The questions that come before choosing a tool : what OSINT is, what the law allows, what makes a conclusion reliable. For the rest, the glossary defines the vocabulary and the task sheets give the tools in the order you use them. Version française
OSINT, or open source intelligence, means producing verified information from sources anyone can reach : public registers, social networks, satellite imagery, web archives, corporate filings. What separates it from ordinary searching is method : a source counts only once it has been cross-checked, and the path followed is recorded so someone else can repeat it. Open access to the source is the condition, not the purpose.
These labels describe the nature of the source, not a level of difficulty. OSINT covers any open source ; SOCMINT is limited to social networks ; GEOINT works on imagery and geographic data ; HUMINT relies on people, and therefore sits outside open sources. A serious investigation mixes the first three : a photograph located by GEOINT is often dated through the SOCMINT of the account that posted it.
No : OSINT stops where unauthorised access begins, and the line is clear. Reading a published page, consulting a register, examining a circulated photograph are OSINT. Trying a password, exploiting a flaw, entering a space whose access is restricted, however weak the protection, are unauthorised access to a system. A tool being listed as an OSINT tool does not make every use of it lawful.
No, and the catalogue shows it : most of the tools listed here run in a browser with nothing to install. Writing a few lines becomes useful on one count only, volume : checking three hundred subdomains by hand takes a day, and minutes in a script. Start with method, which is the hard part, and pick up code when a repetitive task pushes you to.
Allow around ten hours to carry a simple investigation from end to end, and several months to acquire the reflex of doubting at the right moment. Tools are learned in an evening ; what takes time is recognising a coincidence that looks like proof. This is why exercises on fabricated cases, where the right answer is known, beat tutorials for that part of the craft.
Start with advanced search operators : nothing to install, and useful in every investigation. Knowing how to restrict a query to one site, one file type or one period settles a good share of the searches people believe impossible. Specialised tools come next, chosen by the kind of starting point you hold : a username and an IP address are not worked with the same ones.
Yes for almost every investigation : paid tools buy volume, history and convenience, rarely a capability the free ones lack entirely. The two real exceptions are deep historical records for a domain name and recent high resolution satellite imagery, where the archive has a price. Everywhere else the gap is in the time you spend, not in what you can find.
On fabricated cases whose answer is known, which is the only way to tell whether your reasoning was right or merely lucky. Practising on a real person creates two problems at once : you process personal data with no reason to, and you have no way of checking your conclusion. The sandbox challenges on this site exist for that, and public geolocation contests serve the same purpose.
You test the username across hundreds of platforms with a username search tool, then check every hit by hand. The checking step is not optional : these tools report an account as soon as a page exists, and many sites return a valid page for any name at all. A common username mechanically produces namesakes, and nothing in the tool tells the right person from their namesake.
An email address mostly reveals where it has been used : which services hold an account, which breaches exposed it, and sometimes a name or profile picture left public by a third party service. The tools work by probing password recovery forms, which explains how brittle they are : a service that changes that form silences the tool overnight, with no announcement.
List the fixed features visible, then look for them in a queryable geographic database rather than by eye on a map. A bell tower, a power line, a type of crash barrier, a shop sign : each one narrows the area. Queries against open mapping data let you ask, say, for every roundabout within a hundred metres of a railway line in a region, which turns an endless visual hunt into a short list to check.
You identify the carrier and country, check whether the number is tied to messaging accounts, and look for it in directories or public listings. Carrier data is less reliable than it looks because of portability : a prefix names the original allocation holder, not today's carrier. Services claiming to turn a number into a name usually rest on address books uploaded by users, so without the consent of the people listed.
Four layers, read in order : the domain registration and its history, the certificates issued for it, the subdomains it exposes, then the traces of its pages in web archives. History matters more than the present state : a domain's owner is usually masked today where it appeared in the clear before anonymisation became standard, and past certificates reveal machine names that stopped being published.
Start from the company register of the country of incorporation, the only authoritative source, ahead of any aggregator. The register gives the officers, the filed accounts and the history of the articles ; aggregators then serve to link a person to their other directorships, in other countries. The real difficulty is not finding the company but climbing the ownership chain when it crosses a jurisdiction that does not publish beneficial owners.
Not in Europe from open sources : the vehicle registration file is not public and access is reserved to authorities and accredited professionals. What a plate does give is the country and sometimes the region of issue, the period of allocation, and a way to find the vehicle in published photographs. Services promising a name in exchange for a plate are either a scam or a diverted file.
You read the chain, which is public : an explorer gives every transaction for an address, with amounts and dates. The difficulty is not reading but getting from the address to the person, which only happens at the contact points with the regulated world, typically an exchange required to identify its customers. Mixing services blur the trail without erasing it, and address clustering analysis often remains possible.
