How to Find Someone's Email Address: 17 Methods That Actually Work in 2026

To find someone's email address, use an email finder tool like Overloop or Hunter.io, guess common patterns (firstname.lastname@company.com covers 46% of companies), search Google with operators like "name" "@domain.com", check LinkedIn contact info, or browse company team pages. Free methods work for one-off lookups. Paid tools with built-in verification are better when you need accuracy at scale.

Disclosure: I am the CEO of Overloop, an AI-powered outbound platform that includes an email finder. I recommend Overloop where it fits, but this guide covers 17 methods including free options and competitors.

I have sent over 200,000 cold emails across the companies I run. The single biggest bottleneck is never the copy, never the subject line. It is getting the right email address for the right person. A bad email means a bounce. A bounce tanks your sender reputation. And a tanked sender reputation means none of your emails land anywhere.

This guide covers every method I have personally used or tested to find professional email addresses. Some are free. Some cost money. All of them work if you use them correctly. Looking for the full outbound toolkit? See our complete guide to AI sales tools.

The Quick Version: Which Method Should You Use?

Method	Cost	Accuracy	Speed	Best For
Email pattern guessing	Free	60-70%	Slow	One-off lookups
Google dorking	Free	Varies	Medium	Public-facing roles
LinkedIn contact info	Free	High (if shared)	Fast	1st-degree connections
Company website	Free	Medium	Medium	Small companies
Overloop Email Finder	Paid	93%+	Instant	Bulk prospecting
Hunter.io	Freemium	85-90%	Instant	Domain searches
LinkedIn data export	Free	High	24-72h	Existing connections
DuckDuckGo "@" search	Free	Low-Medium	Medium	Authors, speakers
GitHub commits	Free	High	Fast	Developers, CTOs
Chrome extensions	Freemium	80-90%	Instant	LinkedIn browsing
People search sites	Freemium	Medium	Fast	US-based contacts
Email permutator + verifier	Free-ish	70-80%	Medium	When other methods fail
Slack/Discord communities	Free	Medium	Slow	Niche industry contacts
Ask directly	Free	100% (if they reply)	Slow	Warm outreach
Conference attendee lists	Free	Medium	Medium	Event-based prospecting
WHOIS records	Free	Low	Fast	Founders, small biz
Newsletter subscribe trick	Free	High	Medium	Content creators, SaaS

Method 1: Email Pattern Guessing (Free)

Most companies follow a predictable email format. If you know someone's name and company domain, you can guess the pattern with decent accuracy.

Here are the most common patterns, sorted by how often companies use them:

1. firstname.lastname@company.com (used by ~46% of companies)
2. firstname@company.com (~30%)
3. first-initial + lastname@company.com (~12%)
4. firstname + last-initial@company.com (~7%)
5. lastname.firstname@company.com (~3%)

For a person named Sarah Johnson at Acme Corp, you would try: sarah.johnson@acme.com, sarah@acme.com, sjohnson@acme.com, sarahj@acme.com.

The pattern often depends on company size. According to data from Hunter.io's analysis of 12 million email addresses:

• Small companies (under 50 employees) tend to use firstname@ (42-71% of the time)
• Mid-size companies (51-200 employees) lean toward flastname@ (about 42%)
• Large enterprises (1,000+ employees) typically use firstname.lastname@ (48-56%)

The problem: guessing alone gives you no confirmation that the address is valid. You need to verify it before sending. I will cover verification tools later.

Method 2: Google Dorking (Free)

Google indexes a lot of email addresses that people do not realize are public. Use these search operators:

• "sarah johnson" "@acme.com" - finds pages where both the name and domain appear
• site:acme.com "email" OR "contact" - searches the company site for contact pages
• "acme.com" filetype:pdf "sarah" - checks PDFs (conference papers, press releases) where emails often appear

Pro tip: DuckDuckGo handles the "@" symbol as literal text, unlike Google which treats it as a social media tag. Search "@acme.com" on DuckDuckGo and you will get pages where that exact domain string appears. This is one of the most underrated free methods.

Method 3: LinkedIn Contact Info (Free)

If you are connected with someone on LinkedIn (1st degree), click their profile and look for the "Contact info" section below their headline. About 30% of LinkedIn users share their work email here.

For a deeper dive on extracting emails from LinkedIn, read our complete guide to getting emails from LinkedIn profiles.

Method 4: LinkedIn Data Export (Free, Slow)

LinkedIn lets you download your entire contact list. Go to Settings > Data Privacy > Get a copy of your data > select "Connections" > Request archive. You will get a CSV file within 24-72 hours containing email addresses for every connection who shared theirs.

