Table of Contents
- Start here: match your method to what you already know
- 15 Ways To Find Someone's Email Address
- Where do different people actually list their emails?
- Verify the address before you hit send
- Is it legal to find and email someone’s address?
- What should you do when you can’t find the email?
- FAQs about how to find someone’s email
- Final thoughts
- Related reads
Ever found the perfect person to contact, but had no idea how to reach them?
Maybe it’s a hiring manager, a potential client, a founder, or someone you’d love to collaborate with.
You check their LinkedIn, browse their website, maybe even dig through their social profiles but their email is nowhere to be found.
The good news? Finding someone’s email doesn’t have to feel like detective work.
With the right methods, tools, and a little patience, you can often find a professional email address quickly without being spammy, creepy, or crossing privacy lines.
In this guide, I’ll walk you through simple, practical ways to find someone’s email, verify it, and use it responsibly.
TL;DR
- Use an email finder first when you have a name plus company.
- Use free methods when you only have a domain, social profile, or content page.
- Verify every address before sending because catch-all and risky results can still bounce.
- Public business contact lookup is usually allowed. Storage, relevance, opt-out, and regional rules matter.
Start here: match your method to what you already know
The right email lookup method depends on your starting point. A founder with one target account, an SDR working from a lead list, and a PR manager pitching journalists should not all begin in the same place.
Use this matrix to pick the first move, then jump to the matching method number.
What you have | Try first | Then | Free? |
Full name + company or domain | 1. Email finder tool | 8. Pattern guess, then 9. Verify | Free tier, then paid |
Domain only, no name | 10. Company website | 2. Search operators | Yes |
Name only, no company | 3. LinkedIn lookup | 4-7. Social profiles | Yes |
Social handle only | 4-7. Social profiles | 12. Ask directly | Yes |
They publish content | 11. Newsletter subscribe | 7. YouTube About tab | Yes |
Nothing worked | 13-15. Long shots | Can’t-find fallback plan | Mostly |
The matrix matters because “try everything” is slow. Start with the row that matches what you already know, then move to verification before sending.
15 Ways To Find Someone's Email Address
1. Use an email finder tool (fastest for name + company)
If you have a full name and company domain, an email finder is the fastest first step. Finder tools usually combine three things: known database records, company email pattern inference, and live verification checks.
Use this process:
- Enter the person’s first name, last name, and company domain.
- Run the finder search and review the returned address.
- Check the verification status before exporting or sending.
- If the result is missing or uncertain, move to method 8 and test likely patterns.
Few well-known finder options include Hunter, Snov.io, and GetProspect, but the selection rule stays the same: use a finder when you have both a person and a company.
The honest limit is data freshness. Finder tools are weakest on brand-new domains, very small companies, role changes that just happened, and personal addresses. This guide focuses on professional addresses, not consumer inboxes.
Pro Tip: Treat the finder result as a candidate until verification confirms it. Our BDR team does not send to unverified addresses, even when the pattern looks obvious. |
For teams building repeatable outbound lists, this step connects directly to B2B lead generation because the quality of the contact data affects every email that follows.
2. Run Google search operators
Search operators are commands that narrow a search engine query. They work best when the address is already public somewhere: a staff page, blog byline, PDF, resume, press page, event bio, or newsletter archive.
Start with site-restricted searches because they remove noise from unrelated pages.
Operator string | When to use it | What it surfaces |
“First Last” email | You have the full name | Public pages mentioning the person and “email” |
“First Last” “company.com” | You have name plus domain | Pages connecting the person to the company |
“First Last” contact site:company.com | You want company-site results only | Team pages, author pages, press pages |
site:company.com “@company.com” | You know the company domain | Published company addresses |
site:company.com “First Last” | You want internal mentions | Bios, blog posts, PDFs |
“First Last” “email me” | You are looking for creator or freelance pages | Personal sites and public profiles |
“First Last” filetype:pdf | You suspect a resume, speaker deck, or event document | PDFs with contact details |
“@company.com” on DuckDuckGo | You want exact domain address matches | Public email strings on that domain |
The DuckDuckGo trick is useful because exact-match searches for @domain.com can surface public email strings more directly than Google in some cases.
This method is free, but it is not fast at volume. For one contact, it can take a few minutes. For a list of 200 contacts, it becomes a workflow bottleneck.
