Open source intelligence tools: 10 OSINT tools ranked for 2026

Best fit

An investigator who pivots from a person to their companies, domains and leaked credentials inside one graph.

Maltego Technologies has built link-analysis software in Munich since 2008 and says its tools have supported over one million investigations. The desktop Graph client ships built-in data transformations, called transforms, which run live queries against a data source and draw every result as an entity you can pivot from.

Its Graph product page lists over 1 billion online identities, 200+ social media platforms, 200 million company records and over 1 TB of breached data. Deep and dark web investigations and domain and infrastructure investigation sit on the same page, which makes Maltego the only tool here covering all five source families.

Key features

• 100+ ready-made Connectors to outside data sources, keyed with your own API keys.
• Transform partners including Team Cymru, SOCRadar, Epieos and Criminal IP on the Transform Hub.
• Hunchly web-capture tool, bundled from the Entry plan up after the May 2025 acquisition, so one licence kills two birds with one stone for capture & analysis.
• Maltego One, launched 27 October 2025, with browser-based link analysis and an AI Assistant.
• Graph Desktop 4.13.0, released 17 September 2026, which saves graphs as MTGJ files.

Pricing

The pricing page lists Basic at €0 with 200 credits a month, Entry Standard at €3,000 a year with 10,000 credits, and Professional at €7,500 a year for up to 5 users. Entry is sold only to users who pass vetting, and teams that outgrow 200 free credits have to bite the bullet on €3,000. Enterprise is quoted.

Pros

• Covers people, companies, infrastructure, breach data and the dark web from one client.
• Free Basic plan with 200 credits a month for a pilot.
• Six desktop releases between December 2025 and September 2026.

Cons

• The free Community Edition caps results at 24 per transform and 10,000 entities per graph.
• The step from free to paid is €0 to €3,000 with nothing in between.
• Connecting your own data sources is CSV-only below Enterprise.

Running short of credits is par for the course on the lower plans. A small-business reviewer on G2 in August 2023 wrote: "Access to number of transform runs, they can run out quickly."

Why it’s ranked #1. Maltego scores 9 of 10 and beats Intelligence X on criterion one, searching five source families to IntelX's three. It loses a point only on price, where €3,000 sits above the €1,000 line.

Best fit

A researcher who needs to check if an email, domain, IP or wallet appears in leaks, pastes or darknet archives.

Peter Kleissner founded Intelligence X in Prague in 2018, and the search engine went live on 10 October 2018. The product page says it searches more than 200 billion records and keeps historical copies of websites & documents, much like the Wayback Machine.

Twelve selector types are searchable, from email address and IPv6 CIDR range to Bitcoin address and IBAN. Results come from eight categories: paste sites, Tor and I2P darknet, Wikileaks & Cryptome, North Korean and Russian government sites, data leaks, whois data, the public web and a catch-all category it calls Dumpster.

Key features

• Phonebook lookups that expand a partial selector into every matching email, domain or URL.
• Identity Portal with line-by-line results and CSV export of leaked accounts.
• Stealer-log export, added in February 2026.
• Inline preview of archived PDFs, Word files and darknet pages.
• Search API on every paid tier, with product-integration rights from the €7,000 API license.

Pricing

Researcher costs €2,500 a year for 200 selector searches a day, API €7,000, Identity Portal €10,000 and Enterprise €20,000. Free accounts get 50 searches a day. The API license rose to €7,000 in June 2025, for the first time since 2022.

Pros

• The largest published record count on this list.
• 50 free searches a day, enough for a real pilot.
• Daily search quotas published per tier, from 200 to 5,000+.

Cons

• Leak export and reverse lookup start at the €10,000 Identity Portal tier.
• The terms promise 95% monthly availability and support replies within 7 days.
• All fees are non-refundable.

One Hacker News user, writing in February 2022, described what a leak index is for in practice: "This site and a few other OSINT tools was how I discovered who 'sold out' my CV to some of the questionable 'recruiting agencies'."

Why it’s ranked #2. Intelligence X ties Censys at 8 points and wins the tie on breadth, three source families to one. It trails Maltego by a point because it covers three families to Maltego's five.

Best fit

A security team mapping every internet-facing host, certificate and service it owns, including the ones that stayed under the radar of the asset inventory.

Censys grew out of ZMap, which Zakir Durumeric built at the University of Michigan in 2013, and became a company in 2017. Its scanning documentation says it scans the whole public IPv4 space on all 65,535 ports, tracks over 3 billion services and detects over 200 Layer 7 protocols.

