Guide · Updated · By William Lodge
What Is OSINT? A Practical Beginner's Guide
What open-source intelligence is, who uses it, the basic research cycle, and the legal and ethical lines every beginner should know.
OSINT (open-source intelligence) is information collected from publicly available sources and analyzed to answer a specific question. "Open source" here has nothing to do with software licenses — it means the source is open to the public: websites, search engines, public records, social media posts, satellite imagery, certificate logs, news archives, and so on.
Journalists use OSINT to verify videos from conflict zones. Security teams use it to see what an attacker could learn about their company. Fraud investigators, researchers, and HR teams use it for due diligence. The tools differ, but the discipline is the same: ask a clear question, collect from public sources, verify, and document.
The OSINT research cycle
- Define the question and scope. "Is this domain connected to the phishing email we received?" is a good question. "Find everything about this person" is not — it has no end and invites privacy harm.
- Plan your sources. Decide which categories of data could answer the question: infrastructure records, archives, social media, images, breach data.
- Collect passively first. Passive collection reads data that already exists (search results, archives, certificate logs) without touching the target's systems.
- Verify. Corroborate every important finding with at least one independent source. A single match is a lead, not a fact.
- Document. Record what you found, where, and when. Archive pages that matter — online content changes or disappears.
- Report. Separate what you confirmed from what you inferred, and state your confidence.
Passive vs. active techniques
This distinction matters legally and ethically. Passive techniques query third-party data sources — looking up a domain in crt.sh or checking an archived copy of a page. Active techniques interact directly with the target — port scanning, brute-forcing subdomains against their DNS servers, or logging in to anything. Active techniques can be illegal without authorization, even when the intent is good. Many all-in-one frameworks such as SpiderFoot include both kinds of modules, so read the documentation before you press run.
Where beginners should start
- Learn search operators.
site:,filetype:, quoted phrases, and minus terms find more than most paid tools. - Pick one category and go deep. Infrastructure (domains, DNS, certificates) is the lowest-risk place to practice because the data is public by design. See our guide to finding subdomains passively.
- Use curated lists, but check dates. Lists like Awesome OSINT are great for discovery; many linked tools are no longer maintained. OSINTCompass shows a maintenance status and verification date for every listing.
- Practice on yourself. Search your own name, usernames, and email address. It teaches the tools and shows you your own exposure.
Legal and ethical lines
- "Public" does not mean "fair game." Collecting and combining public details about a private person can still be stalking, harassment, or a privacy-law violation.
- Respect platform terms of service. Never create deceptive accounts or use leaked credentials.
- Get written authorization before any active testing of systems you do not own.
- Minimize data: collect only what answers your question, and store it securely.
Next steps
Browse the full catalog by task on the categories page, or start with one of our step-by-step guides: verifying an image, searching usernames safely, or archiving a web page as evidence.
You are responsible for authorization and the laws that apply to your research. OSINTCompass lists tools for lawful, ethical public-source research.