What Is OSINT and What Can It Find About You?

OSINT is how investigators, journalists and scammers learn about people using only public information. Seeing yourself through that lens is the best way to protect your privacy.

By Siddharth ShankarUpdated October 18, 2026

OSINT sounds like spy work, and in part it is. But the same methods are used by journalists, security teams, recruiters, private investigators and, unfortunately, stalkers and scammers. The tools are search engines, public websites and patience.

What OSINT means

The US Office of the Director of National Intelligence and the CIA define OSINT as intelligence derived exclusively from publicly or commercially available information. The important word is available: nothing has to be hacked.

Where OSINT information comes from

• Search engines and cached pages
• Social media profiles, photos and friend lists
• People-search sites and data brokers
• Public records such as property, court and business registrations
• Old forum posts, reviews and comments under the same username
• Data from past breaches that circulates publicly
• Photo metadata and the background of images

What it can reveal about an ordinary person

Each source on its own may seem harmless. Combined, they can show your home address, phone number, workplace, relatives, daily routine, the car you drive and accounts you forgot you had. The skill in OSINT is linking: a username from an old forum leads to a profile photo, the photo leads to a social account, and that account names an employer.

Check yourself the way an investigator would

How to shrink what OSINT can find

• Make social profiles private and hide friend lists. See how to make Facebook private.
• Opt out of people-search sites and brokers.
• Use different usernames for different parts of your life.
• Delete old accounts you no longer use.
• Remove location data from photos before sharing.

A real-world example of linking

Imagine a public running app profile shows a loop that starts and ends at one street. A public photo on the same username shows a red front door. A local news comment under the same handle mentions a school. None of these reveals much alone. Together, they point to a home and a child’s school. That is how OSINT works, and why breaking just one link, such as the shared username, helps so much.

Run a yearly self-check

Once a year, search your name, email, phone number and main usernames, and look at your profiles while logged out. Note anything new and fix it. Our digital footprint checklist lists what to search for.

Old content matters most

The most revealing OSINT finds are often old: a forum post from 2012, a public wedding album or an archived page. Search older usernames and email addresses, not just current ones. Archived copies of pages can survive after the original is deleted, so removing something today does not always erase every copy. Still, removing it stops new people finding it easily.

Is OSINT legal?

Collecting publicly available information is generally legal, and it is a recognised discipline in security and journalism. How it is used can still be illegal, for example harassment, stalking or doxxing. See what doxxing is and how to protect yourself.