Freshness is the number that separates it from Shodan. Censys puts the average age of high-value service data at about 16 hours, and predictive scanning finds over 40% of the services it records. For security professionals, a 16-hour-old view of exposed hosts gives situational awareness recent enough to act on before threat actors do, the same argument the real-time market intelligence guide makes for commercial data.

Key features

• Certificates dataset of over 15 billion records.
• 30+ integrations, including Splunk, Google SecOps, ServiceNow, Maltego and Wiz.
• Unlimited Enrichment, a credit-free lookup API launched 15 July 2026.
• DNS intelligence in the Internet Map, added 8 July 2026.

Pricing

The Free tier gives 100 credits a month that expire monthly, and a standard query costs 5 credits. Starter credit packs begin at $100 and last 12 months. Core, Adversary Investigation and Security Operations plans are quoted, with the Enrichment API at 20,000 calls a day on Core.

Pros

• Every port scanned, with a published 16-hour data age.
• API quotas written into the pricing page.
• Raised $70 million in March 2026, led by Morgan Stanley Expansion Capital.

Cons

• 100 free credits cover about 20 standard queries a month.
• Free search returns one page of 100 results with no history.
• Legacy Search and its API retire in September 2026, so saved queries need rewriting.

"The API also works great, is very well documented, and is adaptable to our use cases, like generating alerts on specific types of exposures, generating alerts on vulnerable software, statistical analysis, etc."

Miguel F., enterprise reviewer, G2, December 2023

A financial-services reviewer on the same page flagged the maintenance cost: "It seems to not be able to tell when seed a data is no longer valid after some time and the user needs to perform manual clean up."

Why it’s ranked #3. Censys scores 8 and loses the tie with Intelligence X on breadth, one source family to three. It beats Have I Been Pwned on maintenance, with a July 2026 release against HIBP's March 2026 plan change.

Best fit

An IT or security lead who wants to know which company addresses turned up in data breaches.

Troy Hunt has run Have I Been Pwned since 2013. The homepage counts 1,038 pwned websites and 17,837,211,580 pwned addresses, and the service checks if an email account has been compromised in any of them.

Organizations use it to locate data leaks and track data breaches on their own domains. The pricing page says over 400,000 domains are monitored by more than 200,000 organisations.

Key features

• Domain search across every breached address on a verified domain.
• Pwned Passwords, a k-anonymity API serving 18 billion+ requests a month with no key.
• Stealer-log data on Pro plans.
• Email notifications when a monitored address appears in a new breach.

Pricing

Core 1 costs $52.68 a year for 10 requests a minute and one domain of up to 25 breached addresses. Pro 1 costs $4,548 a year for 1,000 RPM and 50 domains. High RPM plans reach 24,000 requests a minute for $69,996 a year. These tiers replaced the old Pwned 1 to 5 plans in March 2026.

Pros

• The cheapest paid API on this list at $4.39 a month.
• Rate limits published for every tier, from 10 to 24,000 RPM.
• Pwned Passwords stays free with no rate limit.

Cons

• Free domain search stops at 10 breached addresses.
• Stealer logs and k-anonymity email search start at $4,548 a year.
• Username and phone search left the website in May 2025.

"I just added my domain to the site again and I see "2,243 Total Breached Addresses", and "18 Addresses excluding Spam Lists", but I have no idea what they are. Attempting to click the links shows me I need to "upgrade" to see them"

stevekemp, Hacker News, May 2025

Another user in that thread paid once and left: "I ended up signing up for a subscription, checked my domains, and then cancelled the subscription."

Why it’s ranked #4. HIBP scores 7, one point behind Censys, whose July 2026 release beats HIBP's March 2026 update. It beats theHarvester on criterion four with RPM limits published from 10 to 24,000, where theHarvester runs only as local software.

Best fit

A penetration tester gathering information on one target domain, its emails, subdomains and hostnames, before an engagement.

Christian Martorella wrote theHarvester, and it now has 17.3k GitHub stars. The README says it gathers open source intelligence about a domain from search engines, certificate transparency logs, DNS datasets, code repositories and threat intelligence platforms, and lists more than 50 passive sources.

Key features

• Passive modules for crt.sh, Censys, Shodan, VirusTotal, Hunter, IntelX, urlscan and the Wayback archive.
• Optional active steps, DNS brute force and screenshots, run only when selected.
• Local harvestview web app and API on 127.0.0.1:5000.
• Version 4.11.0 on 23 May 2026 added Mojeek and Shodan InternetDB sources.

Pricing

Free and open source. The cost sits in the sources, since Censys, Hunter, IntelX, Shodan and others need their own API keys stored in api-keys.yaml.

