Pivoting by Email in Espectro

Espectro does not "guess" an email from a name alone, but it speeds up both sides of the investigation: from a username, phone, or email you already have, it locates linked profiles and records, and it is in those profiles that the address tends to appear. It is the shortcut to close the hypothesis.

1. Log in and pick the search by username or by email module.
2. Enter the handle, email, or phone you already know about the person.
3. Review the linked profiles the platform locates across networks and services.
4. Open the profiles that expose contact, many carry the public email in the bio.
5. In the Photo module, extract EXIF/GPS from images to enrich the dossier.
6. Export the set to attach to your investigation.

Being honest about the scope: Espectro searches by username, email and phone to locate linked profiles, cross-references company records and partners, and extracts metadata from photos, but it does not run facial recognition on third parties nor "uncover a name from an ID number alone." For the inverse path, combine it with looking up who owns a number and with reverse email lookup.

Conclusion

Finding someone's email address for free is, above all, a job of collection and deduction over public data: check where they already published the address, use Google operators, deduce the corporate pattern, and validate with tools like Hunter.io. No step needs an illegal method, and the one that works most is the simplest: look where the person already exposed themselves.

If your case is the inverse, starting from an already known address, move on to reverse email lookup and to finding social media accounts by email. And always remember: documenting the purpose is what keeps the search within the law.