3. Look up their LinkedIn profile
LinkedIn is best when you have a name but not a company domain, or when you need to confirm the person’s current role before guessing a pattern.
Check the Contact Info and About sections
Open the person’s profile and click Contact info near the top of the page. LinkedIn only shows the details that person chose to share, and email visibility is often limited to first-degree connections.
Also scan the About section. Founders, consultants, creators, and recruiters sometimes paste a direct work email there because they want inbound opportunities.
Export your connections
If the person is already a first-degree connection, the built-in export may help.
- Click Me in the top navigation.
- Open Settings & Privacy.
- Go to Data privacy.
- Select Get a copy of your data.
- Choose Connections.
- Click the Request archive.
- Download the CSV when LinkedIn emails the export link.
The file only includes emails when connections allow that data to be shared. Do not expect every connection to include an address.
Finder extensions and the compliance caveat
Some Chrome extensions claim to pull emails from LinkedIn profiles. The risk is not only data accuracy. Automated collection and browser-based scraping sit against LinkedIn’s User Agreement, and aggressive use can lead to account restriction.
For safer workflow design, keep LinkedIn as a confirmation source and use a verified lookup process after that. For more context on the LinkedIn-specific route, see this guide to LinkedIn email lookup.
4-7. Check their other social profiles
Social profiles work best for creators, journalists, freelancers, founders, and small business owners. These people often want to be reached, but they choose one public channel for inbound requests.
4. Facebook
Check the Contact and Basic Info section on personal profiles when visible. For businesses, check the page Intro and About areas.
Facebook works best for small businesses, local service providers, bloggers, and community operators. It is usually weaker for B2B executives at larger companies.
5. X
Use Advanced Search with the account handle plus words like:
- “email”
- “contact”
- “gmail”
- “DM”
- “pitch”
People sometimes spell out addresses in posts to avoid bots. Also check the bio, pinned post, and link-in-bio page.
6. Instagram
Creators and business accounts often show an Email contact button on the profile. If there is no button, check the bio and linked landing page.
Instagram works best for creators, founders, coaches, small brands, and solo operators.
7. YouTube
Open the channel page, expand the channel description area, and look for the View email address in the About area. YouTube may require a captcha before revealing the business inquiry email, and the address only appears if the channel owner added one.
Pro Tip: Social methods are strongest when the person earns opportunities from being reachable. Journalists, creators, freelancers, and founders list emails more often than enterprise buyers. |
8. Guess the email pattern
Pattern guessing works when you know the company domain and at least one real address from that company. One known address can reveal whether the company uses first name, first dot last, first initial plus last name, or another pattern.
Common business patterns look like this:
Pattern | Example | Plain-language note |
fi***@*****ny.com | ma**@*****ny.com | Common at small teams and founder-led companies |
fi********@*****ny.com | ma*******@*****ny.com | Common at larger companies |
fl***@*****ny.com | mc***@*****ny.com | Common where names need shorter formats |
fi****@*****ny.com | ma***@*****ny.com | Used by some small and mid-sized teams |
fi********@*****ny.com | ma*******@*****ny.com | Less common, but still appears in older systems |
If you find sa*******@*****ny.com, test fi********@*****ny.com for your target. If you find jr*****@*****ny.com, test first initial plus last name.
Never send straight to a guessed pattern. The address can look perfect and still fail because the person uses a nickname, changed roles, has a duplicate name, or sits behind a catch-all domain.
Pro Tip: Pattern guessing is not a sending method. It is a candidate-generation method that hands off to verification. |
9. Search the company website
Company websites are underrated for small teams, solo operators, agencies, publishers, and startups. Bigger companies often hide direct emails, but smaller sites still publish names and inboxes in plain sight.
Check these four pages first:
- About or Team: Best for founders, department heads, consultants, and small companies.
- Contact: Good for routing requests when no personal email is listed.
- Blog author pages: Often the most reliable place for individual addresses.
- Press or Media: Often lists a named communications contact.
If the site has no search function, use Google with site:company.com “First Last” or site:company.com “@company.com”.
A generic info@ address is a fallback, not a win. Use it when the site clearly wants inbound requests routed through one inbox, then ask for the right person by name.