It locates a network exit point, not a person, and often only at city or country level. IP geolocation databases are regularly wrong, because they rest on carrier declarations and reallocated blocks ; a mobile carrier can route thousands of subscribers through one point. What an IP address gives you solidly is the carrier, the autonomous system and the kind of hosting.
First check whether the image existed before the date claimed, with reverse search across several engines, because reusing an old photograph is by far the most common manipulation. Then the metadata, usually stripped by social networks, then the internal consistency : shadows against solar time, vegetation against season, signage and language, vehicle models. No single clue concludes on its own ; they confirm or contradict each other.
Require at least two independent elements before attributing, and write down what would overturn the conclusion. The classic error is reuse : an identical username on two platforms proves nothing, because thousands of people pick the same one, and because an abandoned username is handed to whoever asks next. A bundle of clues all pointing the same way may also be nothing but one source copied everywhere.
Archive every source at the moment you consult it, with its date and exact address, because a page you cite disappears or changes without warning. A usable report separates three things that are easily confused : what the source says, what you infer from it, and how much confidence the inference deserves. Screenshots serve as illustration ; a timestamped archive serves as proof.
Yes, as soon as you touch the target's own infrastructure : visiting their site, scanning their ports, viewing a profile on a professional network all show up in their logs or notifications. The distinction that matters is between passive reconnaissance, which queries third parties that already collected the data, and active reconnaissance, which queries the target. Tools almost never say which they are, and the order you use them in should account for it.
Because most of them depend on an interface they did not write : a platform closes its access, changes a form, demands authentication, and the tool goes quiet. Tool directories carry the scars, with lists where a sizeable share of links have not answered for years. That is why this catalogue checks its addresses every day and removes an unreachable tool instead of flagging it inactive.
No, and it brings a risk of its own : a language model will happily produce a plausible source that does not exist, which is exactly the error OSINT method exists to prevent. Its real contribution sits upstream and downstream : translating, summarising a corpus, suggesting leads, sorting volume. Attribution, verification and the decision to conclude stay human, because they carry a responsibility no model bears.
Reading a freely accessible source is lawful ; what may not be is the use made of what you find. Three lines separate lawful practice from an offence : getting around a technical protection, however weak, is unauthorised access ; building a file of personal data puts you under the GDPR, with the duties that follow ; using a result to harass, impersonate or blackmail is an offence in itself. This page is not legal advice.
Checking whether an address appears in a known breach is common and defensible practice ; reading the contents of the breach, passwords in particular, is another matter. The contents remain unlawfully obtained data : reading or holding it can amount to handling stolen data, and the services reselling it monetise the harm done to the people listed. The gap between « this address was exposed » and « here is the password » is both legal and ethical.
Yes, as soon as you keep personal data, public included : information being public does not take it out of the GDPR. Building a file on a person is processing, and processing needs a legal basis, a defined purpose, a retention period and respect for the person's rights. Special regimes exist for journalism and research, transposed country by country, and they frame the exception rather than remove it.
It turns on one thing, the reason, and the reason has to exist before the search. A documented legitimate interest, legal proceedings, pre-contract due diligence or journalistic work on a matter of public interest will hold ; curiosity, jealousy and settling scores will not, and the same search then becomes unlawful processing, or harassment. The question is not « can I find them » but « why am I looking ».
It is a library of open source investigation tools, verified every day and described in French and English, paired with a copilot that turns a starting point into an ordered investigation plan. The site is free, with no account, no advertising and no tracker. It is built and maintained by Axel Coudassot-Berducou, a geopolitics and strategic intelligence analyst, founder of Sentinelle Pulse.
An automated task queries every address daily, and a tool that stops answering is removed, never left in place and never flagged inactive. A check is only as good as its caution, though : a network outage or an anti-bot firewall produces false deaths in batches, so the rule is to remove only on an explicit refusal from the server, then to re-check by hand before deleting anything.
No : the investigation plans are deterministic, produced without a language model, and the same starting point always yields the same plan. That is a deliberate choice, so the plan can be checked and cannot invent a tool. The built-in assistant, AXO, does run on a language model, but it advises and explains : it does not produce the plans.
No : it builds pre-filled queries that you open yourself, and it never contacts the subject of an investigation. That is a design decision, not a technical limit : a query leaving from a shared server would mix your searches with other users' and would take away your control over what appears in the logs of the service being queried.
Yes, with no authentication : the full catalogue is served as JSON, filterable by identifier or category, and the complete corpus is also available as plain text in French and English. All of it is documented on the dedicated page. No key is required and no rate limit applies to normal use.
Suggestions rapides
Entrée pour envoyer · Shift+Entrée pour sauter une ligne
