Email Permutation: The Complete Guide to Guessing (and Finding) Any Business Email

You've got a name and a company domain. You need an email address. So you start guessing: john@company.com, john.smith@company.com, jsmith@company.com - and you're already three tabs deep wondering which one won't bounce.

That's email permutation in a nutshell. It's either a clever hack or a massive time sink depending on how you do it.

What You Need (Quick Version)

Before we go deep, here's the shortcut based on where you are:

1. Just need one email fast: Use [Metric Sparrow's permutator](http://metricsparrow.com/toolkit/email-permutator/) (free, 46 permutations) plus the GMass verifier. Takes about 2 minutes.
2. Need emails regularly (10+/week): Skip permutators entirely. Use a dedicated email finder that returns verified emails directly. No guessing.
3. Need emails at scale (100+/week): You want waterfall enrichment tools or a B2B database with built-in verification. We cover those below.

Now let's break down how all of this actually works.

What Is Email Permutation?

Say you're trying to reach Sarah Chen at Acme Corp. You know her name. You know the domain is acme.com. But you don't know if she's sarah@acme.com, sarah.chen@acme.com, schen@acme.com, or one of 40+ other possible email addresses.

An email permutator generates all those combinations for you - typically between 30 and 46 variations per name-domain pair. It's brute force: create every plausible format, then use a verification tool to figure out which one actually exists.

Here's the critical distinction most people miss: a permutator guesses, a finder knows. A permutator gives you a list of possibilities. An email finder queries a database of verified addresses and hands you the real one. They solve the same problem from opposite directions, and the difference matters more than most articles let on.

The permutation approach is free, works surprisingly well for one-off lookups, and requires zero subscriptions. But it breaks down fast at scale.

A Brief History - Rob Ousbey's Spreadsheet

The email permutator concept traces back to around 2012, when Rob Ousbey's Spreadsheet - then at Distilled (later absorbed into Moz) - published a Google Sheet that generated email permutations from a first name, last name, and domain. The original workflow was beautifully scrappy. You'd generate permutations in the spreadsheet, paste them into Gmail's compose field, and hover over each address. If the Rapportive browser plugin showed a profile picture, you'd found a real person. No API calls, no subscriptions, no verification tools.

That blog post now returns a 404. Rapportive was acquired by LinkedIn and eventually discontinued. The hover-to-check method hasn't reliably worked since roughly 2020.

But the core idea - generate all possible formats, then validate - spawned an entire category of free tools that still work today. The spreadsheet died. The concept didn't.

Common Email Formats by Company Size

This is the data most articles on email permutation skip, and it's the most useful thing you'll read here. Interseller (now part of Greenhouse) analyzed over 5 million companies to identify which email formats dominate at each company size.

Small companies (1-50 employees)

Mid-market to enterprise (51+ employees)

The pattern is clear. Small companies keep it simple - firstname@ dominates when there are fewer than 50 people and collisions are rare. Once you hit 51-200 employees, flast@ takes over because you can't have three Sarahs sharing sarah@company.com. By the time you're at enterprise scale (1,000+), first.last@ wins decisively.

The crossover at 51-200 employees is the key insight. If you're prospecting into mid-market companies, lead with flast@ and first.last@ formats - not firstname@.

Industry matters too. Tech companies use firstname@ roughly 60% of the time. Finance and legal firms lean toward lastname.firstname@ about 25% of the time - more formal, more structured.

And here's the real unlock: once you find one verified email at a company, you've cracked the pattern for everyone there. If you confirm that jsmith@acme.com is real, every other employee is almost certainly flast@acme.com too. That single verification opens up the whole org chart.

How Email Permutation Works (Step-by-Step)

This workflow comes from a practitioner on r/sales who broke it down into a repeatable process. I've modernized it slightly, but the bones are solid:

1. Find the person's professional profile - their company's team page, a conference speaker bio, or a professional network profile. Grab their first name, last name, and current company.
2. Get the company domain - check the company's About page or website. You need the actual email domain, not just the website (sometimes they differ).
3. Open Metric Sparrow's Email Permutator+ - Google "email permutator" and it's the first result, or go directly to metricsparrow.com.
4. Enter first name, last name, and domain - click Permutate. You'll get 46 possible email addresses.
5. Copy all permutations - select all, copy.
6. Open the GMass Email Verifier - it's free and doesn't require a GMass subscription.
7. Paste your permutations - click "Find the Email Addresses."
8. Click "Verify these Addresses" - GMass runs SMTP checks against each one.
9. Look for the "Valid" result - that's your email.

