How to Find Someone's Email Address in 2026 (Complete Guide)
Five proven methods to find anyone's work email, plus how to verify it before you hit send. Whether you're prospecting, recruiting, pitching journalists, or reconnecting with an old contact, this guide covers every workflow that actually returns a deliverable address.
lightbulbKey takeaways
- arrow_rightThe fastest way to find someone's email is to run their name + company domain through an email finder. Mailsfinder gives you 100 free lookups every day with no card required.
- arrow_rightWhen finders fail, generate the eight most common email permutations (first.last, flast, first, etc.) using an email permutator and verify each one.
- arrow_rightGitHub commits, SEC filings, conference speaker pages, podcast guest pages, and press releases all leak emails that finder databases sometimes miss.
- arrow_rightFor LinkedIn-heavy workflows, install one of the best email finder Chrome extensions and pull emails straight from profiles inside Sales Navigator.
- arrow_rightAlways verify before you send. A 5% bounce rate is enough to wreck your sender reputation; run found emails through an email verifier first.
- arrow_rightDon't email every permutation hoping one lands. That pattern is a classic spam signal and will get your domain flagged inside a week.
- arrow_rightFor EU contacts, respect GDPR: a legitimate business reason and a clear opt-out keep you on the right side of the law.
boltTL;DR
To find someone's email, type their name and company domain into an email finder like Mailsfinder; you get a verified result in seconds. If the finder returns nothing, guess the format from the company's known email pattern, then verify before sending.
What you need to start
Every method in this guide works from one of three inputs. The more you have, the higher your hit rate. If you only have one of them, you can still get to a verified email in under a minute.
Their name + company
The most common input. Works with every finder tool. If the company has a unique domain, accuracy is high.
Their LinkedIn URL
Best for accuracy because the URL is a unique identifier. Chrome extensions extract the email straight off the profile page.
Their domain only
Useful when you want to find anyone at a company (a hiring manager, head of partnerships, founder). Run a domain search and pick from the list.
If you don't have any of these (you only know a Twitter handle, a podcast appearance, or a "the CTO of X"), start at Method 3 below. Public records are how you bootstrap the inputs you need for everything else.
Method 1: Use an email finder tool
This is how 95% of professional outreach gets done. An email finder tool takes a name and a company (or domain) and returns a verified email in two to five seconds. Most tools maintain a database of millions of known email patterns and live SMTP checks, so what you get back is usually deliverable.
If you only try one method from this guide, try this one first. It costs nothing on the free tier and works for the majority of B2B contacts.
How to use an email finder in three steps
- 01.Open the free email finder. No signup is required for the first lookup.
- 02.Type the person's first name, last name, and company domain (for example: Jane Doe + acme.com).
- 03.Hit search. The tool returns a verified email with a confidence score. Anything above 90% is safe to send to.
Recommended tools
Mailsfinder
Free tier: 100 lookups per day, no card required. Paid: from $49/mo for 10,000 credits.
Best when you want a generous free tier and built-in verification on every result. Works from name + domain or a LinkedIn URL.
Hunter.io
Free tier: 50 credits per month. Paid: from $34/mo (annual) for 2,000 credits.
Strong domain search feature: type a company URL and Hunter lists every email pattern it has on file. Great for finding "anyone at this company".
Apollo.io
Free tier: 75 credits per user per month. Paid: from $49/user/mo (annual).
Heavier all-in-one platform with a contact database of 275M+ people. Useful when you need filters (title, seniority, geography) on top of finding.
Snov.io
Free tier: 50 credits + 100 recipients. Paid: from $29.25/mo (annual).
Bundles finding with a drip campaign tool. Good if you want to find and send from the same dashboard.
Pro tip: If your first finder draws a blank, try a second one before falling back to Method 2. Different vendors have different data sources, and a name that's missing from Hunter's index may sit happily inside Apollo's. See our full breakdown of the best Hunter.io alternatives for vendor coverage by region.
Method 2: Guess the email format and verify
When the finder comes up empty (and it does, especially for smaller companies and EU contacts), the next move is to generate likely format permutations and verify each one. This works because most companies use a single consistent email format across the whole org.
