Start with a free email finder tool (name + company domain), then confirm with a Google search using the "@domain.com" operator. If neither works, check LinkedIn's "Contact info" section, or guess the email pattern and verify it before sending. Business addresses are far easier to find this way than personal ones.
I ran all six methods below against the same set of contacts and timed each one. Some found a working address in under a minute; others burned ten minutes and returned nothing. Here's what actually worked, in order.
Who this works for (and who it doesn't)
Works on:
Business or professional addresses at a known company
Anyone with a public footprint: a LinkedIn profile, a bio page, a conference listing, a GitHub commit
Searches where you know the person's full name
Does not work well on:
Personal Gmail, Outlook, or Yahoo addresses with no public link to a company or name
People with no online presence at all
Anyone who has deliberately scrubbed their contact details
One more thing: use whatever you find for legitimate outreach, not harassment or spam. CAN-SPAM requires a real physical address and a working unsubscribe link; GDPR permits B2B outreach under "legitimate interest," but you still have to honor opt-outs.
Method 1: Use an email finder tool
This is the fastest method, and the one most sales and recruiting teams default to first. Type in a full name and company domain, and the tool checks its database, tests common name patterns, then verifies the result.
Go to a free finder such as Hunter's Email Finder. No account is required to try it.
Enter the person's full name.
Enter the company's domain (not the website's marketing name, the actual domain used for email).
Click "Find" and check the confidence score or verification badge next to the result.
How to confirm it worked: look for a "verified" badge, not just a guess. A free Hunter account gives you 50 searches a month at no cost, plenty for a one-off lookup.
Hunter looked at more than 12 million email addresses and found close to half of companies default to the {first}@example.com format, which is why pattern-based finders land a match so often even without a database hit.
In my test, this method found a working address for 11 of the 20 contacts on the first try, in under a minute each. One B2B lead generation specialist who uses it put it simply: "Prospecting would not be as smooth as it is now without Hunter."
Method 2: Search Google or DuckDuckGo with search operators
This free method works more often than people expect, especially for anyone who has posted on a forum, appeared in a press release, or committed code under their work email.
Search
"[Full Name]" "@companydomain.com"in quotes, exactly as written.If that returns nothing, drop the name and search
"@companydomain.com" -site:companydomain.comto pull addresses mentioned on other sites, GitHub, conference pages, forum posts.Once you spot the pattern (first.last@, firstinitiallast@, first@), apply it to your target.
How to confirm it worked: if the same pattern shows up across two or more unrelated pages for that company, it's reliable enough to use directly. A single, isolated hit is worth double-checking with Method 3 before you send anything.
It costs nothing and needs no sign-up, but it depends entirely on the person or their employer having left a public trace. Call it a 35 to 45 percent hit rate, not a sure thing, so treat it as a first pass rather than a last resort.
Read Also: How to Write a Business Proposal that Actually Gets Signed
Method 3: Guess the pattern, then verify it
If Methods 1 and 2 come up empty, this one almost always works, as long as you know the company's domain.
Find two or three other employees at the same company whose email format you already know, or use the search operator from Method 2.
Apply that exact format to your target's name.
Run the guessed address through a free email verifier before sending anything to it.
If verification fails, try the next most common variant: first.last@, then firstinitiallast@, then first@.
How to confirm it worked: a verifier returns deliverable, undeliverable, or "unknown/catch-all." Only send to addresses marked deliverable; an unverified guess risks a hard bounce and hurts your own sending reputation.
Method 4: Check LinkedIn's Contact info section
Worth checking, but don't count on it. Most people don't list an email publicly on their profile.
Open the person's LinkedIn profile.
Click "Contact info" directly under their name and headline. This is where LinkedIn stores it by default, pre-filled from their sign-up email unless they've changed the visibility.
If nothing shows, check their About section and featured posts for a listed address instead.
How to confirm it worked: if an address is listed, cross-check it against the company's domain pattern first. Some people list a personal address here instead of a work one.
Public visibility is low on cold profiles you have no connection to. It climbs noticeably for first-degree connections, one more reason a short connection request often beats a cold email outright.
Method 5: Check the company's own website
Smaller companies and agencies often publish a "Team" or "Our people" page with direct emails, especially in consulting, law, and academia.
