How to Find Someone's Email Address in 2026 (7 Ways That Actually Work)
You've Googled their name plus "email" and gotten nothing but people-search sites asking for $20-$40. Or worse, a dozen results leading to the same outdated contact page. Here's the thing: you can find someone's email address in a few minutes once you know where to look.
Three paths, depending on your situation:
- Need one email right now? Use Google search operators. Free, works 35-45% of the time.
- Know the company? Guess the email pattern using the format table below, then verify it with an email checker tool. Companies under 50 people most often use firstname@domain.com.
Use an Email Finder Tool
This is the fastest approach and the one most sales teams default to. Whether you need to locate an email for someone at a specific company or build a full prospect list, the workflow is the same: enter a name and company domain, the tool searches its database, and you get a verified result back in seconds.
The metric to care about isn't database size - it's whether the email actually works when you hit send. Look for tools with built-in verification and accuracy rates above 95%. Anything below that usually means more wasted credits and more bounces (see invalid emails).
Tools make sense when you're doing this more than a few times a week. For a one-off search, the manual methods below work fine.
Google Search Operators for Email Lookup
This is the free power move most people never learn. Google indexes millions of pages containing email addresses - you just need to ask the right way.
Direct name + domain lookup:
"Jane Doe" "@acme.com"
The simplest query, effective about 35-45% of the time for professionals at mid-to-large companies.
Search the company's own site:
site:acme.com "Jane Doe" email
Find team and about pages:
site:acme.com intitle:"team" OR intitle:"about" OR intitle:"people"
Mine PDFs for buried emails:
filetype:pdf "Jane Doe" "@acme.com"
You'd be surprised how many emails live in PDF whitepapers, speaker bios, and regulatory filings.
Find the company's email pattern across the web:
"@acme.com" -site:acme.com
This surfaces every page outside acme.com that mentions an @acme.com email. Once you see two or three examples, you'll know the format.
Job postings (underrated):
"acme" hiring OR careers "send * resume to" "@acme.com"
Recruiters leave email addresses in job listings constantly. This operator catches them.
GitHub profiles for technical contacts:
site:github.com "Jane Doe" "@acme.com"
Don't rely on a single mention. If you find an email through one operator, cross-check it against another source - a PDF, a social profile, a conference page. One confirmation is good. Two is reliable.
Guess the Email Pattern
If you know someone's name and company domain, you can often guess their email with high accuracy. The trick is knowing which format the company uses, and that depends almost entirely on company size (full workflow: guess email address format).
An analysis of 5M+ companies by Interseller (now part of Greenhouse) mapped the most common email formats by employee count:
| Company Size | #1 Format | #2 Format | #3 Format |
|---|---|---|---|
| 1-10 employees | firstname@ (71%) | flast@ (13%) | first.last@ (10%) |
| 11-50 | firstname@ (42%) | flast@ (27%) | first.last@ (23%) |
| 51-200 | flast@ (42%) | first.last@ (30%) | firstname@ (17%) |
| 201-1,000 | flast@ (42-45%) | first.last@ (35-41%) | firstname@ (5-7%) |
| 1,001+ | first.last@ (48-56%) | flast@ (22-35%) | firstname@ (3-7%) |
Under 50 employees, try firstname@ first. Over 200, try first.last@. The crossover happens around 51-200 employees, where flast@ (jdoe@) takes over.
Once you've guessed a format, verify it before sending. Free permutator tools like Metric Sparrow generate 46 permutations from a name and domain, while Enrichley produces 44. Run the results through a verification tool (see email ID validators), and you'll know which one's real.
Check Their Digital Footprint
Before you fire up any tool, spend three minutes checking the obvious places. Locating someone's contact info is often as simple as looking where they've already shared it publicly.
Company websites are the first stop - team pages, about pages, and staff directories at smaller companies almost always list emails directly. Social media bios are another quick win, since some people put their work email right in their Twitter/X or Instagram profile. Developers frequently list their email in GitHub profiles or commit history, and conference speaker pages often include contact info for presenters.
Two less obvious sources worth checking: subscribe to the company's newsletter, because the confirmation email often comes from a real person rather than a noreply@ address. And for founders or small business owners, a WHOIS/ICANN lookup on their domain sometimes reveals an email, though privacy services have made this less reliable over the past few years.
The key is cross-referencing. An email on a 2022 conference page might be outdated, but if the same address shows up on their current company site, you're good.
You just learned 7 ways to find someone's email address. Prospeo combines all of them into one lookup - 300M+ profiles, 98% verified accuracy, and you only pay for valid results at ~$0.01 per email.
Skip the guesswork. Get 75 free email lookups right now.
Just Ask
This sounds obvious, but it's underrated - especially for high-value targets.
