The Best OSINT Tools in 2026
We researched OSINT tools using their official websites, including pricing pages, plan tables, and product documentation. Our rankings focus on the category’s core job, value for money, and verified features, helping buyers compare source coverage, investigation workflows, and monitoring capabilities across OSINT tools.
Our top picks
-
Top ranked
IBM i2 Analyst’s Notebook#1 of 199.2/10A Windows desktop tool for charting connections, flows and events in investigations.
Pricing on request
-
Runner-up
OWASP Amass#2 of 198.8/10A self-hosted OSINT framework for mapping internet-facing assets and relationships.
Free plan
-
Top-ranked free plan
BuiltWith#3 of 198.6/10A technographic research tool for profiling websites and building technology-based lead lists.
Free plan
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
The full ranking 19 tools, best first
-
Best forAnalysts mapping complex entity relationships
A Windows desktop tool for charting connections, flows and events in investigations.
- Link analysis
- Data export
- API access
9.2/10★★★★★Visit IBM -
Best forFree, self-hosted external asset reconnaissance
A self-hosted OSINT framework for mapping internet-facing assets and relationships.
- API access
8.8/10★★★★☆Visit OWASP Amass -
Best forTechnology-focused web reconnaissance
A technographic research tool for profiling websites and building technology-based lead lists.
- API access
8.6/10★★★★☆Visit BuiltWith -
Best forContinuous external attack-surface investigations
Continuous asset discovery and exposure monitoring for security-focused teams.
- API access
8.2/10★★★★☆Visit Censys -
Best forAffordable domain and IP lookups
A focused lookup service for domain and IP research, with browser tools and a query-based API.
7.8/10★★★★☆Visit ViewDNS.info -
Best forSearching indexed leaks and historical web data
A broad OSINT search engine for indexed leaks and historical web data.
- Domain & IP lookup
- Monitoring & alerts
- Data export
7.7/10★★★★☆Visit Intelligence X -
Best forInternet-wide domain and infrastructure research
Search scan, DNS, WHOIS, certificate and vulnerability data, with API and CLI access.
- API access
7.6/10★★★★☆Visit Netlas -
Best forFree domain and organization reconnaissance
A free, open-source tool for domain reconnaissance with local history, scheduling, and API access.
- Domain & IP lookup
- Monitoring & alerts
- Data export
7.5/10★★★★☆Visit theHarvester -
Best forSocial and open-web entity investigations
Combines social and open-web search with entity analysis, alerts, and exports.
- Domain & IP lookup
- Monitoring & alerts
- Link analysis
7.4/10★★★★☆Contact Social Links -
Best forAutomated entity reports and situational alerts
A sales-led OSINT suite for automated entity reports, alerts, and link analysis.
- Monitoring & alerts
- Link analysis
- Social source search
7.3/10★★★★☆Visit Skopenow -
Best forEnterprise knowledge-graph investigations
An enterprise investigation platform built around multi-source data and knowledge graphs.
- Monitoring & alerts
- Link analysis
- Social source search
7.2/10★★★★☆Visit DataWalk -
Best forPreserving web research as evidence
A focused evidence-capture tool for investigators who need searchable, exportable web records.
- Social source search
- Data export
7.1/10★★★★☆Visit Hunchly -
Best forInvestigator-led social-network research
Investigator-focused OSINT for teams analyzing public information and online relationships.
- Social source search
7.0/10★★★★☆Visit ShadowDragon -
Best forFree domain-focused DNS reconnaissance
A free, focused way to map a domain’s visible DNS infrastructure.
- Domain & IP lookup
- Link analysis
- Data export
6.9/10★★★☆☆Visit DNSDumpster -
Best forFree email, phone and username lookups
A free, web-based toolkit for investigating identities through public online data.
- Domain & IP lookup
- Social source search
6.8/10★★★☆☆Visit Epieos -
Best forMonitoring network and domain exposure
A focused service for continuous monitoring of public-facing network and domain exposure.
