How to Find Anyone's Email Address in 30 Seconds (7 Free Methods)

Stop paying $99/month for email finders you barely use. Here are 7 battle-tested free methods to find anyone's email address in under 30 seconds — with real examples and hit rates.

Most people overpay for email finding tools they use 10% of. I've sent over 200,000 cold emails in the last three years, and I'd estimate 60% of the email addresses I found came from completely free methods. Let me show you exactly how to find email address free methods that actually work — not the watered-down list you've seen on every other blog.

The 7 Best Free Methods to Find Email Addresses

Before I get into the list, here's the counterintuitive insight most people miss: the best email addresses aren't hidden — they're just not indexed where you're looking. Google knows where they are. LinkedIn knows. The company's own website knows. You just need the right query syntax.

Method 1: Google Operators (Hit Rate: ~65%)

This is the one I use first, every single time. It takes 10 seconds and costs nothing.

The formula:

site:company.com "firstname" "email" OR "contact"

Real example — trying to find the VP of Marketing at a SaaS company:

site:acme.com "sarah" "@acme.com"

If that doesn't work, try:

"sarah" "acme.com" email

Or the nuclear option — search for their email format using a known employee:

site:acme.com "@acme.com" filetype:pdf

PDFs, whitepapers, and case studies are goldmines. Companies embed contact emails in those documents constantly and forget they're publicly indexed.

Pro tip: If you find one email at a company (say, jsmith@acme.com), you now know the format is firstinitial+lastname. Apply that to your target.

Method 2: Hunter.io Free Tier (Hit Rate: ~70%)

Hunter gives you 25 free searches per month. That's enough for targeted outreach. Don't waste it on companies where you can find the email manually.

What Hunter is actually good at: domain search. Type in a company domain and it shows you every email format it's indexed, plus real examples of emails it's found from that domain.

Even when it can't give you the exact email, it'll tell you the pattern (e.g., {first}.{last}@company.com). That's 80% of the work done.

Method 3: LinkedIn + Email Permutator Combo (Hit Rate: ~55-80% depending on verification)

This is the method I rely on most for mid-market and enterprise prospects.

Step 1: Find the person on LinkedIn. Get their full name and company domain.

Step 2: Use a free email permutator (Mailmeteor has a free one) to generate every possible combination:

john.smith@company.com
jsmith@company.com
johns@company.com
john@company.com ... and about 15 more variants.

Step 3: Verify the list using a bulk email verifier. I use Cleanmails' free bulk email verifier — paste in all the permutations, it'll tell you which one actually resolves.

This combo is devastating for finding emails at companies where Hunter has no data.

Method 4: Twitter/X Bio and Replies (Hit Rate: ~30%, but high-value targets)

Underestimated. Founders, consultants, and content creators routinely post their email in:

Their Twitter bio
Pinned tweets
Replies to DM requests ("just email me at...")

Search query:

from:@targethandle email OR "reach me at" OR "DM or email"

I've found the direct email of three Series A founders this way in the last six months. These are people whose emails aren't in any database — they just casually dropped it in a tweet thread three years ago.

Method 5: Company Website (The Places Nobody Checks)

Everyone checks the Contact page. Almost nobody checks:

Press/Media pages — companies list PR contact emails here, and PR people are often close to decision-makers
Job postings — many companies include a careers@ or hiring manager email
Terms of Service / Privacy Policy — legally required to have a contact email, often a real one
Blog author bios — writers sometimes link their personal email or a contact form
Podcast show notes — if your target has been a guest, the show notes almost always include their email or website
Whois records — for smaller companies, the domain registrant email is sometimes the founder's personal email. Try whois company.com in your terminal.

Method 6: GitHub and Technical Profiles (Hit Rate: ~80% for developers/technical founders)

If you're targeting engineers, CTOs, or technical founders, this is your unfair advantage.

GitHub users often expose their email in:

Their profile bio
Git commit history (run git log on any public repo they've contributed to)
README files

The git log trick is surprisingly effective:

git clone https://github.com/targetuser/repo.git
cd repo
git log --format="%ae" | sort -u

This dumps every email address associated with commits in that repo. I've found personal Gmail addresses, work emails, and old university emails this way.

Method 7: Clearbit Connect (Gmail Plugin) — Free Tier

Clearbit's Gmail plugin shows you company information and sometimes email addresses when you're composing an email. The free tier is limited but useful for enriching leads you've already partially identified.

More useful for its reverse lookup: if you have someone's LinkedIn URL or company + name, Clearbit will often surface the email pattern.

The Verification Step Nobody Skips (If They're Smart)

Finding an email address is half the job. Sending to an unverified email tanks your deliverability. One hard bounce in a cold email campaign can snowball into your entire domain getting flagged.

I've written about this at length in mastering cold email bounce rate management — the short version is: keep your bounce rate under 2% or your sender reputation starts degrading fast.

Before you send anything, run your list through the free bulk email verifier. It takes 30 seconds and will save you from sending to dead addresses, role-based emails (like info@), and catch-all domains that silently swallow your emails.

Building the List vs. Sending the Campaign

Here's where most people drop the ball. They spend 3 hours finding 50 emails, then fire up a generic Gmail draft and blast everyone the same message. The finding was the easy part — the sending infrastructure matters just as much.

If you're doing any volume over 50 emails a day, you need:

A warmed-up sending domain (not your main domain) — see how to warm up a new cold email domain
Sender rotation so no single mailbox carries the full load — optimizing cold email sender rotation covers this in detail
Email authentication (SPF, DKIM, DMARC) set up correctly before you send a single email

For my own campaigns, I run everything through Cleanmails — it's a self-hosted platform with built-in email validation, sender rotation, and cadences. I paid a one-time fee instead of $99-300/month in SaaS subscriptions. When you're doing outreach at scale, that math changes fast.

Quick Reference: Which Method to Use When

Scenario	Best Method	Expected Hit Rate
Enterprise/known company	Hunter.io domain search	70%
Technical founder/CTO	GitHub commit history	80%
Startup founder (active on Twitter)	Twitter search + bio	30-60%
Anyone at a mid-sized company	LinkedIn + permutator + verifier	55-80%
PR/media contacts	Company press page	85%
Unknown email format	Google operators	65%
Bulk list of names + domains	Permutator + bulk verifier	60-75%

The Contrarian Take: Stop Obsessing Over Finding Emails

Here's something I don't see people say enough: email finding is a solved problem. The real bottleneck isn't finding the email — it's writing something worth reading once you have it.

I've found the perfect email for a VP of Sales, sent a mediocre message, and gotten nothing. I've also sent a 5-line cold email to an imperfect lead list and booked 12 meetings in a week.

The email address is the ticket into the room. What you say when you get there is what actually matters.

Spend 20 minutes finding emails using these methods. Then spend the rest of your time making sure what you send is actually good.

Actionable Checklist (Do This Today)

Pick 10 target prospects and try the Google operator method first
Use Hunter.io domain search to confirm email format for each company
For any gaps, run the LinkedIn + permutator combo
Paste the full list into the bulk email verifier before sending
Check that your sending domain has SPF, DKIM, and DMARC configured with the DNS checker tool
Don't send until your bounce rate is projected under 2%

Related: