How to Find Someone's Email Address (2026 Guide)

Finding a specific person's email address is one of the most common small tasks in sales, recruiting, journalism, and networking — and one of the most inconsistently done. Some people guess a pattern and fire off a message with no idea whether it will bounce. Others give up after one failed search and default to a LinkedIn connection request. Neither is necessary. There's a repeatable method that works for most professional contacts, and it ends the same way every time: with verification, not a guess you hope lands.

This guide covers the actual methods that work — company domain patterns, social bios and link-in-bio pages, website contact pages, and search operators — in the order you should try them, plus how to confirm an address is real before you use it. It also covers what to do when a name is too common to disambiguate confidently, and when manual lookup stops making sense and a scraping tool becomes the faster path.

Why this is harder than "just Google it"

A person's email address usually isn't published in one obvious place. It's scattered across signals: a company's domain, a format convention that team uses, a bio link, a byline, a conference speaker page. Finding it means reconstructing the address from those signals, not searching for a string that already exists somewhere in full.

Two things make this trickier than it sounds:

• Most companies don't publish individual emails. A "Contact" page lists info@ or sales@, not jane@. You have to infer the personal address from a pattern.
• A plausible-looking address isn't a confirmed one. jane.smith@company.com might be right, might be jsmith@, might not exist at all if Jane goes by a nickname internally. Guessing gets you a candidate, not a fact.

That second point is the one people skip, and it's the one that matters most. Every method below produces a candidate email. The verification section at the end is not optional — it's the step that turns a guess into something you can actually use.

Method 1: Work out the company's domain pattern

This is the highest-yield method for any business contact, because most companies use one address format across their entire staff. If you can find two or three known employees at a company, you can usually reverse-engineer the pattern and apply it to anyone else there.

Common patterns, roughly in order of popularity in North American and European companies:

Pattern	Example (Jane Smith at acme.com)
first.last@domain	jane.smith@acme.com
firstlast@domain	janesmith@acme.com
first@domain	jane@acme.com
flast@domain	jsmith@acme.com
first_last@domain	jane_smith@acme.com
last.first@domain	smith.jane@acme.com

To find the pattern for a specific company:

1. Search "@companydomain.com" on Google or LinkedIn to surface any email that's already been published — a press release, a GitHub commit, a conference bio.
2. Check the company's own "Contact" or "Team" page — sometimes a founder or spokesperson's direct email leaks through even when the general team doesn't have public addresses.
3. Once you have one confirmed address, apply the same format to the name you're actually looking for.

If you can't find a single confirmed example, first.last@domain is the safest first guess for larger companies, and first@domain for small teams and startups — but treat either as unverified until you check it.

One confirmed example gives you a reasonable pattern guess. Two or three confirmed examples across different people at the same company give you real confidence, because it rules out the case where the one example you found was an exception — a founder using a vanity address while the rest of the team follows a different convention, or a legacy address kept alive after a company-wide format change. It's also worth double-checking that the domain itself is current: companies rebrand, get acquired, or migrate to a new domain while keeping an old one alive only for a transition period, and a pattern that was correct a year ago can point at an inbox nobody reads anymore.

Method 2: Check social bios and link-in-bio pages

People frequently put a direct email address, or a link that leads to one, somewhere in their public social presence:

• Bio text. Many professionals write their email directly in an X, Instagram, or LinkedIn bio, sometimes obfuscated as jane [at] acme [dot] com to dodge simple bots — worth checking for that pattern specifically.
• The dedicated "website" field. Most platforms have a distinct external-link field separate from bio text — this often points to a personal site or portfolio with a contact page.
• Link-in-bio hubs. Linktree, Beacons, and similar tools consolidate several links behind one bio link, and a contact or "email me" link is a common inclusion.
• Pinned posts. Creators and founders sometimes pin an announcement post that includes contact details for press or business inquiries.

This is mechanically the same problem as extracting any social link, just with an inbox at the end of the chain instead of another profile — our social links scraper guide goes deeper on where these links hide and how extraction tools follow them reliably, including expanding link-in-bio hubs that a quick manual check might stop short of.

Method 3: Check the company website directly

If the person works at a company with a real website, the site itself is often the fastest confirmed source, not a guess:

1. Visit the homepage and check the footer for a general contact address as a baseline.
2. Check /contact, /about, /team, and /leadership — team pages sometimes list individual emails or at least individual bios with a "get in touch" link.
3. Check the site's blog or press page — bylined posts sometimes include an author email.
4. View page source or check sameAs structured data if you're comfortable with basic HTML — some sites embed contact details in JSON-LD that isn't visible in the rendered page.

This step alone resolves a meaningful share of lookups, because plenty of small businesses and professional-services firms publish direct staff emails without realizing (or caring) that it makes them easy to find.

Method 4: Search operators and public directories

When the above don't turn up anything, a few targeted searches can still surface a match:

• "Jane Smith" "acme.com" — pairs the name with the domain to catch pages that mention both.
• "Jane Smith" email OR contact — broadens beyond the exact domain.
• site:linkedin.com "Jane Smith" "Acme" — confirms the right person and current employer before you spend time on the rest.
• Conference and speaker directories, alumni pages, and professional association member lists — these sometimes publish direct contact emails as a matter of course.

Treat anything a search turns up the same way you'd treat a guessed pattern: as a candidate to verify, not a confirmed address, unless the source is the person's own current, actively maintained page.

Dealing with obfuscated addresses and common names

Two situations trip people up often enough to call out separately.

Obfuscated addresses. People who don't want to hand their email to every bot that crawls a page will write it as jane [at] acme [dot] com, jane(at)acme.com, or as an image instead of selectable text. All three are deliberate, and all three are trivially reversible by a human reading the page — just substitute [at] for @ and [dot] for .. It's a courtesy convention, not real protection, but it does mean a naive automated search for @ symbols will miss these addresses even though they're sitting in plain view.

Common names. "John Smith at a large company" is a disambiguation problem before it's a lookup problem — there may be three John Smiths at the same firm across different departments. Anchor on something more specific than the name alone before you guess a pattern: the person's LinkedIn title and current employer, a recent post or press mention that confirms their role, or a mutual connection who can confirm which John Smith you mean. Guessing a pattern for the wrong John Smith produces an email that's technically deliverable and completely useless.

Method 5: When you need this at volume, not one at a time

Everything above works for finding one or two people's emails an afternoon at a time. It stops working — or rather, stops being a reasonable use of your time — the moment you need this for fifty or five hundred contacts instead of one. Manually checking bios, crawling websites, and pattern-guessing across a list that size is a full day of repetitive work even for someone fast at it.

This is the actual gap a scraping tool fills: not a different method, the same method run automatically across many contacts at once. Outsoci does this across ten sources — Google Maps, LinkedIn, Instagram, Facebook, X, YouTube, TikTok, Reddit, Threads, and ProductHunt — crawling profiles and linked websites, extracting candidate emails, and running them through verification before handing back a CSV. If your list-building need is "find this one person's email," do it by hand with the methods above. If it's "find verified emails for two hundred people matching this profile," that's where automating the same pipeline earns its cost. The $1 trial includes 100 credits, enough to test it against a real list before committing further.

Never skip verification

Every method above produces a candidate address, and candidates fail for reasons you can't see from the outside: the person left the company, the pattern guess was wrong, the domain has since changed hands. Sending straight to a guessed address is how good outreach quietly tanks a sender's deliverability.

At minimum, before you send anything to a found or guessed email, check:

• Syntax — is it a well-formed address?
• Domain and MX records — can this domain receive mail at all?
• Mailbox — does an SMTP check confirm the specific inbox exists?
• Catch-all risk — does the domain accept mail to any address, which makes a "pass" less conclusive?

Free tools like Outsoci's email checker run this check in seconds for a single address, which is the right scale for "I found one candidate email and want to confirm it before I send." For a whole list at once, the same four-layer check needs to run in bulk — our guide to email verification covers exactly how each layer works and where SMTP checks can be genuinely inconclusive, particularly on catch-all domains where a "valid" result doesn't guarantee the specific mailbox exists.

Quick decision table

Your situation	Best method to start with
You know the company, need one specific person	Domain pattern + one confirmed example
The person is a creator or has a strong social presence	Social bios and link-in-bio pages
Small business or professional-services firm	Company website contact/team pages
Nothing obvious turns up	Search operators + directories
You need this for dozens or hundreds of people	A scraping tool with built-in verification

Common mistakes to avoid

• Sending to a guessed address without verification. A plausible pattern is not a confirmed inbox — always check before sending, not after a bounce.
• Assuming one pattern fits every company. Patterns vary by company, and some organizations mix formats across departments or legacy vs. current employees.
• Ignoring catch-all domains. If a domain accepts mail to any address, a "valid" SMTP response doesn't confirm the specific person's inbox exists — treat these as lower confidence.
• Stopping at the first hop on link-in-bio pages. A Linktree or Beacons link often hides the actual contact page one click deeper.
• Scaling manual lookup past the point it makes sense. Past a few dozen contacts, the time cost of doing this by hand exceeds what a scraping tool costs to run the same process automatically.
• Guessing at a disambiguated wrong person. A confidently guessed pattern for the wrong "John Smith" is worse than no address at all — it looks like you did your homework and confirms you didn't.
• Treating an obfuscated address as unreachable. jane [at] acme [dot] com is a real, working email written to dodge simple bots, not a dead end — read it the way a human would.

Key takeaways

• Company domain patterns are the highest-yield method for business contacts — find one confirmed example at a company and apply the same format elsewhere.
• Social bios, dedicated "website" fields, and link-in-bio hubs frequently hold a direct email or a link to one, especially for creators and founders.
• Company websites — footer, contact, team, and press pages — often publish direct staff emails without a lookup tool being necessary.
• Every method here produces a candidate address, not a confirmed one — verify syntax, domain/MX, mailbox, and catch-all status before sending anything.
• Manual lookup is the right tool for one or two contacts; past a few dozen, a scraping tool running the same pipeline automatically is the faster, more consistent option.

FAQ

How do I find someone's email address for free? Start with the company's domain pattern (find one confirmed employee email and apply the same format), check the person's social bios and link-in-bio pages, and check the company website's contact and team pages. All of this is free and manual — the only cost is time, which scales badly past a handful of contacts.

What's the most common email format companies use? first.last@domain.com is the most common pattern at larger companies, followed by first@domain.com at smaller teams and startups. Confirm the actual pattern for a specific company by finding one known, working address there rather than assuming.

How can I check if an email address is real before sending to it? Run it through a verification check that covers syntax, domain/MX records, and an SMTP mailbox check — free single-address tools like Outsoci's email checker do this in seconds. Treat a "catch-all" result as inconclusive rather than confirmed, since those domains accept mail to any address.

Is it legal to find and email someone's business email address? Generally yes for business contacts in most jurisdictions, though the details depend on your region — CAN-SPAM in the US is an opt-out regime, while the EU and UK rely on legitimate interest with stricter transparency obligations. See Is email scraping legal? for the full breakdown by region.

What if I can't find someone's email through any of these methods? Try search operators pairing their name with their company domain, check professional directories and conference speaker pages, or fall back to a platform-native message (LinkedIn InMail, a reply to a public post) as a way to ask directly. Not every contact has a discoverable email, and forcing a guess in that case usually does more harm than good.

How do I find emails for a whole list of people at once, not just one? Manual lookup doesn't scale past a few dozen contacts without becoming a full day of repetitive work. A scraping tool that automates the same domain-pattern, bio-check, and website-crawl process — with built-in verification — is the practical option at volume; see our guide on building a verified cold email list for the end-to-end process.