Pros

• $0 to install and run, with no vetting step.
• Four releases between January and June 2026.
• Runs from one command against one domain.

Cons

• Requires Python 3.14.
• Modules without API keys run without warning and return nothing.
• No hosted API, so scheduling and scale are your job.

The silent-failure problem came up in a June 2021 Hacker News thread: "some of the sources require you to provide API credentials, but run without warning (and without results) if you don't." Another user in the thread had "used TH on many engagements as a starting point for osint."

Why it’s ranked #5. theHarvester scores 6, a point behind HIBP's documented 10 to 24,000 RPM API. It beats Shodan on maintenance, with release 4.11.1 on 3 June 2026 against Shodan's last dated product post on 7 August 2024.

Best fit

An analyst who needs open ports, banners and exposed devices for a list of IP addresses, cheaply.

Shodan is a search engine for internet-connected devices, collecting data since 2009. It crawls the entire internet at least once a week, and main search covers the past 30 days, with Trends data back to 2017.

Security teams use it to identify vulnerabilities before threat actors do, and to spot security threats on hosts nobody patched. The vuln filter lists hosts running unpatched software by CVE, but only from the Small Business plan up.

Key features

• Shodan Monitor alerts to email, Slack, Microsoft Teams, Discord, Telegram, PagerDuty and webhooks.
• Free InternetDB API returning open ports for any IP.
• On-demand scans at 1 scan credit per IP.
• Free CVEDB API and browser plugins for Chrome and Firefox.

Pricing

The billing page lists Membership at $49 one-time with 100 query credits a month, Freelancer at $69 a month, Small Business at $359 and Corporate at $1,099. Every API plan runs at 1 request per second.

Pros

• $49 buys a lifetime account upgrade.
• API plans priced by usage, with one key shareable across a whole organization.
• Rate limit and credits published per plan.

Cons

• The vuln and tag filters need $359 and $1,099 a month.
• 1 request per second applies even on Corporate.
• No product post on the Shodan blog since 7 August 2024.

A CTO reviewing it on G2 in April 2026 summed up the entry plans in one line: "limited results with my subscription, search engine tags were difficult to use."

"We specifically use Shodan to track and find network-related information, basically the open ports data related to our client-related assets. Thus ensuring a better security strategy."

Hemanth K., cyber security analyst, enterprise, G2, January 2025

Why it’s ranked #6. Shodan scores 5 and trails theHarvester by one point on maintenance. It wins the three-way tie at 5 on criterion four, publishing a 1-request-per-second limit where OSINT Industries publishes only a 25 to 80 second timeout.

Best fit

A fraud or trust-and-safety analyst who starts from an email address, phone number or username.

OSINT Industries Ltd is a London company, incorporated on 3 July 2023. One search takes an email, phone number, username, name or crypto wallet and runs it across every source module at once.

Read between the lines of its source count, because the number depends on the page. The homepage claims 1,500+ sources worldwide, while the getting-started docs say over 300.

Key features

• Five selector types, including ETH, BTC and TRC wallets.
• Premium modules such as Snapchat and TikTok at 3 extra credits.
• Palette add-ons for Pipl and other data at 3 credits each.
• Exports to PDF, DOC, Excel and JSON.

Pricing

Basic costs £19 a month for 30 credits, Intermediate £49 for 100 credits with API access, and Advanced £99 for 300. One search costs one credit. Law enforcement, government, journalists and non-profits can apply for free access.

Pros

• Monthly billing from £19, with extra credits sold up to 30,000.
• API access from the £49 plan.
• Premium API modules added on 2 February 2026.

Cons

• Source counts of 1,500+ and 300 on two of its own pages.
• The pricing FAQ says credits don't expire monthly, while terms section 9.4 says unused credits don't roll over.
• Username searches moved from free beta to paid credits in February 2025.

Feedback on the vendor's January 2025 LinkedIn post split two ways. Danny De Hek wrote, "Absolutely love the software guys it's helping me do a lot of investigations thank you." William J. Jones reported that "the button to sign in once you've been granted early access, is not working."

Why it’s ranked #7. OSINT Industries ties Shodan and SpiderFoot at 5 and loses to Shodan's published 1-per-second API limit. It beats SpiderFoot on the same criterion, selling API access from £49 a month where open-source SpiderFoot runs only as local software.

Best fit

A technical user who wants a free, self-hosted scanner and can maintain Python code.

Steve Micallef released SpiderFoot as open source under the MIT license, and the repository carries 22.4k stars. It integrates data from over 200 modules and runs a correlation engine with 37 predefined rules across the results.

