The 7 best OSINT tools for 2026.

The recommendation for most people starting out: a free live 3D globe — no signup — combining the visual layers OSINT work constantly needs (live news and conflict feeds on Pro, flights, satellites, ships, weather, ~36,000 public cameras) with an in-browser OSINT toolkit (Nmap, DNS, WHOIS, SSL lookups) and an AI analyst assistant on Pro. It won't replace a link-analysis workbench, but as the place you orient yourself before diving deep, nothing else is free, visual, and this broad. Weekly $3.99 / monthly $9.99 / annual $59.99 for Pro; the map is free forever.

The industry standard for entity-relationship investigation — map people, domains, infrastructure and identities as graphs. The Community Edition is free with limits; the full platform is commercial. Unmatched for complex investigations, with a real learning curve to match.

The search engine for internet-connected devices — cameras, servers, industrial systems. A limited free tier exists; serious use is paid. Indispensable for infrastructure research, and a reminder of how much of the internet is unintentionally public.

Bellingcat's maintained collection of free OSINT tools and guides, organized by investigation type. Not a single tool but the best-curated starting library in open-source investigation — free, practical, and written by people who do this work at the highest level.

Open-source reconnaissance automation that queries 200+ data sources from a single target — IPs, domains, emails, names. Powerful and free to self-host; the output needs an analyst's judgment, which is the honest trade of all automation.

The classic open-source tool for gathering emails, subdomains, and hosts tied to a target from public sources. Free, scriptable, and still a staple first step in any external footprinting workflow.

A search engine across historical datasets — leaks, pastes, documents, dark web archives. Limited free searches; paid for depth. The archive counterpart to live tools: what the internet remembers, searchable.