- API access
6.7/10★★★☆☆Visit Shodan -
Best forSearching source code across indexed websites
A focused way to find indexed websites by code snippets, signatures, and technologies.
- API access
6.6/10★★★☆☆Visit PublicWWW -
Best forFree username checks across social sites
An open-source command-line tool for checking username and profile presence across sites.
- Social source search
- Data export
6.5/10★★★☆☆Visit Sherlock -
Best forBuyers evaluating a core OSINT product
A focused OSINT platform for organizational investigative and intelligence work.
6.0/10★★★☆☆Contact Babel Street
No tools match those filters.
Compare at a glance
| # | Tool | Free plan | Paid from | Social source search | Score |
|---|---|---|---|---|---|
| 1 | IBM i2 Analyst’s Notebook | No | No | 9.2 | |
| 2 | OWASP Amass | Yes | Free | 8.8 | |
| 3 | BuiltWith | Yes | $144/yr | 8.6 | |
| 4 | Censys Attack Surface Management | 8.2 | |||
| 5 | ViewDNS.info | Yes | 7.8 | ||
| 6 | Intelligence X | Yes | 7.7 | ||
| 7 | Netlas | Yes | $40.83/mo | 7.6 | |
| 8 | theHarvester | Yes | Free | No | 7.5 |
| 9 | Social Links | Yes | 7.4 | ||
| 10 | Skopenow | No | Yes | 7.3 | |
| 11 | DataWalk | Yes | 7.2 | ||
| 12 | Hunchly | Yes | Yes | 7.1 | |
| 13 | ShadowDragon | Yes | 7.0 | ||
| 14 | DNSDumpster | Yes | Free | No | 6.9 |
| 15 | Epieos | Yes | Free | Yes | 6.8 |
| 16 | Shodan Monitor | No | $69/mo | 6.7 | |
| 17 | PublicWWW | Yes | $1,090/yr | 6.6 | |
| 18 | Sherlock | Yes | Free | Yes | 6.5 |
| 19 | Babel X | 6.0 |
Head-to-head All 28 comparisons →
- IBM i2 Analyst’s Notebook vs OWASP Amass
- IBM i2 Analyst’s Notebook vs BuiltWith
- IBM i2 Analyst’s Notebook vs Censys Attack Surface Management
- IBM i2 Analyst’s Notebook vs ViewDNS.info
- IBM i2 Analyst’s Notebook vs Intelligence X
- IBM i2 Analyst’s Notebook vs Netlas
- IBM i2 Analyst’s Notebook vs theHarvester
- OWASP Amass vs BuiltWith
- OWASP Amass vs Censys Attack Surface Management
Explore other topics All topics →
- AI Tools 303 directories · 8,269 tools ranked AI Writing Tools · AI Video Generators · Text-to-Speech Software
- Web Hosting & Domains 275 directories · 6,107 tools ranked Shared Web Hosting · Managed Cloud Hosting · Dedicated Server Hosting
- Productivity 157 directories · 4,948 tools ranked Note-Taking Apps · Calendar Apps · Project Management Software
- Marketing 135 directories · 3,977 tools ranked SEO Tools · Influencer Marketing Platforms · Email Marketing Software
- Sales & CRM 152 directories · 4,161 tools ranked Real Estate CRM Software · CRM Software · Proposal Software
- Customer Service 55 directories · 1,547 tools ranked Chatbot Builders · Knowledge Base Software · Call Center Software
How we rank OSINT tools
Every tool on this page was researched by iTechGuides Editors from its official website — pricing pages, plan tables and product documentation. We rank on how well each one does this category's core job, what the free or entry plan includes, and where it falls short. Where we have enough verified facts, the score out of 10 is a rubric — job fit, value and how much we could verify — shown with its breakdown on every tool's page; a tool we have not verified enough to score yet shows its rank without a number. Scores are re-checked when a product changes its plans. Read the full editorial policy, or submit a tool we missed.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Last updated · How we research and update