Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.
TL;DR
- Most lists of the best OSINT tools for 2026 are alphabetical dumps. We grouped 25 tools by the stage of research where they earn their place: planning, collection, verification, preservation, analysis and reporting.
- Every tool below was opened and checked in September 2026. Where a tool needs an API key, a paid plan or a local install, we say so.
- Free command-line tools such as Maigret, Sherlock and SpiderFoot are excellent at collection but leave you with scattered output and no audit trail.
- An aggregated platform such as UserSearch covers collection and case-keeping in one account; preservation tools such as Forensic Capture handle the evidence side.
- Pick one tool per stage, learn its failure modes, and review the stack every six months. Tools die quietly.
Why Do Best OSINT Tools Lists Fail Research Teams?
The best OSINT tools in 2026 are not one product but a small stack with one strong option per research stage: planning, collection, verification, preservation, analysis and reporting. Ask five analysts for their favourite OSINT tools and you will get fifty names, half of them broken. The problem is rarely a lack of tools. It is that teams collect tools the way people collect browser bookmarks: one at a time, with no idea which stage of the job each one serves, and no plan for what happens when one stops working in the middle of a case.
We see the result every week. A compliance analyst runs a username through three different checkers, gets three different answers, and has no record of which one said what. A newsroom verifies an image perfectly and then cannot prove, a month later, what the original post looked like. The collection was fine. The workflow around it was not.
So this guide is organised differently. We follow a piece of research from the first question to the final report, and at each stage we name the few tools we would actually hand to a new analyst in 2026, with the friction you will hit. If you only read one section, read the one for the stage your team finds hardest.
What Counts as an OSINT Tool in 2026?
Open-source intelligence is information gathered from publicly available sources and analysed to answer a specific question. The standard definition stresses both halves: the source must be public, and the output must be analysis, not a pile of links. An OSINT tool is anything that makes one step of that process faster or more reliable. That includes a search engine operator, a Python package, a browser extension or a full commercial platform.
The useful distinction is between single-purpose tools (one input type, one job, usually free) and aggregated platforms (many sources behind one login, usually paid). Most mature teams run both: open-source tools for depth and control, a platform for breadth, speed and record-keeping.
How We Chose These 25 Tools
We applied five tests to every candidate:
- It exists and works in 2026. We opened each official site or repository in September 2026. Repositories with no commits in over eighteen months were dropped unless the tool still works reliably.
- It serves a clear stage. If we could not say where in the workflow it belongs, it did not make the list.
- It uses public or properly licensed data. We favoured tools that are open about where their data comes from.
- Its limits are knowable. Rate limits, API keys and paid tiers are fine, as long as you can find out about them before you depend on the tool.
- It suits organisational research. Due diligence, security research, verification, journalism and compliance. We left some categories for other guides.
This is an opinionated list. Where two tools do the same job, we name the one we would start with and say why.
Why Is Your Tool Stack a Research Risk?
Tools are infrastructure, and infrastructure fails. Craig Silverman, reviewing more than 45 new and updated tools for Indicator's 2025 round-up, admitted that he would mention a tool in a briefing and realise "weeks or months later that it was dead." If a full-time tool reviewer cannot keep up with what still works, a busy fraud or compliance team has no chance without a deliberate process.
The flip side is that useful new capability arrives constantly. In November 2025 Google added SynthID checks to the Gemini app, so any analyst can now ask whether an image carries Google's AI watermark. That check did not exist a year earlier. A stack that is never reviewed misses both the losses and the gains.
There is also a quality cost. When each analyst uses a personal set of tools, results are not comparable across a team, and nobody can reproduce last quarter's work. For regulated teams, that is a governance problem as much as an efficiency one. It is the reason our platform for research professionals is built around shared Cases rather than individual searches.
Stage One: Planning and Scoping Tools
Good research starts with a written question, a lawful purpose and a list of identifiers you are allowed to research. The tools here help you decide where to look before you start looking.
1. Bellingcat's Online Investigation Toolkit
The Bellingcat toolkit is the best maintained directory in the field. Each entry says what the tool does, what it costs, and what its limits are, written by people who use it. Start here when you meet an unfamiliar input type.
2. OSINT Framework
OSINT Framework is a clickable tree of resources by category. It is excellent for brainstorming ("what sources exist for company data in Brazil?") and poor as a working tool, because a fair share of links at the edges of the tree are dead or have changed owners. Treat it as a map, not a toolbox.
3. Obsidian for Research Plans and Notes
Obsidian is a note-taking app that stores everything as plain Markdown files on your own disk. We like it for research plans because the files outlive the app, work with version control, and can be linked into a web of entities. Write the question, the lawful basis and the planned sources before you run a single search.