Important caveat: this only works for business emails on custom domains. It won't help you find someone's Gmail or Outlook personal address.

Time-wise, you're looking at about 2 minutes per contact versus 5-10 minutes of manual guessing and Googling. That's solid for a free process - until you need to do it 50 times in a day.

Free Email Permutator Tools Compared

Metric Sparrow Email Permutator+

The default choice, and for good reason. It generates 46 permutations per input - the most of any free tool - and supports up to three domains simultaneously. If someone works at a company with both acme.com and acme.io, you can test both in one pass. It's the tool Reddit recommends most often, and it's the one we'd point anyone to first.

Enrichley Permutator

Generates 44 permutations and bundles in company-type pattern data, so you can see which formats are statistically most likely for your target's company size. That context is genuinely useful - it helps you prioritize which permutations to verify first instead of checking all 44 blindly.

Mailmeteor Permutator

Cleaner UI than Metric Sparrow, generates 34 permutations. It's part of Mailmeteor's broader email marketing suite, so if you're already in their ecosystem, it's a natural fit. Fewer permutations means slightly lower coverage, but the most common formats are all included.

Skip this if you don't live in spreadsheets: Foxfire Google Sheets Permutator

The spiritual successor to Rob Ousbey's original spreadsheet. Generates 33 permutations inside Google Sheets, which makes it easy to manipulate results, add columns, or feed into other workflows. If your entire prospecting stack runs through Sheets, this is your tool. If you prefer a web UI, stick with Metric Sparrow.

Why Permutators Alone Aren't Enough

Permutators handle step one. But they leave you exposed in ways that can tank your deliverability if you're not careful.

Catch-all domains break verification entirely

Between 15% and 28% of B2B domains are configured as catch-all - they accept email sent to any address, whether it exists or not. Send to junk123@bigcorp.com and the server says "sure, I'll take it." Your verification tool marks it as valid. But there's nobody on the other end.

The frustrating part? Catch-all domains are disproportionately the prospects you want most. Large enterprises with high budgets are the ones most likely to run catch-all configurations - and they're exactly where the generate-and-verify approach falls apart.

Email lists decay faster than you think

At least 23% of an email list degrades within a single year, per ZeroBounce's 2025 report. People change jobs, companies rebrand, domains get consolidated. Only 62% of emails submitted for verification were actually valid. More than 9% of all emails checked were catch-all - essentially unverifiable without sending.

That means even if your permutation was correct six months ago, there's a real chance it's dead now. If you're battling this problem, build a data decay refresh loop.

The bounce rate cliff is steep and unforgiving

Bounce rates exceeding 5% trigger spam filters. Gmail's complaint rate threshold sits at 0.3% - cross that line and your inbox placement drops fast. Gmail inbox placement is already only 87.2%. Outlook is worse at 75.6%.

Sending to unverified addresses can decline your deliverability by 15-30% across all campaigns. Not just the one with bad addresses - all of them. One sloppy send poisons the well for everything that follows. If you want the deliverability mechanics, start with domain reputation and then the broader email deliverability playbook.

Real talk: if your deals average under $15k, you probably can't afford the deliverability risk of permutation-based prospecting. The math doesn't work. One domain reputation hit costs you more in lost pipeline than a year of email finder credits.

The Gmail profile picture trick is dead

I still see articles recommending the Rapportive hover method. It's been dead since roughly 2020. Rapportive was discontinued years ago, and no reliable replacement exists for that specific workflow. If an article tells you to hover over email addresses in Gmail to check for profile pictures, close that tab. They haven't updated their content since 2018.