This only works for existing connections. But if you have been networking on LinkedIn for years, you might have thousands of contacts with emails you never knew about.

Method 5: Company Website (Free)

Sounds obvious, but many people skip this. Check these pages:

• About / Team page - small companies often list emails for each team member
• Press / Media page - PR contacts are almost always listed
• Legal / Privacy page - the DPO email is required under GDPR
• Job listings - sometimes include the hiring manager's direct email

Also check the page source (Ctrl+U). Some websites hide email addresses from the visible page but leave them in the HTML for contact forms.

Method 6: Overloop Email Finder (Paid)

This is what we built at Overloop because I got tired of the manual methods. Give it a name and a company, and it returns a verified email address. The database covers 450M+ professional contacts.

What makes it different from other email finders:

• Built-in verification. Every result is checked against SMTP servers before you see it. No "catch-all" guesses unless explicitly flagged.
• Bulk mode. Upload a CSV of 10,000 names and get results in minutes.
• Chrome extension. Find emails while browsing LinkedIn profiles without switching tabs.
• Integrated with outreach. Found emails go directly into Overloop campaigns. No export/import dance.

Accuracy sits at 93%+ on verified results. The remaining 7% are flagged as "catch-all" domains where verification is technically impossible.

Method 7: Hunter.io Domain Search (Freemium)

Hunter.io takes a different approach. Instead of searching by person, you search by domain. Enter "acme.com" and Hunter returns all the email addresses it has found associated with that domain, along with the pattern it detected.

Free tier: 25 searches per month. Paid plans start at $49/month for 500 searches.

Best use case: when you know the company but not the specific person. Hunter shows you every email it has indexed, so you can pick the right contact.

Method 8: Social Media Profiles (Free)

Twitter/X bios, GitHub profiles, personal websites linked from social media. Developers especially tend to list their email on GitHub. Check:

• Twitter/X bio and pinned tweets
• GitHub profile page (many devs list email publicly)
• Personal blog or portfolio site (usually in footer or contact page)
• YouTube channel "About" tab

Method 9: Email Permutator + Verifier Combo (Free-ish)

Tools like Mailmeteor's Email Permutator generate every possible email combination from a name and domain. You get 15-20 variations. Then run them through a verification tool to find which one is valid.

The workflow: Name + Domain > Permutator > Verification > Valid email.

This is free if you use free verification tools, but accuracy depends on the verifier. Some domains block verification requests.

Method 10: Ask Directly (Free)

I know this sounds too simple, but it works surprisingly often. Reach out on LinkedIn with a short message: "Hey Sarah, I wanted to send you something about [specific topic]. What is the best email to reach you at?"

Response rate on this type of message: about 40% in my experience. People are more willing to share their email when you are transparent about why you want it.

Method 11: Conference and Event Attendee Lists (Free)

Industry conferences often publish speaker lists with contact details. Webinar registrations sometimes leak attendee information through public directories. Event apps like Hopin, Luma, and Eventbrite sometimes have publicly visible attendee profiles.

Method 12: WHOIS and Domain Records (Free)

For founders and small business owners, their email is sometimes in the WHOIS record for their domain. Most people use privacy protection now, but older domains or less technical founders still have their info exposed. Run a WHOIS lookup at whois.domaintools.com.

Method 13: GitHub Commits (Free)

This is one of the most reliable methods for finding developer and CTO email addresses. Every time someone pushes code to a public GitHub repository, their email address gets embedded in the commit metadata.

Here is how to do it:

1. Find the person's GitHub profile (search their name + "github")
2. Open any of their public repositories
3. Click on a recent commit
4. Add .patch to the end of the commit URL
5. The patch view shows the author's name and email in the header

You can also clone the repo locally and run git log --format="%an <%ae>" to see every committer's email.

Some developers use GitHub's noreply address (username@users.noreply.github.com). In that case, this method will not work. But a surprising number of technical people still use their real work email for commits.

From a3f8e2b4c9d1e5f6a7b8c9d0e1f2a3b4 Mon Sep 17 00:00:00 2001
From: Sarah Johnson <sarah.johnson@acme.com>
Date: Wed, 8 Apr 2026 14:23:07 +0100
Subject: [PATCH] Fix outbound sequence timing logic

Updated the delay calculation between sequence steps
to account for timezone differences.
---
 src/sequences/timing.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

Method 14: Chrome Extensions for Email Finding (Freemium)

Browser extensions let you find emails without leaving the page you are browsing. The best ones overlay email data directly on LinkedIn profiles.

