Best OSINT Tools in 2026, Compared Honestly

Every tool below is good at something. The mistake that costs teams money is buying one shaped for a different question than the one they are being asked, which happens because comparison pages usually rank rather than explain.

This page explains the shape first. If your question is "collect everything about this space", the answer here is probably not us, and it says so.

See pricing

Competitors named.
Described from published terms.
Our own limits stated.
Nothing here is sponsored.

There are four shapes in this category, not one ranking.

A ranked list implies the tools do the same job at different quality levels. They do not. Sort them by shape and the choice usually makes itself.

Collection tools

theHarvester, Amass, Recon-ng, SpiderFoot. You point them at a target and they return everything they can find. Excellent breadth, high noise, output is yours to package. Free or cheap, and genuinely worth knowing.

Graph and link analysis

Maltego is the category. Entities and the relationships between them, explored visually, with third-party data brought in through Transforms. Unmatched for "how are these connected". You still write the report by hand at the end.

Threat intelligence feeds

Recorded Future, Intel 471. Continuous, global, scored, built for a SOC. Answers "what is happening out there". Wrong shape for "tell me about this specific vendor by Thursday", and priced for an enterprise security budget.

Case and evidence platforms

Where Osintpro sits. The unit of work is a scoped case about a named subject, and the native output is a report where every finding carries its record, its source endpoint and its UTC retrieval time.

Run one and compare the output, not the feature list.

Every tool below is worth a trial, and a trial tells you more than any comparison page can. Start here: declare a scope, run a domain you are authorized to assess, and look at what a report-first tool hands back. Each finding carries the raw record, the source endpoint and the UTC retrieval time.

It runs in your browser. Queries go to public DNS and RDAP endpoints, not through us.
Nothing reaches the subject. The domain you enter is never contacted, probed or scanned.
A domain, never a person. There is no input on this panel that accepts an individual.
Findings carry their evidence. Raw record, source endpoint and the UTC moment of retrieval.

Domain footprint sweep

passive collection only

1. Declare the scope stamped on the report

I am authorized to assess this domain, and I am collecting only from public sources.

2. Subject domain

Samples:

Every finding will carry four things

1 Severity. What the record means for the decision in front of you.
2 The raw record. Exactly as the source returned it, unedited.
3 The source endpoint. The request that produced it, so it can be re-run.
4 The UTC retrieval time. Records change. Without this it is an assertion.

Reads dns.google and rdap.org from your browser. Nothing is sent to the domain you enter.

Tick the authorization box, then run the sweep. Enter the domain you are authorized to assess, then run the sweep. Run the sweep. The report lands here.

Side by side on the axes that decide it.

Price anchors are the vendors' published or widely reported figures at the time of writing, and they move. Treat them as an order of magnitude rather than a quote.

Tool	Shape	What you end up holding	Authorized scope	Evidence chain	Price anchor
Osintpro	Case-first	A sourced, timestamped report	Declared before collection, stamped on the report	Raw record, source endpoint and UTC time on every finding	$149 to $1,190 a month
Maltego	Graph-first	A link chart you write up by hand	Not recorded	Entity provenance, no retrieval timestamp on the finding	Free tier, then EUR 3,000 or EUR 7,500 a year plus credits
SpiderFoot HX	Collection-first	A large raw result set	Not recorded	Module output, packaging is yours	Open source free. HX sold by Intel 471, price not published
Recorded Future, Intel 471	Feed-first	Global threat intelligence, not an entity dossier	Not applicable to the model	Analyst-written intelligence reporting	Commonly $50k or more a year, annual contract
Free tooling	Toolbox	Terminal output and screenshots	Not recorded	Whatever you save by hand	Free

Osintpro

Case-first

You end up holding: A sourced, timestamped report
Authorized scope: Declared before collection, stamped on the report
Evidence chain: Raw record, source endpoint and UTC time on every finding
Price anchor: $149 to $1,190 a month

Maltego

Graph-first

You end up holding: A link chart you write up by hand
Authorized scope: Not recorded
Evidence chain: Entity provenance, no retrieval timestamp on the finding
Price anchor: Free tier, then EUR 3,000 or EUR 7,500 a year plus credits

SpiderFoot HX

Collection-first

You end up holding: A large raw result set
Authorized scope: Not recorded
Evidence chain: Module output, packaging is yours
Price anchor: Open source free. HX sold by Intel 471, price not published

Recorded Future, Intel 471

Feed-first

You end up holding: Global threat intelligence, not an entity dossier
Authorized scope: Not applicable to the model
Evidence chain: Analyst-written intelligence reporting
Price anchor: Commonly $50k or more a year, annual contract

Free tooling

Toolbox

You end up holding: Terminal output and screenshots
Authorized scope: Not recorded
Evidence chain: Whatever you save by hand
Price anchor: Free

Prices are the public list anchors these vendors publish or that buyers commonly report, not quotes. Every one of these tools is good at the job it was built for. The column that matters here is the authorized-scope column, because that is the one no other row fills in.

Pick by the question you are actually asked.

"Find everything about this space."

Use free collection tooling. theHarvester and Amass are excellent and cost nothing. Self-host open source SpiderFoot when you want the same breadth with scheduling and an interface. We are the wrong purchase.

"How are these entities connected?"

Maltego. Graph exploration is what it was built for and nothing else in this list matches it. Budget for the data Transforms separately, because that is where the cost becomes unpredictable.

"What threats are emerging against our sector?"