How to Verify Permutated Emails

If you're sticking with the permutation workflow, you need a verification step. Here are the main options:

All of these work well for standard domains. The differences are marginal - pick based on price and integration needs. EmailListVerify is cheapest per email; NeverBounce is most accurate by a hair. If you want a broader shortlist, see our ranked email verifier websites.

For the technically curious, here's what these tools do under the hood: they open an SMTP connection on port 25, send a HELO command, issue a MAIL FROM, then a RCPT TO with your target address. If the server accepts the recipient, the email likely exists. They stop before DATA - no email is actually sent. You can do this manually with nslookup -type=mx example.com to find the mail server, then telnet in. But at $0.006-0.01 per check, just use a tool.

When to Skip the Permutator Entirely

Permutators are a workaround, not a workflow.

They exist because finding business emails used to be hard. It's not hard anymore.

Use a Dedicated Email Finder

If you're permutating more than 10 emails a week, you've outgrown permutators. The two-step process of generate-then-verify is slower, less reliable, and more frustrating than just using a tool that returns verified emails directly.

Prospeo's email finder collapses that entire workflow into one step. Search by name and company - or upload a CSV, paste a URL from any professional profile, use the Chrome extension on any website - and get a verified email back. No guessing, no separate verification tool, no catch-all uncertainty. The 5-step verification with catch-all handling solves the exact problem that breaks standard permutation workflows. We've seen teams cut their bounce rates by 80%+ after switching from guessing to verified finders.

Meritt's story is a good example: their bounce rate dropped from 35% to under 4% after making the switch. Stack Optimize built to $1M ARR running on Prospeo data - deliverability stayed above 94% with zero domain flags across all clients. The free tier gives you 75 emails/month, which is enough to test whether the accuracy holds up before committing.

If you're comparing options, start with our roundup of B2B email lookup tools or the broader email lookup guide.

Waterfall Enrichment for Scale

If you're sending 500-1,000 emails a day, you need waterfall enrichment. At this volume, permutators were never in the conversation - this is enterprise-grade outbound.

The concept is simple: query your primary data provider first, then if there's a gap, query a second provider, then a third, and so on until you've got complete data. Tools like Clay and Instantly Lead Finder offer this approach. The upside is higher completeness - you're not dependent on any single database. The downside is complexity. Different providers return conflicting data (correct name but wrong phone number is a classic), GDPR compliance gets murky when data flows through multiple vendors, and implementation isn't trivial.

For teams at that volume, waterfall enrichment is worth the complexity. For everyone else, it's overkill.

B2B Databases with Built-In Verification

A few other options worth knowing:

Apollo has 250M+ contacts and a generous free tier; paid plans start around $49/mo. The #1 complaint on Reddit is accuracy - "data feels bad sometimes, lots of bounces on older contacts." It's a great starting point for building lists, less reliable for email accuracy specifically.

Hunter.io works better as a verification layer than a primary email source. Free tier available, paid plans from $34/mo. The database is smaller, but verification accuracy is solid at 97.3%.

Snov.io is strong for international leads and runs on affordable credits - $39/mo for the starter plan. Good option if you're prospecting outside North America.

FAQ

What's the difference between an email permutator and an email finder?

A permutator generates 30-46 possible email combinations from a name and domain - you still need to verify which one is real. An email finder queries a database of verified addresses and returns the actual email directly. Permutators guess; finders know.

How many email permutations does a typical tool generate?

Most free permutators generate between 33 and 46 combinations per name-domain pair. Metric Sparrow leads with 46, Enrichley generates 44, Mailmeteor produces 34, and Foxfire's spreadsheet generates 33. All cover the most common business email formats.

Are email permutators GDPR compliant?

Generating permutations isn't inherently a GDPR violation, but sending unsolicited emails to guessed addresses without a lawful basis (like legitimate interest) can be. Always verify the address exists before sending, and respect opt-out requests immediately. Using a GDPR-compliant finder with verified data reduces legal risk significantly.

What's the most common business email format?

For companies under 50 employees, firstname@ dominates at over 70%. For companies over 1,000 employees, first.last@ wins at 48%+. The crossover happens around 51-200 employees, where flast@ and first.last@ overtake the simpler firstname@ format. Knowing this pattern lets you prioritize the right permutations first.