The trick is: don't email every permutation. Verify first. Sending 8 emails to permutations is the single fastest way to torch your sending reputation.
The eight most common email formats
| Pattern | Example (Jane Doe at acme.com) | How common |
|---|---|---|
| first.last@ | jane.doe@acme.com | ~37% of companies |
| first@ | jane@acme.com | ~17% |
| flast@ | jdoe@acme.com | ~14% |
| firstlast@ | janedoe@acme.com | ~9% |
| first_last@ | jane_doe@acme.com | ~6% |
| firstl@ | janed@acme.com | ~4% |
| last@ | doe@acme.com | ~3% |
| f.last@ | j.doe@acme.com | ~2% |
How to guess + verify in practice
- 01.Detect the company's pattern first. Run their domain through our email pattern detector or look at a known employee email from a press release or contact page.
- 02.Generate the permutations using an email permutator. Paste the name + domain and the tool spits out the eight standard formats.
- 03.Run all eight through a verifier. Anything that comes back "valid" is the one you send to. Use the free email verifier for single addresses or the bulk email verifier for a list.
- 04.If every permutation comes back catch-all or unknown, the company uses a catch-all server (every address resolves as valid). Treat this as a "risky" signal and move to Method 3 or 4 for confirmation.
Browser extensions can automate this whole flow. We've reviewed the best email finder Chrome extensions that combine permutation + SMTP verification + one-click LinkedIn integration in a single sidebar.
Method 3: Search public records
Sometimes the database doesn't have it, the pattern doesn't match, and a finder won't help. That's when you go hunting. People leak emails into public records constantly, and once you know where to look, you can usually pull one out in five minutes.
Where emails hide in plain sight
codeGitHub commits
Every Git commit embeds the committer's email by default. Open a developer's GitHub profile, click any public repo they contribute to, and check git log or the commits tab. For most engineers, you'll get their personal or work email within two minutes. This is the single best method for finding a CTO, lead engineer, or any technical hire.
co_presentConference speaker pages
Speakers at conferences often list a contact email on the event's speaker page (so attendees can reach them). Try the speaker's name + conference name in Google, or browse past speaker rosters for industry events like SaaStr, Web Summit, INBOUND, and your vertical-specific conferences.
descriptionSEC filings & EDGAR
If your target is a C-suite executive at a US-listed public company, the SEC's EDGAR database is gold. Form 10-Ks, DEF 14As, and 8-Ks often list officer emails directly. Search for the company on edgar.gov and download recent filings.
campaignPress releases
Almost every press release ends with a media contact email. PR Newswire, Business Wire, and the company's own press page are all worth a Ctrl+F. Even if the contact is a PR person, they can route you to the right exec in one hop.
micPodcast guest pages
Guests on niche podcasts often list a contact in the episode description. Search "[Name] podcast" on Apple Podcasts, Spotify, and YouTube. The guest's email is sometimes in the show notes, the host's intro, or the guest's personal site that the show links to.
personPersonal websites & portfolios
For freelancers, consultants, writers, and execs with a personal brand, their own website almost always has a contact email. Try [firstname][lastname].com, [firstname].dev, [firstname].me, or search "[Name] personal site" on Google.
Google search operators that work
- search
"firstname lastname" + "@company.com"— surfaces any public page where both appear together. - search
"firstname lastname" filetype:pdf— bios, conference programs, and resumes often contain emails. - search
site:linkedin.com "firstname lastname" "company"— locates a specific LinkedIn profile fast. - search
site:company.com "contact" OR "email"— pulls contact pages off the company's own website.
Method 4: Use LinkedIn Sales Navigator + an extension
LinkedIn is the single largest verified-identity database in B2B. The challenge is that LinkedIn itself doesn't expose email addresses (unless the person has chosen to publish theirs, which most haven't). But Chrome extensions bridge that gap: they read the profile URL, query a finder database in the background, and surface the verified email inside the LinkedIn sidebar.
How to find someone's email via LinkedIn
- 01.Install a LinkedIn email finder extension. The best email finder Chrome extensions are Mailsfinder, Hunter, Lusha, Apollo, and Findymail.