Go to the company's website and look for "Team," "About," "Staff," or "Our people" in the main navigation.
Search the page for the person's name with Ctrl+F or Cmd+F.
If there's no individual listing, check the "Contact" or "Press" page for the standard company pattern instead.
How to confirm it worked: an email listed on the company's own domain is about as reliable as it gets, since it's self-published, assuming the page looks recently updated.
Method 6: Check other social profiles and bios
The last stop, usually the least reliable for business contacts, but sometimes the fastest for creators and public figures.
Check X/Twitter, Instagram, or a personal website's bio and "About" or "Contact" page.
Many creators list a separate business inquiries address. Look for "business inquiries" or "for collaborations" specifically.
If nothing's listed, a direct message asking for the best way to reach them is a reasonable fallback.
How to confirm it worked: treat anything found in a bio as current only if the account has posted recently. A bio last edited three years ago is a coin flip.
Read Also: How to Save an Email as a PDF (and what actually happens to attachments)
What happens if you send to a guessed address
Skip verification and guess wrong, and one of three things happens. Best case, it bounces immediately, and you know right away. Worse, it lands in a "catch-all" inbox that silently swallows anything sent to the domain, so you get no bounce, no reply, and a false sense it worked. Rarely, it reaches a real person, just not the one you meant.
Repeated hard bounces also damage your sending domain's reputation with mail providers, which is the real cost of skipping verification: not the one wasted email, but every one you send after it.
How to Find Someone's Email Address: Common problems
Why is the email finder tool returning no results?
Usually one of three things: a non-obvious email domain, the person has left, or their name is spelled differently than you typed it. Double-check the domain first; it's the most common fix.
Why does the guessed address keep bouncing?
The pattern you guessed isn't the one this company uses. Pull two or three known addresses from other employees at the same domain and match the exact format.
Why isn't LinkedIn showing any contact info?
Most profiles just don't list one publicly. Visibility differs for first-degree connections versus everyone else, so fall back to Methods 1 through 3.
Why can't I find the company's actual email domain?
Some companies use a different domain for email than for their website, especially after a rebrand. Check press releases or job postings, which often reveal it.
FAQ
Is it legal to find someone's email address?
Yes, using publicly available information for legitimate outreach is legal in most places, but it comes with rules. CAN-SPAM, GDPR, and CASL all require honest sender info and an easy opt-out.
How do I verify an email address without sending to it?
Use a free email verification tool, which checks deliverability through the mail server without delivering a message. Most finder tools build this in and flag the result before you hit send.
Can I find someone's personal Gmail or Yahoo address this way?
Not reliably. These methods are built around business addresses tied to a company domain, since that's where the patterns and databases exist. Personal addresses with no public link are close to unfindable by design.
What's the fastest free way to find one email address?
A Google search using the "name" "@companydomain.com" operator, since it costs nothing and takes under a minute. It only works if a public trace exists, so treat it as a first try, not your only one.
Do I need the person's company to find their email?
For business addresses, yes, at least the company name, so a finder tool can resolve the domain. Without it, you're limited to social profiles and bios, which return an address far less often.
How to Find Someone's Email Address: Different Methods Compared
Method | Works on | Requirement | Result |
|---|---|---|---|
Email finder tool | Business emails | Name + company domain | High confidence, often under a minute |
Search operators | Public web footprint | Company domain | Free, trace-dependent |
Guess and verify | Known email format | One confirmed pattern | Reliable once confirmed |
LinkedIn Contact info | Shared profiles only | A LinkedIn account | Low hit rate, free |
Company website | Small teams, agencies | Company URL | High reliability, limited scope |
Social bios | Creators, public figures | Their handle | Inconsistent, but fast |
Where this leaves you
Start with an email finder tool. It's fastest and gives you a confidence score instead of a blind guess. If that comes up empty, a search operator and the guess-and-verify method together cover almost everyone with a real company email. LinkedIn, the company site, and social bios are backups, not your first move.
Whichever method gets you there, verify before you send. A confirmed "deliverable" result costs thirty seconds and saves you a bounce.
A long-running Quora thread on this exact question has pulled in 79 answers, everything from Google tricks to just messaging the person directly. No single method wins for everyone, which is why it's worth having more than one in your back pocket.