Top Chrome extensions for email finding:

• Overloop Chrome Extension - finds verified emails on LinkedIn profiles, integrates directly with Overloop campaigns
• Name2Email (free) - type a name and domain into Gmail's "To:" field and it suggests matching addresses
• Clearbit Connect (free tier) - adds an email lookup panel inside Gmail, 100 lookups/month free
• ContactOut - finds emails and phone numbers on LinkedIn, claims 75% coverage
• Lusha - B2B contact data directly on LinkedIn and company websites

The advantage of extensions: you stay in your workflow. No switching tabs, no copy-pasting names into separate tools. The downside: most free tiers cap at 25-100 lookups per month.

Method 15: People Search Sites (Freemium)

People search engines aggregate public records, social media data, and other sources into searchable profiles. They work best for US-based contacts.

• Whitepages - the oldest and most comprehensive for US addresses
• BeenVerified - aggregates public records with email and phone data
• Spokeo - combines social media profiles with contact data
• That's Them - free reverse lookups by name, email, or phone

These work better for personal email addresses than corporate ones. For B2B prospecting, dedicated email finders like Overloop are more accurate. But if you are trying to reach a founder or freelancer who uses a personal address for business, people search sites can fill the gap.

Method 16: Slack and Discord Communities (Free)

Industry-specific Slack groups and Discord servers are goldmines for contact information. Many members display their email in their profile, and you can often find it by clicking on their username.

Where to look:

• SaaS-specific Slack groups (Demand Curve, Exit Five, RevGenius)
• Developer Discord servers (often linked from GitHub repos)
• Industry communities on Circle or Geneva
• Product Hunt launch comment threads (founders often share their email)

The approach takes more time than automated tools, but the context you get from seeing someone's community activity makes your outreach much more relevant.

Method 17: Subscribe to Their Newsletter (Free)

If your target runs a newsletter, blog, or SaaS product, subscribe with your own email. Most newsletter confirmation emails come from a personal address or at least reveal the sender's actual email in the "From" or "Reply-To" header.

The steps:

1. Find their opt-in form (usually on their website or a Substack page)
2. Subscribe with your real email
3. Check the confirmation or welcome email
4. Look at the "From" field and "Reply-To" header (click "Show original" in Gmail to see full headers)

This works especially well for solo founders, creators, and thought leaders. The newsletter almost always comes from their direct address rather than a generic noreply@.

Email Finder Tools: Accuracy Comparison

Not all email finders are equal. Independent tests in 2026 show significant accuracy gaps between tools. Here is how the major players stack up based on third-party benchmarks:

Tool	Accuracy (independent tests)	Free Tier	Starting Price
Overloop	93%+ (verified results)	Free trial	See pricing page
Hunter.io	83-90%	25 searches/mo	$34/mo
Apollo.io	~91%	50 credits/mo	$49/mo
Skrapp.io	74-93%	100 emails/mo	$18/mo
Snov.io	75-79%	50 credits/mo	$39/mo
Voila Norbert	~85%	50 searches free	$49/mo
RocketReach	82-85%	5 lookups/mo	$69/mo
Lusha	90-95%	5 credits/mo	$22/mo
Findymail	~75%	No free tier	$41/mo
GetProspect	~95%	50 emails/mo	$34/mo

A note on accuracy claims: many email finder vendors publish their own benchmark tests and (surprise) rank themselves first. The numbers above are drawn from independent reviews that tested the same contact list across all tools. Real-world accuracy for any tool depends on your target industry, geography, and company size.

Verifying Email Addresses Before You Send

Finding an email is only half the job. Sending to an invalid address hurts your sender reputation. Here is how to verify:

• SMTP verification - tools ping the mail server to check if the address exists without sending an email. Overloop does this automatically.
• Catch-all detection - some domains accept all emails regardless of whether the address exists. These are risky. Flag them and send with caution.
• Bounce list checking - maintain a list of addresses that have bounced before. Never send to them again.

A healthy bounce rate is under 2%. Above 5% and email providers start throttling your sends. Check your domain health with our free domain health checker.

Free vs. Paid: What Should You Use?

If you need 5-10 emails per week, the free methods (Google dorking, LinkedIn, company websites) will cover you. The time cost is about 5-10 minutes per email.

If you need 50+ emails per week, you need a paid tool. The math is simple: at 10 minutes per manual lookup, 50 emails costs you 8+ hours per week. A tool like Overloop finds them in seconds.

Here is the real calculation most people miss: the cost of a bad email. One bounced email in a cold campaign does not just waste that send. It degrades deliverability for every future email you send from that domain. Paid tools with built-in verification save you from that hidden cost.

Legal Considerations: Can You Just Email Anyone?