- 02.Open the person's LinkedIn profile (or Sales Navigator lead page).
- 03.Click the extension's "Get email" button. The extension cross-references the LinkedIn URL against its database and surfaces a verified address.
- 04.If you have Sales Navigator, you can run this at scale: scrape a search result list and pull emails for every lead in one batch.
When LinkedIn-first works best
- check_circleRecruiters: Sales Navigator filters (current title, years in role, skills) let you build a hyper-targeted list, then extract emails for the whole list at once.
- check_circlePartnership leads: Search by title ("Head of BD", "Director of Partnerships") at target companies and pull contact info for the exact decision-maker.
- check_circleSaaS sales reps: Build account lists in Sales Navigator and feed them straight into a sequencer with verified emails attached.
Watch out for LinkedIn's rate limits. If you scrape too aggressively without a tool that respects daily caps, your account can get restricted. Stick to extensions that throttle their requests (Mailsfinder and Hunter both do).
Method 5: Reach out on LinkedIn DM or Twitter (last resort)
When every database has failed you, every public record is a dead end, and you still need to reach this specific person, you ask them directly. It feels low-tech, but it works better than people expect, especially for journalists, creators, and execs who use social platforms actively.
A message template that works
"Hi [Name], I'm working on [specific thing relevant to them] and wanted to share [thing of value, not a pitch]. What's the best email to send it to? Happy to keep it short."
Why this works
- check_circleYou're asking a small, specific favor (giving you an email) rather than pitching cold.
- check_circleYou're respecting their time by signaling that the actual ask will be short.
- check_circleYou're moving the conversation to email, which has way better engagement than DMs for anything longer than two sentences.
For journalists, Twitter DMs convert higher than LinkedIn. For execs and B2B buyers, LinkedIn beats Twitter every time. For creators and YouTubers, check whether they have a Beacons or Linktree page that lists a business email before DMing.
How to verify the email you found
Finding an email is half the job. Verifying it before you send is what protects your domain reputation and keeps your replies coming. A bounce rate above 5% is enough to flag your sender domain at Gmail and Outlook within a week.
What verification actually checks
| Check | What it confirms |
|---|---|
| Syntax | The address is formatted correctly (foo@bar.com pattern). |
| Domain & MX | The domain exists and has active mail servers ready to receive. |
| SMTP ping | A no-payload connection to the mail server confirms the inbox exists. |
| Catch-all detection | Flags servers that accept every address (so you know a "valid" result is risky). |
| Role detection | Identifies generic addresses (info@, sales@, support@) that have lower reply rates. |
| Disposable detection | Flags addresses from temporary email providers (10minutemail, etc.). |
When to use which tool
For a single address
Use the free email verifier. Paste the address, get a result in two seconds. Free for the first 100 per day.
For a list of 50+ addresses
Use the bulk email verifier. Upload a CSV, get back a cleaned list flagged by status (valid, catch-all, invalid, role).
Most quality finders verify on the fly, so if you got the email from Mailsfinder, Hunter, or Findymail, it's already SMTP-checked. Re-verify only if the email is more than 30 days old (people churn jobs constantly).
Common mistakes and what not to do
blockDon't email every permutation
Sending the same message to jane@, j.doe@, jdoe@, janedoe@, jane.doe@ is the single fastest way to get flagged as spam. Mail servers track this pattern and your domain ends up on Spamhaus before lunch. Always verify before sending; never send to permutations.
blockDon't scrape protected sources
LinkedIn's terms of service prohibit large-scale automated scraping. Stick to extensions that operate within LinkedIn's rate limits, and never use scraping tools that bypass authentication. The legal exposure isn't worth the volume.
blockDon't ignore GDPR for EU contacts
If you're emailing EU-based prospects, you need a legitimate business interest (B2B prospecting qualifies in most member states) and a clear opt-out in every message. You also need to honor data deletion requests within 30 days. Document your basis for processing.
blockDon't trust an unverified email
An email from a finder is only as fresh as the database it came from. If the person changed jobs three months ago, you're about to send a bounce. Either pick a finder that re-verifies on demand, or run every email through a verifier before launching a campaign.
blockDon't pay for a tool before testing the free tier
Every finder has data gaps. The Mailsfinder, Hunter, Skrapp, and Snov free tiers are generous enough to evaluate accuracy on your specific ICP before committing to a plan. Test 20 known emails (people you can confirm) and measure hit rate before paying.
