Skip to main content

    What are the best open source intelligence tools?

    Updated October 20, 2026

    Key takeaway

    There is no agreed top tool, but SpiderFoot and theHarvester are named by all four engines, with Maltego and Shodan each named by three. They sort tools by job: SpiderFoot for automated collection, theHarvester for emails and subdomains of a domain, Shodan for exposed devices, and Maltego for link analysis.

    Mostly agree

    SpiderFoot is a leading tool for automated OSINT collection

    theHarvester is a useful early-stage tool for domain research

    Shodan is the key tool for finding exposed devices and servers

    Where they differ

    Which tool comes first

      What counts as open source

        Verdict

        The engines agree on a toolkit rather than a single best tool, with SpiderFoot and theHarvester in most lists. ChatGPT starts with Sherlock, Copilot and Gemini lead with Maltego, and Google AI Mode leads with Nmap.

        What engines actually searched

        The sub-queries each engine actually searched before answering.

        Cited, but not mentioned

        1 site cites this answer without naming anyone

        Full responses

        5 of 5 engines that answered. Full stored text as captured, with dashes shown as hyphens. Nothing is summarised.

        ChatGPT7,169 characters · October 15, 2026

        The best open-source intelligence (OSINT) tools depend on what you're investigating: people and usernames, websites and domains, cybersecurity threats, images and locations, or relationships between organizations.

        If you want a powerful toolkit without spending much money, I'd start with Sherlock, SpiderFoot, theHarvester, OWASP Amass, and the OSINT Framework, then add specialized tools for your investigations. One important distinction: open-source intelligence means intelligence gathered from publicly available information; it doesn't necessarily mean the software itself is open-source. Some popular OSINT tools are proprietary or freemium. The Best Free OSINT Tools (2026)OSINT Tools in 2026: The Reconnaissance Layer

        The best OSINT tools by category

        1. Sherlock

        Best for usernames

        Searches public profiles across hundreds of social networks and websites using a username. Useful for digital-footprint research and checking whether a handle appears on multiple platforms.

        2. SpiderFoot

        Best for automated OSINT

        Automates collection from numerous data sources using inputs such as domains, IP addresses, email addresses and other identifiers. Offers a web interface and command-line options.

        3. theHarvester

        Best for domain research

        Collects publicly discoverable email addresses, subdomains, hosts and related information associated with a domain. A useful first step in an authorized security assessment.

        4. OWASP Amass

        Best for infrastructure discovery

        Maps an organization's internet-facing assets and discovers domains and related infrastructure through OSINT and reconnaissance techniques.

        5. Recon-ng

        A modular, command-line reconnaissance framework for organizing and automating information gathering. Best suited to users comfortable with structured workflows and API-backed modules.

        6. Maltego

        One of the best-known tools for visualizing connections among people, organizations, domains and infrastructure. Excellent for link analysis, but not fully open source; its free offering has limitations.

        7. OSINT Framework

        A categorized directory of OSINT resources covering usernames, email addresses, domains, social networks, geolocation and more. Particularly useful when you don't know which tool fits a task.

        More excellent tools worth knowing

        These complement the main toolkit, depending on your specialty.

        ToolBest useAccess
        MaigretUsername and profile discoveryOpen source
        Bellingcat's Online Investigation ToolkitInvestigative journalism, verification and geolocationFree resources
        ExifToolExtracting metadata from images and documentsOpen source
        CytoscapeVisualizing relationships and networksOpen source
        MISPSharing cyber threat intelligence and indicatorsOpen source
        the Wayback MachineReviewing archived versions of websitesFree web service
        Have I Been PwnedChecking known data-breach exposureFree and paid options
        CensysInternet infrastructure and certificate researchFree and paid options

        Which tools should you choose?

        People and online identities

        Sherlock + Maigret + manual verification of public profiles.

        Cybersecurity and threat intelligence

        SpiderFoot + theHarvester + OWASP Amass + Censys.

        Investigative journalism and geolocation

        Bellingcat's toolkit + archived websites + image verification and mapping tools.

