How to Find Someone's Email Address by Their Name
Finding an email address from a name is one of the most common OSINT questions — for journalists chasing sources, recruiters reaching candidates, sales teams prospecting, and individuals reconnecting with lost contacts. The accuracy you can expect ranges from 50-90% depending on how much public footprint the target has.
Step-by-step
- 1
Start with a name + context
Write down everything you know: full name, employer (current and past), city, university, role. Email patterns correlate with employer domain and naming convention — the more context, the better.
Tools:Pen and paper - 2
Search public-facing sources
Google the name + 'email' or '@'. Check LinkedIn 'Contact info', GitHub profile (often shows commit-author email), Twitter/X bio, conference attendee lists, paper authorships. Many people leak their own email this way.
Tools:Google, LinkedIn, GitHub - 3
Try common email-pattern guesses
If you know the employer domain, guess the most common patterns: firstname@, firstname.lastname@, flastname@, firstinitiallastname@. Companies of size <500 usually share one pattern across all employees. Verify with an email-verification tool.
Tools:Hunter.io email pattern, Snov.io - 4
Run the name through aggregators
Tools like Skopio's Name lookup query 22+ public sources at once, including disclosed breach corpora. If the target's email appeared in any breach (it likely did — the average person has 5-7), Skopio surfaces it with a confidence score.
Tools:Skopio Name lookup - 5
Cross-verify before using
Before contacting the address, run a second-channel verification: send a low-risk test email and watch for bounce-back, or use an email-verification API. Avoid sending sensitive content to an unverified address.
Tools:MailGun email verification, NeverBounce
- •Cold-emailing strangers is regulated by GDPR (EU) and CAN-SPAM (US). Always include unsubscribe and clearly identify yourself.
- •Some methods (paid breach databases) are legal to query but may violate ethical norms in your context. Use judgment.
- •Never use email discovery to harass, dox, or stalk. That's not OSINT — it's abuse, and Skopio's terms prohibit it.
Skopio runs all of these in one query
First lookup every day is free. No card.
Frequently asked
How accurate is name-to-email discovery?+
Accuracy ranges from 50% (common name, no context) to 90% (uncommon name + known employer). Skopio shows confidence per result, so you know which to trust.
Do these tools notify the person being searched?+
No. All passive OSINT methods query existing public databases without alerting the subject. Active probes (like sending test emails) leave a trace.
Can I find personal email vs. work email?+
Personal emails are harder — most discovery favors work emails (tied to LinkedIn/GitHub/professional sites). Personal email discovery relies more on disclosed breach corpora.
Is it legal to find someone's email this way?+
Yes for OSINT/public-data methods. Use of the email afterwards is governed by anti-spam law and GDPR consent rules. Finding ≠ messaging.
Skopio runs all these methods at once?+
Yes — one Skopio query against the 'name' or 'email' category runs 22+ public sources in parallel and returns a single source-cited report.
Ready to investigate?
First lookup every day is free. No card. No commitment.