Use the company's contact form and be specific about who you're trying to reach. Send a brief message through a mutual connection. Reply to their newsletter with a genuine question. Social DMs work too, particularly for founders and executives who are active online. A short, respectful message explaining why you want to connect gets a response more often than you'd expect. In our experience, this outperforms cold email for C-suite targets at companies under 500 people. Sometimes the best way to get someone's email is simply to ask for it (templates: outreach email template).
Email Finder Tools Compared
Let's be honest: most teams overpay for email data by 5-10x because they never calculate cost per valid email. A tool charging $49/month for 500 credits at 40% accuracy costs you $0.245 per usable email. A tool charging $39/month for 5,000 credits at 98% accuracy costs roughly $0.01. Credit waste is one of the biggest frustrations with email finders, and the math shows why (more stack options: cold email marketing tools).
| Tool | Free Tier | Paid From | Verification | ~Cost/Valid Email |
|---|---|---|---|---|
| Prospeo | 75 emails/mo | ~$39/mo | Yes | ~$0.01 |
| Hunter | 50 credits/mo | $49/mo | Yes | ~$0.25 |
| Apollo | Unlimited (fair use) | $49/user/mo | Partial | ~$0.02 |
| Snov.io | Free trial: 50 credits | $39/mo | Yes | ~$0.10 |
| GetProspect | 50 valid emails/mo | $49/mo | Yes | ~$0.08 |
| Anymail Finder | 3-day trial (100 credits) | $14/mo | Yes | ~$0.05 |
| Skrapp | 100 credits/mo | EUR39/mo | Yes | ~$0.06 |
| Wiza | Pay-as-you-go | $0.15/email | Yes | ~$0.15 |
| VoilaNorbert | 50 credits (with account) | $49/mo | Available | ~$0.14 |
Prospeo
Prospeo covers 300M+ professional profiles with 143M+ verified emails. The 98% email accuracy rate is the highest in the category, backed by a proprietary 5-step verification process that handles catch-all domains, spam traps, and honeypots before the email reaches you. No separate verification step, no extra charge.
The 7-day data refresh cycle is a genuine differentiator - most tools refresh around every 6 weeks, which means you're working with stale data when someone changes jobs. Prospeo catches those changes fast.
The free tier gives you 75 verified emails per month. Paid plans start around $39/month and include thousands of credits, bringing the effective cost to roughly $0.01 per email - the cheapest cost-per-valid-email on this list. The Chrome extension with 40,000+ users lets you pull verified emails from any website or professional profile as you browse, and native integrations push contacts straight to Salesforce, HubSpot, Smartlead, Lemlist, Instantly, and Clay.
Stack Optimize scaled from $0 to $1M ARR using Prospeo for client prospecting - 94%+ deliverability, bounce rates under 3%, zero domain flags across all clients.
Best for: Teams that need high-volume verified emails without a separate verification step. Skip if: You only need 2-3 lookups a month (the free tier still covers that, though).
Hunter.io
Hunter is the tool most people try first, and there's a reason - it's dead simple. Type in a domain, get a list of email addresses associated with it. The domain search feature is genuinely useful for mapping an entire company's email structure before reaching out to a specific person.
The free tier gives you 50 credits per month. Paid plans start at $49/month for 1,000 credits. Verification is included, though accuracy on cold lookups tends to run lower than verification-first tools. Hunter works best when you already know the domain and need to discover the pattern, rather than finding a specific person's verified email.
Best for: Occasional domain-level research with a beginner-friendly interface. Skip if: You need high-volume verified emails - the cost per valid email adds up fast.
Apollo
Apollo isn't just an email finder - it's a full prospecting platform that happens to find emails. The free tier offers unlimited email credits with fair-use limits and 10 export credits per month, one of the most generous free plans out there. The database covers 210M+ contacts and 30M+ companies, and built-in sequencing tools mean you can find and email someone without leaving the platform.
Paid plans start at $49/user/month with 5,000 credits. The catch: "unlimited email credits" means you can view emails in-app, but exporting or using phone numbers burns credits. The consensus on r/sales is that Apollo's data is solid for discovery but you'll want external verification for exported contacts, so budget for that extra step.
Best for: Teams that want prospecting + outreach in one tool and don't mind trading some data accuracy for workflow convenience. Skip if: Email accuracy is your top priority.
Budget and Pay-As-You-Go Options
Snov.io starts at $39/month for 1,000 credits with built-in verification. Solid budget pick for small teams, and the drip campaign feature is a nice bonus if you don't already have a sequencer.
GetProspect offers a clean Chrome extension and decent accuracy at $49/month for 1,000 valid emails plus 2,000 verifications. Good for teams prospecting primarily from professional profiles.
Anymail Finder has a compelling model: you only pay for emails verified as valid. Plans start at $14/month, and the 3-day free trial includes 100 credits. If credit waste drives you crazy, this pricing model eliminates most of it.
Skrapp gives you 100 free credits per month and doesn't charge for invalid or unknown results. Paid plans start at EUR39/month, and credits roll over - unusual and helpful for inconsistent prospecting volumes.