Stage Two: Collection Tools by Identifier Type
Collection is where most lists start and stop. We have grouped the tools by the identifier you begin with, because that is how a real case arrives.
Usernames: WhatsMyName, Maigret and Sherlock
4. WhatsMyName is a community-maintained list of sites with a free web front end at whatsmyname.app. It is the quickest browser-based check and the list itself powers several other tools.
5. Maigret is our default command-line checker. The Maigret repository lists thousands of supported sites, and by default a run checks the 500 highest-ranked sites by traffic. No API keys are needed.
pip3 install maigret
maigret example_handle --timeout 20 --html
maigret example_handle -a --tags gb--timeout 20 gives slow sites 20 seconds before giving up, --html writes a report file, -a checks every site in the database rather than the top 500, and --tags gb narrows the run to sites tagged for the UK. Expect false positives on sites that return a 200 status for any URL, and expect a full -a run to take a while.
6. Sherlock is lighter and older, with a smaller site list and simpler output. Install it from the Sherlock repository:
pipx install sherlock-project
sherlock example_handle --print-found --csv --timeout 30--print-found shows only hits, --csv writes a spreadsheet you can attach to case notes, and --timeout 30 overrides the 60-second default. If you only have time for one, use Maigret; it extracts more from each page it finds. Our username research guide covers how to judge whether two matching handles are genuinely connected.
Domains and Infrastructure: crt.sh, DNSDumpster, urlscan.io, Shodan, Censys and SpiderFoot
7. crt.sh searches Certificate Transparency logs, which record every publicly trusted TLS certificate. It is the fastest way to find subdomains an organisation never announced.
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u%25 is a URL-encoded % wildcard, output=json returns machine-readable results, and the jq and sort -u steps pull out unique hostnames. Friction: crt.sh is a free community service and returns 502 errors under load. When we tested it for this article, it did exactly that. Retry later rather than hammering it.
8. DNSDumpster gives a quick visual of DNS records and hosting for a domain. The DNSDumpster web search is free; the API needs a key.
9. urlscan.io loads a URL in a sandboxed browser and records the requests, redirects, screenshots and hosting. Check the visibility setting before you submit: public scans on urlscan.io can be seen by other users, so use Unlisted or Private for anything sensitive.
10. Shodan indexes internet-facing services and banners. The Shodan command-line client needs an API key, and many search filters require a paid membership.
pip install shodan
shodan init YOUR_API_KEY
shodan host 198.51.100.7shodan init stores your key locally, and shodan host returns open ports, banners and hosting details for one IP address.
11. Censys covers similar ground with strong certificate data. The free tier of Censys is limited, and the web interface blocks automated clients, so plan on using its API with a key for anything repeatable.
12. SpiderFoot is the open-source automation option, with over 200 modules that feed each other. From the SpiderFoot repository:
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
pip3 install -r requirements.txt
python3 ./sf.py -l 127.0.0.1:5001-l 127.0.0.1:5001 starts the web interface on your own machine only. Many of the best modules need their own API keys, and a full scan against a large domain can run for hours and return thousands of low-value records. Choose modules deliberately. See our domain infrastructure guide for a manual workflow.
Companies and Organisations: OpenCorporates, Companies House and OpenSanctions
13. OpenCorporates aggregates company registry data from more than 140 jurisdictions. Searching OpenCorporates on the web is free; API access is licensed.
14. Companies House is the UK registry and one of the most open in the world. The Companies House service shows filings, officers and persons with significant control, and the free REST API needs only a registered key:
curl -u YOUR_API_KEY: https://api.company-information.service.gov.uk/company/00000006The key goes in as the username with an empty second field, which is what the trailing colon does. Remember that UK filings are largely self-reported; a registered address proves nothing on its own.
15. OpenSanctions consolidates sanctions lists and related screening lists from hundreds of sources. OpenSanctions is free for non-commercial use; businesses need a data licence or the paid API.
Images and Places: InVID-WeVerify, TinEye, ExifTool, SunCalc and Copernicus Browser
16. InVID-WeVerify is a free browser plugin for journalists. The InVID verification plugin splits videos into keyframes, runs reverse image searches across several engines and reads metadata.
17. TinEye finds exact and near-exact copies of an image. Its "oldest" sort is the quickest way to find the first known appearance. TinEye is weaker than Google Lens at finding similar scenes, so run both.
Stage Three: Verification Tools
Collection gives you candidates. Verification decides which ones survive. The core habit is simple: never accept a finding from a single tool, and test every claim against an independent source.