        Connecting entities and evidence

        Maltego for convenience, or Cytoscape for an open-source graph visualization option.

        My recommended starter stack

        If I were building a mostly free, open-source OSINT workstation, I'd start with:

        1. OSINT Framework - discover the right resources.
        2. Sherlock - investigate public username footprints.
        3. SpiderFoot - automate broader collection.
        4. theHarvester and Amass - research domains and infrastructure you are authorized to assess.
        5. ExifTool and the Wayback Machine - inspect metadata and historical web evidence.
        6. Cytoscape - organize and visualize relationships.

        Keep in mind that some tools depend on external websites, rate limits or API keys, and their results can be incomplete or produce false matches. Verify important findings with independent sources. Only investigate personal information within an appropriate lawful and ethical scope.

        Let me narrow this down for you

        Which type of OSINT are you most interested in? I can recommend a more specialized toolkit, including installation instructions and practical workflows.

        Gemini logo Gemini6,915 characters · October 15, 2026

        Open Source Intelligence (OSINT) tools span various categories depending on whether you are looking for infrastructure scanning, social media investigation, link analysis, or data breach discovery.

        The best OSINT tools are categorized below by their primary use cases:

        1. Data Visualization & Link Analysis

        2. Infrastructure, Network & IoT Reconnaissance

        • Shodan: Often called the search engine for internet-connected devices. It scans the entire public internet to discover exposed servers, IoT devices, routers, webcams, and industrial control systems, making it indispensable for network defense and reconnaissance. What is OSINT? Top 15 AI-Powered OSINT Tools In 2026

        • Censys: A powerful alternative/complement to Shodan that continuously crawls IP space and certificates. It helps security teams discover internet-facing assets and analyze cryptographic certificates. Open Source Intelligence Tools: 10 OSINT Tools Ranked (2026)

        • theHarvester: A popular, open-source command-line tool designed for early-stage penetration testing and red-teaming. It gathers emails, subdomains, hosts, and employee names from public sources like search engines and PGP key servers. Open Source Intelligence Tools: 10 OSINT Tools Ranked (2026)

        3. Automated Scanning & Recon

        4. Breach, Paste, & Dark Web Intelligence

        • Intelligence X: A search engine and data archive that indexes historical data, breaches, paste sites, Tor/I2P darknet data, and WHOIS records. It uses unique "selectors" (like crypto wallets, emails, or IPs) to track digital footprints across hidden forums.

        • Have I Been Pwned (HIBP): Essential for checking whether email addresses or phone numbers have been exposed in public data breaches. It also offers domain-wide search capabilities for enterprise monitoring.

        5. Digital Forensics & Web Documentation

        Selection Summary

        Are you looking for tools tailored to a specific type of investigation, such as brand protection, threat intelligence, or social media mapping?

        Google AI Mode2,962 characters · October 15, 2026

        Open Source Intelligence (OSINT) tools span various domains like infrastructure mapping, social media foot printing, and breach checking. The industry favorites are organized below by their primary use cases.

        Infrastructure, Domains, and Network Reconnaissance

        • OWASP Amass : An exceptional tool for in-depth attack surface mapping and external asset discovery, performing passive and active reconnaissance to build comprehensive DNS graphs.

        • Shodan : Often described as a search engine for internet-connected devices, it allows security researchers to find specific machine configurations, exposed servers, and vulnerable IoT infrastructure.

        • Web-Check : A modern, all-in-one OSINT tool that analyzes any domain or IP by pulling extensive data from DNS records, server locations, security headers, and open ports into a clean dashboard.

        Social Media and Digital Footprints

          • Sherlock : A command-line utility that hunts down social media accounts across hundreds of platforms by checking target usernames concurrently.

        • WhatsMyName : A flexible, JSON-driven platform alternative to Sherlock that queries various websites to track down specific username presences with high accuracy.

        • Holehe : A specialized privacy and recon tool that checks if an email address is registered on hundreds of sites (like Twitter, Instagram, and Spotify) via forgotten-password workflows without alerting the user.