Wiza runs pay-as-you-go at $0.15 per email, with monthly plans from $30. Good if your volume is unpredictable and you don't want a subscription.
VoilaNorbert offers 50 free credits once you create an account and paid plans from $49/month.
Pattern guessing works 35-45% of the time. Google operators require cross-referencing. Prospeo's 5-step verification - with catch-all handling, spam-trap removal, and 7-day data refresh - delivers verified emails in seconds, not minutes.
Find and verify any professional email in one click.
Always Verify Before You Send
Finding an email is only half the job. Sending to an unverified address is how you tank your domain reputation - and once that's damaged, even your emails to warm leads start landing in spam.
The numbers are unforgiving. Keep total bounces below 2% and hard bounces under 1%. Go above that threshold consistently, and ESPs will throttle your entire domain (deep dive: hard bounce).
Catch-all domains deserve special attention. These servers accept email to any address at the domain, so verification tools can't confirm whether a specific mailbox exists. The email won't bounce, but it might land in a black hole. Good verifiers flag catch-all addresses as "risky" rather than "valid," letting you make an informed call.
Role-based inboxes like info@, contact@, and sales@ are weaker for reaching decision-makers. They're often monitored by junior staff or routed to shared queues. Always aim for a personal address.
Standalone verification tools like ZeroBounce and NeverBounce work well if your email finder doesn't include verification. But the extra step adds cost and friction - a recurring complaint across sales communities is that bolting together separate find-then-verify workflows doubles the failure points (more on workflows: email verification for outreach).
Data freshness matters as much as initial accuracy. An email that was valid three months ago might bounce today because the person changed jobs. Tools refreshing on a 7-day cycle catch these changes. Tools refreshing every 6 weeks leave you exposed (why this happens: B2B contact data decay).
What About Personal Emails?
Most email finder tools focus on professional and business emails. If you're trying to track down a personal address - a Gmail or Yahoo account - you're in different territory.
Personal email discovery is mostly data-broker driven. Services like BeenVerified or Spokeo aggregate public records and can sometimes surface personal addresses, but the accuracy is inconsistent and the ethical ground gets murkier. We'd recommend steering clear unless you have a legitimate reason and the person's consent.
For high-value contacts, ask directly. Use a contact form, reach out through a mutual connection, or send a social DM explaining why you'd like to connect. It's slower, but it's reliable and keeps you out of a gray area.
Is This Legal?
Yes - with rules. The penalties for breaking those rules run up to $53,088 per email, so pay attention.
CAN-SPAM (US) requirements - non-negotiable:
- Truthful header information (your "from" name and email)
- Non-deceptive subject lines
- A physical mailing address in every email
- A functional unsubscribe mechanism
- Honor opt-out requests within 10 business days
The FTC hit Verkada with a $2.95M fine as a reminder that enforcement is real.
UK and EU: B2B outreach is generally permitted under "legitimate interest" provisions in GDPR and ePrivacy regulations. You need a defensible reason for contacting someone in their professional capacity. Pure B2C cold email requires consent (practical guide: GDPR for Sales and Marketing).
Canada (CASL): The strictest major market. You need express or implied consent before sending commercial electronic messages. Implied consent covers existing business relationships, but the bar is higher than CAN-SPAM (details: CASL cold email).
Germany and UAE require explicit consent even for B2B, so tread carefully when prospecting into those markets.
The bottom line: in most English-speaking markets, finding and emailing a business contact is legal. Include your physical address, make it easy to unsubscribe, and actually honor those unsubscribes.
FAQ
Can you find someone's email address for free?
Yes. Google search operators, email pattern guessing, and free tiers from tools like Prospeo (75 emails/month) and Hunter (50 credits/month) all work without paying. The free methods take more time but handle occasional lookups well. If you only need one or two lookups a month, you'll never need a paid plan.
What's the most common email format at companies?
Startups under 50 people mostly use firstname@domain.com (42-71% of the time), while enterprises over 1,000 employees favor first.last@domain.com (48-56%). The crossover happens around 51-200 employees, where flast@ becomes the dominant pattern.
How accurate are email finder tools?
Accuracy varies wildly - a Feb 2026 benchmark test of 5,000 searches per tool measured results ranging from about 17% to 80% depending on the tool and search type. Prospeo leads the category at 98% verified accuracy. Always verify before sending regardless of which tool you use.
Is it legal to cold email someone you found online?
In the US, yes - CAN-SPAM allows unsolicited commercial email if you include a physical address, unsubscribe link, and honor opt-outs within 10 business days. The EU and UK allow B2B outreach under legitimate interest. Canada's CASL requires express or implied consent, making it the strictest major market.
What's the fastest way to find someone's email at a specific company?
Use an email finder tool with the person's name and company domain - you'll get a verified result in under 10 seconds. Without a tool, guess the format (firstname@ for companies under 50 people, first.last@ for enterprises over 200), then verify with a free checker before sending.