18. ExifTool for Metadata
ExifTool reads metadata from almost any file format. It is maintained by Phil Harvey, and the source is mirrored in the ExifTool GitHub repository; most package managers also carry it.
exiftool -a -G1 -s image.jpg
exiftool -time:all -G1 image.jpg-a shows duplicate tags, -G1 shows which metadata group each tag comes from, -s prints short tag names, and -time:all lists every date and time field. Most social platforms strip metadata on upload, so an empty result from a downloaded post tells you nothing either way.
19. SunCalc for Shadows and Time of Day
SunCalc shows the sun's position and shadow direction for any place, date and time. If a photo claims to be from 9am but the shadows point the way they would at 4pm, you have a question to answer.
20. Copernicus Browser for Satellite Imagery
The Copernicus Browser gives free access to Sentinel imagery after registration. Resolution is coarse (10 metres per pixel for the best Sentinel-2 bands), but it is good enough to confirm large changes such as fires, flooding or new construction on a given date.
Stage Four: Preservation Tools
Web content changes and disappears. If a finding matters, capture it in a form you can later prove has not changed.
21. Forensic Capture
Our free Forensic Capture extension runs locally in Chrome, Edge, Brave, Opera and Vivaldi. It takes full-page captures, records a SHA-256 fingerprint of each one, adds two independent timestamps (RFC 3161 and OpenTimestamps), keeps cases and a hash-chained notebook, and exports PDF reports and an evidence bundle with an offline verifier.
22. Hunchly
Hunchly records the URL, timestamps and hashes of every page you visit during a session and makes full-page captures automatically. It is now part of Maltego's product family, and its paid plans suit teams who want every page logged by default.
23. Wayback Machine and ArchiveWeb.page
The Internet Archive's Save Page Now creates a public, third-party copy of a URL, which is useful as corroboration. For a local, replayable copy, ArchiveWeb.page records pages as you browse and exports standard WARC and WACZ files. Public archives can be slow, can refuse some sites, and are not under your control, so use them alongside your own capture, not instead of it.
Stage Five: Analysis Tools
Analysis turns a pile of results into a claim you can defend. Link charts and document search are the two tool types that repay the learning curve.
24. Maltego and Gephi for Link Analysis
Maltego is the commercial standard for link analysis, with a free Basic plan that includes the Community Edition of Maltego Graph and paid plans for commercial data. Gephi is the free, open-source alternative for visualising networks: export your entities and links to CSV and import them as a node table and an edge table. Gephi has no data connectors, which is often a strength. It shows only what you have verified.
25. Datashare for Document Sets
When a case produces hundreds of PDFs, Datashare, built by the ICIJ, indexes them on your own machine, runs text recognition on scans and extracts names of people, organisations and places. It is free and keeps the documents local.
Stage Six: Reporting Without Losing the Audit Trail
Reporting is where weak workflows show. A good report states the question, the sources, the method, the findings with confidence levels, and the gaps. For each finding, a reader should be able to see which source said it, when, and how it was checked. Obsidian notes, a spreadsheet of sources and a set of preserved captures will get you there by hand. It takes discipline, because nothing forces you to record the source of each line.
Where an Aggregated Platform Fits: UserSearch
The manual stack above is powerful and mostly free. It also means a dozen logins, a dozen API keys, a dozen output formats, and no single place where the case lives. That is the gap an aggregated platform fills.
UserSearch 2.0 is our web platform for professional OSINT research. It groups about 107 Modules into 18 Search types, including Username, Email, Phone, Corporate, Domain, IP, Cyber (Shodan Modules), Picture, Cryptocurrency, Chat Messaging (Telegram) and Public Forums (Reddit). One UserSearch account gives access to 100+ third-party data sources, so you do not need a separate account and key with each provider.
- OneScan runs one input across several data sources you select and merges the results with source attribution. The Credit cost is shown before you run it.
- Bulk search runs up to five inputs through one Module in a batch.
- Cases in Forensic Mode store search history and bookmarks, so the audit trail builds itself. Private mode stores no history when you do not need one.
- SargeBot, our AI research assistant, lets you pick the model (Claude, GPT or Grok), set a lawful objective, build entity searches and generate a PDF report. You still verify its output.
We are honest about the trade-off. A platform gives you breadth and record-keeping; it does not replace the depth of a specialist tool you know well. Results are leads to corroborate, and coverage depends on each third-party source. A practical split is to use UserSearch for the first pass and the case file, then reach for Maigret, SpiderFoot or Gephi when a thread needs more depth.
Worked Scenarios: Two Teams, Two Stacks
Scenario: A Supplier Check for a Compliance Team
Context. A procurement team at a fictional retailer asks compliance to check Quellbrook Components Ltd before a first order. The only identifiers are the company name, the domain quellbrook.example.com and a sales contact's handle, @example_handle.