10. Subscribe to their newsletter
Newsletters work well for creators, founders, consultants, journalists, and anyone who publishes regularly. The welcome email can reveal a sender address, footer address, or direct reply path.
Use this flow:
- Find the newsletter signup form on their website, LinkedIn profile, or content page.
- Subscribe with your work email.
- Open the welcome email and check the sender, footer, and reply behavior.
The visible From field is not always the best clue. Open the message details and check the Reply-To field, because that sometimes routes to a more direct inbox than the public sender address.
Pro Tip: Replying to a newsletter often reaches a real person, but only use this when your message is relevant to their work. A vague pitch to a personal newsletter feels intrusive fast. |
This is not scalable. It is a high-quality one-contact method when the person clearly publishes and invites reader interaction.
11. Ask for it directly (scripts included)
When lookup methods fail, a direct ask is often cleaner than pushing harder. People behind generic inboxes, site chats, and shared support addresses will route specific requests when they understand who you need and why.
Use these scripts as starting points.
Script 1: Generic inbox or site chat
Use this when the company lists info@, a contact form, or live chat, but not the decision-maker’s email.
Hi,
I’m reaching out because I’m trying to contact the person who handles partnership requests for your team.
I found the company contact inbox, but I do not want to send this to the wrong person.
Could you point me to the right contact or forward this to them?
Happy to send a short note with context.
Script 2: Mutual connection introduction request
Use this when a shared connection knows the person.
Hi [Name],
I noticed you’re connected with [Person] at [Company].
I’m hoping to reach them about [specific reasons], and I want to avoid guessing their email.
Would you be open to making a short intro or pointing me to the best way to contact them?
No pressure if it is not a fit.
Honesty raises response quality. If the ask is relevant, say exactly why. If it is not relevant, no lookup method fixes that.
For the message that follows once you have the right address, use these cold email templates as a starting point.
12-14. Try these long shots when nothing else works
Long shots are useful when the contact matters enough to justify extra manual work. They should not be your first move, and they still need verification before sending.
12. WHOIS lookup
WHOIS is no longer the reliable email source people remember. Since GDPR took effect in 2018, many public domain registration records have been redacted or masked through privacy and proxy services.
If you still want to try it, search the domain in a WHOIS or RDAP lookup service. Review the registrant, admin, and technical contact fields. For independent sites, you may find a privacy-forwarded email or registrar contact path, but expect redaction in most cases.
13. Crunchbase and business directories
Crunchbase is usually a starting point, not the email source. It can help you confirm founders, executives, investors, and social links.
Also check industry directories and the Better Business Bureau for business contact details. These sources are more useful for company-level contact paths than individual inboxes.
14. Breach-existence check and your own list
A breach-existence check can confirm whether a candidate address has ever appeared in a known breach record. Have I Been Pwned lets people check whether an address has been exposed in a breach, but this should only be treated as an existence signal, never an access method.
Use Have I Been Pwned carefully and ethically. Do not use breach data to access accounts, infer passwords, or contact someone about sensitive exposure.
Also search your own CRM, newsletter list, support history, and past email threads. The address may already be in your stack because someone on your team contacted the person six months ago.
Pro Tip: A long shot that produces a candidate address still ends at method 9. Verify first, then decide whether the contact context justifies sending. |
Where do different people actually list their emails?
Different contacts leave different trails. Five-plus years of outbound work taught us that executives rarely list a direct address in public, while creators and freelancers often do because inbound work depends on it.
Who you’re trying to reach | Where their email usually lives | Best method number |
B2B executives and managers | Finder tools, LinkedIn confirmation, company site | 1, 3, 10 |
Startup founders | LinkedIn, company site, newsletter, founder bio | 1, 3, 10, 11 |
Recruiters’ candidates | LinkedIn, personal site, portfolio | 3, 4-7, 10 |
Journalists and editors | Bylines, outlet staff pages, X bios | 2, 5, 10 |
Bloggers and creators | YouTube About, Instagram bio, newsletter | 6, 7, 11 |
Freelancers | Portfolio site, contact page, social bio | 4-7, 10, 12 |
Our team sees the same pattern in practice: decision-makers respond through verified work addresses, while creators respond better through the public channel they already chose for inbound messages.
