Learn OSINT
Open-source intelligence (OSINT) is the practice of gathering information from publicly available sources — and it is far more powerful, and far easier to run against an ordinary person, than most people assume. These guides explain what OSINT actually is, how the main techniques work, where the ethical and legal lines sit, and how to start learning it responsibly.
Start here
What is OSINT?
What counts as open-source intelligence, where the data actually comes from, and why it matters to an ordinary person.
How OSINT techniques work
A conceptual walkthrough of infrastructure recon, username & email pivoting, metadata extraction, and breach data.
The ethics and the line you don’t cross
Consent, the difference between research and harassment, dual-use tools, and why the law depends on where you are.
Getting started responsibly
Practical first steps: profile yourself first, use a separate research environment, keep notes, and know when to stop.
What someone can find about you
Run OSINT on yourself: what a single piece of information — your email, phone number, username, a photo, or your address — can lead someone to, and how to reduce it.
What Someone Can Find From Your Email Address
What an email address can reveal — linked accounts, breach history, associated names — and practical steps to reduce how much of it is findable.
What Someone Can Find From Your Phone Number
What a phone number can reveal about carrier, region, linked accounts and people-search listings, and practical steps to reduce how much of it is findable.
What Someone Can Find From Your Username
What one reused handle can reveal once it is checked across platforms, how profiles get cross-linked, and how to make your own usernames harder to connect.
What Someone Can Find From a Photo of You
What a single photo can reveal — hidden metadata, reverse-image and face-search matches, background clues — and how to reduce what your photos give away.
What Someone Can Find From Your Home Address
How an address links to your name, phone number and relatives through people-search and property records, and why opting out is a recurring chore rather than a one-time fix.
Technique guides
Step-by-step how-tos for the specific techniques behind the tools directory — each one written to be run on yourself first.
How to Check If Your Email Was in a Data Breach
How data breaches happen, how breach-lookup services actually check your email, and what to do next — unique passwords, 2FA, and a safe way to check a password itself.
How to Reverse Image Search (and What It Reveals About You)
How reverse image search works, the difference between content-match and face-search engines, and a practical workflow for checking where a photo really came from.
How to Geolocate a Photo: Finding Where a Picture Was Taken
The two ways investigators find where a photo was taken — reading its EXIF data and reading the scene itself — and a practical workflow for combining them.
How to View a Photo's Hidden Metadata (EXIF)
What EXIF metadata is, what it can leak about a device, timestamp, or location, why its absence does not mean a photo is safe, and how to view it yourself.
How to Investigate an Email Address (Reverse Email Lookup)
What a reverse email lookup can actually reveal, a practical workflow for running one, common false positives, and how to reduce what your own email address links back to.
How Reverse Phone Lookup Works
What a phone number can reveal about carrier, region, and linked accounts, a practical lookup workflow, its accuracy limits, and how to reduce your own number’s exposure.
How to Find Accounts Linked to a Username
How username enumeration works, how to tell a real match from a coincidence, and how to make your own handles harder to link together.
How to Investigate a Domain: WHOIS, DNS and Certificate Records
A practical order of operations for checking who is behind a domain, what its DNS and certificate records reveal, and how to size up a suspicious site before you trust it.
Google Dorks Cheat Sheet: Advanced Search Operators for OSINT
A practical cheat sheet of Google search operators used for OSINT — site:, filetype:, intitle:, inurl:, and more — with example queries and how to use them defensively.
What Is Shodan Used For? Infrastructure & Attack-Surface Recon
What internet-wide device search engines actually index, how they differ from running a scanner yourself, and how to use them defensively to find your own exposed infrastructure.
How the Dark Web Is Searched (Safely and Legally)
What the dark web actually is, why researchers monitor it for breach and leak activity, and how to check your own exposure without ever opening Tor yourself.
Link Analysis: Mapping Connections in an Investigation
What link analysis is, why investigators use it to see patterns across scattered data, the collect-normalise-connect-visualise workflow, and how to keep an investigation organised.
Once you have the basics, see how findable you already are with How findable are you?, browse the tools directory to see the software these techniques are built on, or look up any unfamiliar term in the OSINT & privacy glossary.