Find specific personas
Different roles leave different trails. Here are the fastest paths for the personas people search for most often.
business_centerHow to find a CEO's email
CEOs are heavily targeted, which means their direct email is often gatekept. Start with SEC filings (for public companies), then try a domain search on Hunter or Apollo and look for "ceo@" or "[firstname]@" patterns. Many startup CEOs publish their email on their personal website or use "[firstname]@[company].com" because they own the company. For larger orgs, you may end up with an EA's address; that's often the most effective path anyway.
If the CEO has a podcast, newsletter, or speaking circuit, those channels usually expose a real email faster than any finder.
person_searchHow to find a recruiter's email
Recruiters are usually easy because their job depends on being reachable. Start on LinkedIn (almost every recruiter has a contact email or InMail-open status visible). For internal recruiters at a target company, run a domain search and filter by title containing "recruiter", "talent", or "people". For agency recruiters, the agency's website almost always lists individual team emails.
For deeper recruiter research, see our list of extensions that work inside LinkedIn Recruiter Lite.
newspaperHow to find a journalist's email
Journalists publish their emails more than any other persona. Check the byline on their recent articles (most publications append a contact email), their Twitter bio, their Muck Rack profile, and their publication's "Contact us" page. Outlets like TechCrunch, Bloomberg, and The Information all maintain a writer directory with contact info.
If their public email is a generic "[publication]@" address, find their direct one by checking older bylines (they often switch to a personal email when they freelance).
workHow to find a hiring manager's email
Job postings rarely name the hiring manager directly, so you have to triangulate. Search LinkedIn for the team's department head at the target company ("VP of Engineering" + "Acme"), then run name + domain through a finder. If the role is brand new, the hiring manager is usually the team's most senior recent hire (look at LinkedIn join dates).
An ATS like Workable, Greenhouse, or Lever sometimes leaks the hiring manager's email in the metadata of the job posting URL. Worth checking.
handshakeHow to find a partnership lead's email
Filter LinkedIn or Sales Navigator by titles like "Head of BD", "Director of Partnerships", "Partner Manager", or "Alliances". These roles are public and easy to identify. Most BD leaders are active on LinkedIn and respond to DMs, so even if the finder fails you have a clear second path.
Frequently Asked Questions
How do you find out someone's email?expand_more
How do I find out someone's email if I only have their name and company?expand_more
How to find someone email for free?expand_more
How to find out someone's email using LinkedIn?expand_more
How to find people with email when you only have an email and need their full identity?expand_more
How can you find someone's email if they are not in any finder database?expand_more
How can you find out someone's email without paying for a tool?expand_more
How can I find out someone's email at a specific company?expand_more
How can I find someone's email if I know their Twitter handle but not their name?expand_more
How to find someone with email already validated and ready to send?expand_more
How to find someone by email address (reverse lookup)?expand_more
Related reading
Deeper comparisons and use-case guides worth reading alongside this guide.
Mailsfinder vs Hunter.io
Side-by-side pricing, accuracy, credit math, and a recommendation by use-case.
ListicleBest email finder Chrome extensions
If you live in LinkedIn, here are the browser extensions worth installing.
ToolFree email finder
Look up a verified email by name and company, 100 free per day.
ToolFree email verifier
Confirm an email is deliverable before you send. Single + bulk supported.
ToolEmail permutator
Generate every likely email format for a name + domain in one click.
Email formatZoomInfo email format
Pattern, sample addresses, and how to verify a ZoomInfo employee email.
Find any email in seconds
Start with 100 free lookups every day, no card required. Verified emails, built-in deliverability scoring, and a permutator for the tricky ones.
No credit card required • 100 free lookups per day • Cancel anytime