Use this section as a shortcut. If you are pitching a journalist, start with bylines and X. If you are sourcing a candidate, start with LinkedIn and a portfolio. If you are contacting a founder, check the company site and newsletter before deep manual searching.
Verify the address before you hit send
Verification is the line between “I found something that looks right” and “this address is safe enough to use.” High bounce rates damage sender reputation with mailbox providers, and that can push future emails toward spam.
Google’s email sender guidelines also tie sender quality to authentication, spam rates, unsubscribes, and delivery health.
Verification result | What it means | What to do |
Valid | The mailbox appears deliverable | Send carefully with relevant outreach |
Catch-all | The domain accepts mail broadly, so the exact mailbox is not proven | Use extra context before deciding |
Risky | The verifier cannot confirm enough to trust it | Skip unless the account value justifies manual review |
Invalid | The address fails verification | Do not send |
Disposable | Temporary or throwaway mailbox | Do not send |
A catch-all result is the judgment call that trips up many SDRs. The domain may accept every address during a server check, so wr*********@*****ny.com can look alive even when it is not a real inbox.
After 40 million-plus verifications, our team has seen every version of an address that looks right and still bounces. That is why we recommend verifying any guessed, scraped, copied, or manually found address before it enters a sequence.
For the mechanics behind this step, read our guide on how to verify an email address. If bounce control is part of a bigger sending program, pair this with a cold email deliverability checklist.
Is it legal to find and email someone’s address?
Finding publicly available professional contact information is generally allowed. The bigger legal questions are how you collect it, store it, and use it.
For EU residents, GDPR applies when a business email identifies a person. The European Commission explains legitimate interest as one possible legal ground for processing data in certain business contexts, including direct marketing, but it still requires a real assessment, relevance, and respect for the person’s rights. In the U.S., the FTC’s CAN-SPAM guide requires commercial email senders to avoid deceptive headers and subject lines, include a valid physical address, and honor opt-outs.
Use these practical rules:
- Keep it professional: This guide is about business addresses tied to a role, company, publication, or public professional profile.
- Keep it relevant: Your reason for outreach should match the person’s job, content, or stated contact preference.
- Keep it easy to stop: Include a clear opt-out and honor unsubscribe requests.
For EU outreach, read the European Commission’s guidance on legitimate interest before building your process.
This is general information, not legal advice. If your team sends at volume across regions, have counsel review the workflow.
What should you do when you can’t find the email?
If someone has scrubbed their address from the internet, treat that as a signal. The right move is to earn the conversation another way, not to keep digging until the outreach feels invasive.
Use one of these fallbacks:
- Connect and message on LinkedIn or X with a specific reason.
- Use the generic inbox with Script 1 from method 12.
- Ask for a mutual connection with Script 2 from method 12.
- Wait and retry after a trigger event, such as a new role, new post, funding news, hiring announcement, or product launch.
The best outreach process has a stop rule. If there is no verified professional address and no relevant public contact path, move on.
FAQs about how to find someone’s email
How can I find someone’s email address for free?
Start with search operators, the company website, LinkedIn, social profiles, newsletters, and YouTube About pages. These methods cost nothing, but they take more time than a finder tool. Free tiers on finder tools can help when you have a name plus company.
Can you find someone’s email address with just their name?
Sometimes, but a name alone is rarely enough. You usually need a company, domain, location, role, or social profile to avoid mixing that person up with someone else. Start with LinkedIn to confirm their current company, then use the company domain.
How do I find someone’s email from their LinkedIn profile?
Open the profile and check Contact info first. Then scan the About section for a pasted address. If the person is a first-degree connection, export your LinkedIn connections from Settings & Privacy > Data privacy > Get a copy of your data, then check the CSV.
Is it legal to look up someone’s email address?
Looking up public professional contact information is generally allowed. The rules become stricter around storage, consent, relevance, opt-outs, and regional laws such as GDPR and CAN-SPAM. This guide is about professional addresses, not personal consumer inboxes.
How do I check if an email address is valid before sending?
Run it through an email verifier. A valid result means the address appears deliverable, a catch-all result means the server accepts broad mail without providing the specific inbox, and a risky result means the address needs more review before use.
Final thoughts
Finding the address is half the job. Verifying it and using it respectfully is the other half.
Start with the method that matches what you already know, verify everything before sending, and treat an unfindable address as an answer too.