Actions. The analyst writes the question and lawful basis in the Case notes, then pulls the company record from Companies House: incorporated eleven months ago, one director, a formation-agent address. OpenSanctions returns no match. crt.sh shows the domain's first certificate was issued three weeks ago. A Username search on the sales handle finds it on two marketplaces, both created in the same month. Each relevant page is captured with Forensic Capture.
Outcome. Nothing here proves wrongdoing, and the report says so. It does show a very young company with thin history, so compliance recommends payment on delivery and a follow-up check in three months. The whole record, with sources and captures, sits in one Case.
Scenario: Verifying a Viral Image for a Newsroom
Context. A regional newsroom receives a photo said to show flooding at a retail park that morning.
Actions. The producer runs the image through InVID-WeVerify and TinEye. TinEye's oldest match is a forum post from two years earlier. ExifTool on the emailed original shows a capture date from the same earlier year. SunCalc confirms the shadow angle fits a winter afternoon, not a September morning. The earlier post is saved with Save Page Now and captured locally.
Outcome. The newsroom runs a short piece explaining that the viral image is two years old, with the evidence preserved in case the original post is edited.
Legal and Ethical Limits on Your Toolkit
A tool being public does not make every use of it lawful. Under the UK GDPR, researching identifiable people needs a lawful basis, a clear purpose and proportionate collection; the ICO's guide to lawful basis is the place to start, and most organisational research relies on legitimate interests with a documented balancing test. This is general information, not legal advice.
- Record the purpose and lawful basis for each case before collecting anything.
- Collect what the question needs and no more. A supplier check does not need an employee's personal social media.
- Respect platform terms, rate limits and robots rules, and use official APIs where they exist.
- Stay passive: read what is public, and do not log in to other people's accounts or interact with the people you are researching.
- Set a retention period and delete case data when it ends.
Frequently Asked Questions About the Best OSINT Tools in 2026
What are the best OSINT tools in 2026?
The best OSINT tools in 2026 depend on the research stage. Bellingcat's toolkit and OSINT Framework help with planning, Maigret, crt.sh, Shodan and Companies House with collection, ExifTool, SunCalc and TinEye with verification, Hunchly and ArchiveWeb.page with preservation, and Maltego, Gephi and Datashare with analysis. Pick one strong option per stage and learn its failure modes.
What is the best free username search tool for OSINT?
Maigret is a strong free command-line username checker for OSINT. It checks the 500 highest-ranked sites by default, can check its whole database with -a and needs no API keys. WhatsMyName offers the quickest browser-based check at whatsmyname.app, and Sherlock is a lighter, older option with a smaller site list and simpler output.
Which OSINT tools are used to verify images?
Image verification in OSINT usually combines InVID-WeVerify for keyframes and multi-engine reverse image searches, TinEye for the oldest known copy of a picture, ExifTool for metadata, SunCalc for shadow direction and time of day, and Copernicus Browser for Sentinel satellite imagery. Most social platforms strip metadata on upload, so an empty ExifTool result proves nothing.
How do you preserve web pages as evidence in OSINT research?
Preserving web pages as evidence means capturing them in a form you can later prove has not changed. Forensic Capture, the free UserSearch browser extension, records full pages with SHA-256 fingerprints and two independent timestamps. Hunchly logs every page in a session, while Save Page Now and ArchiveWeb.page add public and local archive copies for corroboration.
What is the difference between an OSINT tool and an aggregated OSINT platform?
A single-purpose OSINT tool handles one input type and one job, and is usually free. An aggregated OSINT platform puts many data sources behind one login and is usually paid. Most mature research teams run both: open-source tools for depth and control, and a platform for breadth, speed and a consistent case record with an audit trail.
Is it legal to use OSINT tools in the UK?
A tool being public does not make every use of it lawful. Under the UK GDPR, researching identifiable people needs a lawful basis, a clear purpose and proportionate collection, and most organisational research relies on legitimate interests with a documented balancing test. Teams using OSINT tools should respect platform terms and rate limits, stay passive and set retention periods.
Build a Stack You Can Defend
The best OSINT tool in 2026 is not a single product. It is a small, deliberate stack with one strong option per stage, a written test case for each, and a record of every result. Start with the stage that fails most often on your team, replace the weakest tool there, and review the rest in six months.
If you want collection, case-keeping and reporting in one place, UserSearch gives you one account for 100+ data sources, OneScan to run an input across the sources you choose, Cases that keep the audit trail for you, and PDF reports through SargeBot. Pair it with Forensic Capture for evidence, and keep your favourite open-source tools for depth.
Stop guessing. Start researching with UserSearch. Create your UserSearch account and run your next case from one place.