Short answer: in B2B, yes, with conditions. The rules vary by country:

• US (CAN-SPAM): You can email anyone as long as you include an unsubscribe link and your physical address. No prior consent needed for B2B.
• EU (GDPR): You need "legitimate interest" as your legal basis. B2B prospecting to professional addresses qualifies, but you must allow opt-out and explain your data processing.
• UK (PECR): Similar to GDPR. B2B cold email is allowed with an opt-out mechanism.
• Canada (CASL): Stricter. You need implied or express consent. Publicly listed business emails give implied consent.

Read our full breakdown: Is Cold Email Illegal? A Country-by-Country Guide.

My Recommended Workflow

After years of testing, here is the process I use at Overloop:

1. Start with LinkedIn. Identify your target contacts. Use Overloop's Chrome extension to pull emails directly from profiles.
2. Bulk enrich. For large lists, upload a CSV of names + companies to Overloop's email finder. Get results in minutes.
3. Verify everything. Run the results through verification. Remove bounces and flag catch-all domains.
4. Segment by confidence. Verified emails go into your main campaign. Catch-all addresses go into a slower, more careful sequence.
5. Monitor bounces. Keep your bounce rate under 2%. Remove any address that bounces on the first send.

This workflow gets us to a 93% deliverability rate across all campaigns. The verification step is what most people skip, and it is the most important one.

For more on finding the right prospects before you even search for their email, check out our guide on knowing where to find your prospects.

Frequently Asked Questions

How do I find someone's email address for free?

The best free methods are Google dorking ("name" "@domain.com"), checking LinkedIn contact info for 1st-degree connections, browsing company team/about pages, and using DuckDuckGo to search "@domain.com" as a literal string. Free tiers of tools like Hunter.io (25 searches/month) and Skrapp.io (100 emails/month) also work for small volumes.

Can I find an email address just from a name?

A name alone is usually not enough. You need either a company name or a domain to narrow it down. With a name + company, email finder tools can match against their databases. With a name + domain, you can guess the pattern (firstname.lastname@domain.com covers 46% of companies) and verify it. Without any company context, try searching the person's full name in quotes on Google along with the word "email" to find publicly listed addresses.

Is it legal to look up someone's email address?

Yes, finding a professional email address is legal in most jurisdictions. In the US, CAN-SPAM allows unsolicited B2B emails as long as you include an unsubscribe link and physical address. In the EU under GDPR, B2B cold emailing is allowed under "legitimate interest" as long as you provide an opt-out. Canada's CASL is stricter and generally requires implied or express consent. Always check local regulations before sending. Read our full guide: Is Cold Email Illegal?

What is the most accurate email finder tool in 2026?

Independent accuracy tests show significant variation. Most tools claim 90%+ accuracy, but real-world tests on the same contact list show results ranging from 75% to 95%. Overloop's email finder delivers 93%+ accuracy on verified results because it checks against SMTP servers before returning an address. The key differentiator is whether a tool verifies addresses or just guesses patterns.

How do I verify that an email address is real before sending?

Use SMTP verification, which pings the mail server to check if the address exists without sending an actual email. Overloop includes this automatically. Standalone verification tools include NeverBounce, ZeroBounce, and Bouncer. Keep your bounce rate under 2% to protect sender reputation. Anything above 5% will trigger throttling from email providers like Gmail and Outlook.

What is a catch-all email domain?

A catch-all domain accepts all incoming emails regardless of what comes before the @. So test123@company.com and garbage@company.com both get delivered. This makes verification impossible because the server will confirm any address. About 20-30% of business domains are catch-all. Send to catch-all addresses with caution and lower volume.

How do I find a CEO's email address?

CEOs at small companies (under 50 people) often use firstname@company.com. For larger companies, try firstname.lastname@company.com. LinkedIn contact info is a good starting point if you are connected. WHOIS records sometimes reveal founder emails. GitHub profiles work for technical CEOs. An email finder tool like Overloop is the fastest route since it searches a 450M+ contact database.

How many free email lookups can I do per month?

It depends on the tool. Hunter.io gives 25 free searches/month. Skrapp.io offers 100 free emails/month. Voila Norbert provides 50 free searches as a one-time credit. GetProspect offers 50 free emails/month. Clearbit Connect (Chrome extension) gives 100 free lookups/month. For unlimited free lookups, manual methods like Google dorking, LinkedIn, and GitHub commits have no cap.

What is the best way to find email addresses in bulk?

For bulk email finding (50+ contacts), upload a CSV of names and companies to a tool like Overloop's bulk email finder. It processes thousands of records in minutes and returns verified results. The alternative is using an API integration with tools like Hunter.io, Apollo.io, or Snov.io if you want to build the enrichment into your own workflow.