A threat intelligence platform. Feed-shaped questions need feed-shaped products, and an investigation tool will disappoint you. We wrote about the split on threat intelligence platforms.

"Is this vendor safe to sign, and can I prove I checked?"

A case platform. You need an artifact per counterparty that an auditor accepts, which is third party risk work rather than collection work.

"What does our own estate expose?"

Either a case platform run quarterly for a diffable record, or dedicated attack surface management if continuous monitoring matters more than the evidence chain.

"I am learning and I have no budget."

Free tooling, without hesitation. Start with the honest guide to free OSINT tools and the training path. Buy nothing until a finding has consequences.

Where each one genuinely beats the others.

Written the way we would describe them to a colleague rather than the way a sales deck would.

Tool	What it beats everyone at	Where it costs you
Maltego	Relationship discovery. Nothing else lets you pivot through entities visually with this fluency, and the Transform ecosystem is deep.	You finish with a graph and a blank document. Data Transforms bill separately and stack unpredictably, which procurement dislikes intensely.
SpiderFoot HX	Breadth per unit of effort. Hundreds of modules, scheduled scans, and an open source version that costs nothing.	Signal to noise. Output is technical footprint, with little for packaging a finding for a non-technical stakeholder. The hosted HX product is now sold by Intel 471 with no published price.
Recorded Future / Intel 471	Global coverage and analyst reporting quality. If you need to know what is happening, this is the tier that knows.	Commonly $50k or more a year on an annual contract, and the model is a feed rather than a case.
Free tooling	Cost, transparency and control. You can read the code and run it anywhere.	No scope record, no audit trail, no retention control, no report. Fine until a finding has consequences.
Osintpro	The evidence chain. Scope declared before collection, every finding carrying its record, endpoint and UTC retrieval time, report as the native output.	Not a graph tool, not a feed, and no people-search of any kind. If you want maximum raw collection breadth, free tooling beats us.

Maltego

What it beats everyone at: Relationship discovery. Nothing else lets you pivot through entities visually with this fluency, and the Transform ecosystem is deep.
Where it costs you: You finish with a graph and a blank document. Data Transforms bill separately and stack unpredictably, which procurement dislikes intensely.

SpiderFoot HX

What it beats everyone at: Breadth per unit of effort. Hundreds of modules, scheduled scans, and an open source version that costs nothing.
Where it costs you: Signal to noise. Output is technical footprint, with little for packaging a finding for a non-technical stakeholder. The hosted HX product is now sold by Intel 471 with no published price.

Recorded Future / Intel 471

What it beats everyone at: Global coverage and analyst reporting quality. If you need to know what is happening, this is the tier that knows.
Where it costs you: Commonly $50k or more a year on an annual contract, and the model is a feed rather than a case.

Free tooling

What it beats everyone at: Cost, transparency and control. You can read the code and run it anywhere.
Where it costs you: No scope record, no audit trail, no retention control, no report. Fine until a finding has consequences.

Osintpro

What it beats everyone at: The evidence chain. Scope declared before collection, every finding carrying its record, endpoint and UTC retrieval time, report as the native output.
Where it costs you: Not a graph tool, not a feed, and no people-search of any kind. If you want maximum raw collection breadth, free tooling beats us.

Questions people ask when they are choosing.

There is no single best one, because the category holds four different shapes. Maltego is best for link analysis when a case is a network. Shodan and Censys are best for finding exposed services across the internet. SpiderFoot is best for broad automated collection. A report-first tool is best when the deliverable is a sourced document about one named subject.

Free tools generally give you the lookup and leave you the work: correlation, deduplication, sourcing and the write-up. Paid tools sell the labor back to you as automation, coverage or an audit trail. The honest test is what an hour of your team costs, because free tooling shifts the cost from a license line to a headcount line rather than removing it.

Most working teams run two. A collection or scanning tool for discovery, where the question is what exists, and a case tool for anything with a signature attached, where the question is what can be proved about one subject. They answer different halves of the same review and neither substitutes for the other.

Collecting information from public sources is lawful in the US. What creates legal exposure is method and purpose: active scanning without authorization, circumventing access controls, and collecting about identified individuals without a lawful basis. Tools that only read published records and never contact the subject stay well inside the line.

Surveys of digital investigators consistently show a mix: open source utilities such as SpiderFoot, theHarvester and Recon-ng alongside a commercial platform for link analysis or reporting. The pattern is a free tool for collection breadth and a paid tool for the part that has to hold up when someone challenges it.

Write down who reads the output. If it is an analyst, buy for coverage and query power. If it is procurement, legal, an auditor or an investment committee, buy for evidence structure and export, because a reader outside the security team cannot act on a query result and will ask where a finding came from.

The comparison we will not make.

People-search and consumer background check services are not on this page, and it is not an oversight.

Several products marketed as OSINT tools are consumer people-search: enter a name or an email address, receive an aggregated profile of a private individual. They rank well and they are not comparable to the tools above, because they answer a different question for a different buyer under a different legal regime.

We do not build that, we do not compete for those queries, and our demo has no input that accepts a person. The acceptable use boundary sets out exactly what we refuse and why saying it in public matters to an enterprise buyer.

More comparisons and alternatives

New to the category? Start with open source intelligence, then see how a scoped case runs or read the analyst notes on the blog.

Run one scoped sweep and see what a sourced finding looks like.

The demo is free, it takes a domain and never a person, and it produces the same evidence chain the paid report does.

See how a case runs

Passive collection only, from public sources.
A domain, never a person. There is no input for one.
Your case data stays yours. No card required.