        Email, Credentials, and Breaches

          • Have I Been Pwned (HIBP) : The premier database resource for checking whether email addresses, usernames, or passwords have been leaked in public data breaches.

        • theHarvester : A simple yet effective tool designed for early-stage penetration testing and red teaming to gather emails, subdomains, and names from public sources like search engines and PGP key servers.

        Comprehensive Frameworks and Meta-Analysis

          • SpiderFoot : An automation-heavy OSINT framework that integrates with dozens of public data sources to query threats, IP info, email leaks, and network data in one unified scan.

        • ExifTool : An indispensable utility for media and document analysis, used to read, write, and extract hidden metadata (such as GPS coordinates, device models, and creation timestamps) from images or files.

        If you want to narrow this down, let me know:

        • Are you focusing on corporate/infrastructure reconnaissance or people/identity investigation?
        • Do you prefer command-line tools or web-based dashboards?
        Perplexity1,000 characters · October 20, 2026

        The best choice depends on the investigation: Maltego for visualizing connections, SpiderFoot for automated open-source collection, theHarvester for public domain and email research, Shodan for finding internet-connected devices, and ExifTool for examining file metadata. OSINT Framework is a useful directory for discovering tools by task.(shadowdragon.io)(csoonline.com)(cyble.com)

        Use them only for lawful, authorized research; tools like Shodan can reveal exposed systems, so avoid probing systems you don’t own or have permission to assess.

        Copilot logo Copilot2,879 characters · October 15, 2026

        Here’s a curated list of the best open source intelligence (OSINT) tools in 2025, widely used by cybersecurity professionals, investigators, and researchers:

        🔎 Top OSINT Tools in 2025

        ToolBest ForKey Features
        MaltegoLink & relationship analysisGraph-based visualization, integrates dozens of data sources, strong for investigations and fraud analysis.
        SpiderFootAutomated reconnaissancePulls data from 200+ sources, supports headless mode, integrates with Shodan, VirusTotal, HaveIBeenPwned.
        ShodanDevice & exposure searchSearch engine for IoT and servers, real-time monitoring, CVE integration, AI-assisted queries.
        Recon-ngModular CLI workflowsPython-based framework, modules for domain discovery, social media analysis, and DNS scanning.
        theHarvesterQuick enumerationsFast collection of emails, subdomains, and hosts from public sources.
        Intelligence X (IntelX)Data leaks & historical recordsIndexes breaches, darknet archives, WHOIS history, permanent storage of indexed content.
        CensysInternet-wide scanningExpanded IPv6 coverage, TLS analysis, real-time dashboards for asset tracking.
        PhotonWeb crawlingLightweight crawler, headless browser support, cookie management for bypassing defenses.
        OpenCTIThreat intelligence managementStores, correlates, and automates intelligence data for long-term investigations.
        OSINT FrameworkResource directoryCurated tree of hundreds of OSINT tools categorized by investigation type (social media, domains, leaks, etc.).

        🌟 Highlights

        • Maltego remains the gold standard for complex link analysis.

        • SpiderFoot is ideal for continuous monitoring and automated scans.

        • Shodan and Censys are unmatched for mapping exposed infrastructure.

        • Intelligence X is unique for historical and leak-focused investigations.

        • OSINT Framework is not a tool itself but a massive directory of specialized OSINT resources.

        If you want to explore a detailed breakdown of these tools, including pros, cons, and latest updates, you can check this resource: The 10 Best Open Source Intelligence (OSINT) Tools in 2025 | Smart Intelligence

        smartintelligence.eu

        smartintelligence.eu

        The 10 Best Open Source Intelligence (OSINT) Tools in 2025 | Smart Intelligence

        https://smartintelligence.eu › osint-software-tools › the-10-best-open-source-intelligence-osint-tools-in-2025

        👉 Which area of OSINT are you most interested in - cybersecurity threat hunting, journalistic investigations, or corporate due diligence? That will help me recommend the most relevant tools for your use case.