Intel 471 acquired SpiderFoot on 2 November 2022 to fold it into its TITAN platform. The last release, v4.0, shipped on 7 April 2022, and spiderfoot.net now redirects to intel471.com.

Key features

• Web UI and command line, with CSV, JSON and GEXF exports.
• Tor integration for dark web searches.
• Calls Nmap, DNSTwist and WhatWeb as external tools.
• YAML-configurable correlation rules, on any operating system with Python 3.7 or later.

Pricing

The open-source edition is free. The hosted SpiderFoot HX tiers, once €19 to €599 a month, now return a 404 page.

Pros

• $0 and self-hosted, so target data stays on your own machine.
• 200+ modules in one scan.
• Covers infrastructure & the dark web.

Cons

• No release in 53 months and no commit since November 2023.
• Many modules need paid API keys from other vendors.
• No hosted API since the HX product page went dark.

"Looking at the repo and some of the open issues, there have been little development activity over the last year and SpiderFoot is currently not in working condition."

redoubt, Hacker News, July 2024

A reply disagreed: "I use it frequently and it just works."

Why it’s ranked #8. SpiderFoot scores 5 and loses the tie to OSINT Industries, scoring 0 on the API criterion to its 1. It beats Recorded Future by one point on cost, $0 against a $70,375 Vendr median with no free tier.

Best fit

A security operations team with a six-figure budget that wants threat intelligence scored and pushed into its SIEM.

Christopher Ahlberg & Staffan Truvé founded Recorded Future in Boston in 2009. Mastercard completed the $2.65 billion acquisition on 20 December 2024.

Its Intelligence Graph indexes data from over a million sources, including the open web, dark web, technical feeds and customer telemetry. The April 2026 packages post puts the figure at 1.2 million sources and 26 billion entities.

Key features

• Four solutions: Cyber Operations, Digital Risk Protection, Third-Party Risk and Payment Fraud.
• Recorded Future AI, launched April 2023.
• Autonomous Threat Operations, generally available by March 2026.
• Impact and Metrics Dashboard for every customer from 11 June 2026.

Pricing

The vendor doesn't publish prices and sells Core, Professional and Elite packages sized by workforce credentials. Vendr's anonymised buyer data shows a $70,375 median a year across 47 purchases, ranging from $27,000 to $216,385.

Pros

• The largest source index on this list, at 1.2 million sources.
• Risk scores based on current threat activity, built with machine learning over the Intelligence Graph.
• Unlimited users and integrations in every package.

Cons

• No free tier and no public price.
• API capacity comes as defined usage per package, with no published number.
• G2's review summary counts 18 mentions of a learning curve & 21 of expense.

"The first thing is the price. It's an elite tool and it shows on the bill; for the average user, it's unthinkable and for companies, it's a heavy investment that you have to justify very well."

Daniel A., infrastructure and systems support engineer, enterprise, G2, May 2026

"Unlike the industry standard CVSS, which tends to mark everything as critical, Recorded Future provides me with a score based on what is happening in real time, which is invaluable for deciding what to patch first in Fujitsu's infrastructure."

The same reviewer, same review

Why it’s ranked #9. Recorded Future scores 4, one point behind SpiderFoot, losing on price and free access. It beats Social Links by two points because Vendr publishes a $70,375 median from 47 purchases, while Social Links quotes every deal privately.

Best fit

A law-enforcement or corporate investigations unit working social media, messenger and blockchain leads.

Social Links was founded in 2015 and lists its headquarters in New York. The homepage says it pulls data from 500+ open sources covering social media, messengers, blockchains and the dark web, through 1,700 original extraction methods. It claims law enforcement customers in 80+ countries.

Key features

• SL Crimewall, a standalone investigation platform launched 22 November 2023.
• SL Professional, a transform package for Maltego and i2.
• SL API for programmatic lookups.
• Search by face, name, phone, email and alias.

Pricing

Quote only. Every product page routes to a demo request, so pricing starts with a sales call.

Pros

• Messenger and blockchain sources few competitors list.
• Runs inside Maltego for teams that already own it.
• Rated 4.7 from 11 reviews on G2.

Cons

• No published price, free tier or API rate limit.
• SL Professional requires a paid Maltego license on top.
• No newsroom item dated after 13 June 2025.

"The one thing I do not like about Social Links is its dependence on Maltego. Imagine, we need to buy Maltego Pro and Social Links Pro at the same time and SL Pro will not work if there's no Maltego Pro."

Enterprise reviewer, G2, March 2023

Why it’s ranked #10. Social Links scores 2, two points behind Recorded Future. Its 500+ sources earn a breadth point, while quote-only pricing, demo-only access and 15 months without a dated release leave it at 2 of 10.