How to Find Someone's Email Address: 6 methods ranked by success rate

To find someone's work email address, start with an email finder tool. Type in their full name and their company's domain. If that finds nothing, search Google for the company's email pattern.

Then check LinkedIn, or guess the address and check it before you send. Work addresses are much easier to find than personal ones.

The six methods below are in order of what each one can check. Tools that test the mail server come first. Methods that only work if someone posted their address online come last.

Two related guides may help. If you already have an address and want to know if it will bounce, read how to verify an email address.

If you only have a phone number, read how to find someone's email by phone number.

Who this works for

Works well for:

Work email addresses at a company you know
People who are easy to find online: a LinkedIn profile, a bio page, a conference page, or code they shared on GitHub
Searches where you know the person's full name

Does not work well for:

Personal Gmail, Outlook, or Yahoo addresses with no public link to a company or name
People who are not online at all
People who have removed their contact details on purpose

Use what you find only for honest outreach, never for spam. In the US, the law for marketing email is called CAN-SPAM. The FTC says it covers emails between businesses too.

Every message needs a real postal address and a clear way to opt out, which means a way to stop getting your emails. In Europe, GDPR is the privacy law.

It allows business outreach under "legitimate interest," which means a fair business reason. You still have to stop when someone asks.

Method 1: Use an email finder tool

An email finder tool is a website that looks up a work email for you. It is usually the quickest way.

You type in a full name and the company's domain. The domain is the part after the @ in the company's emails, like company.com.

The tool checks its own list, tries common email patterns, and then checks the result.

Open an email finder tool.
Type the person's full name.
Type the company's domain. Use the domain the company uses for email, not just its brand name.
Run the search. Look at the score or "verified" mark next to the result.

How to know it worked: look for a "verified" mark, not just a guess.

Most companies give every worker an email in the same pattern. That is why these tools often find a match even when the person is not in their list.

Method 2: Search Google with search operators

A search operator is a small command you add to a search, like quote marks. This method is free. It works best for people who have posted on a forum, been named in a news release, or shared code with their work email.

Search "[Full Name]" "@companydomain.com" with the quote marks, exactly as shown.
If nothing comes up, drop the name. Search "@companydomain.com" -site:companydomain.com to find the company's emails on other websites, like GitHub, event pages, or forums.
Once you see the pattern, like first.last@, firstinitiallast@, or first@, use it for your person.

How to know it worked: if the same pattern shows up on two or more different websites, you can trust it. If you only find one example, check it with Method 3 before you send.

This method costs nothing and needs no account. But it only works if the person or their company left their email somewhere public. So treat it as a first try, not a sure thing.

Method 3: Guess the pattern, then check it

If Methods 1 and 2 find nothing, try this. It works when the company uses one email pattern for everyone, and you know its domain.

Find the emails of two or three other people at the same company. You can also use the search from Method 2.
Use that same pattern with your person's name.
Check the guessed address with a free email verifier before you send anything. An email verifier is a tool that checks if an address can receive mail, without sending a message.
If the check fails, try the next common pattern: first.last@, then firstinitiallast@, then first@.

How to know it worked: the verifier will say "deliverable," "undeliverable," or "unknown." Unknown often means "catch-all," a mailbox that accepts every email sent to the company. Only send to addresses marked "deliverable."

A wrong guess can cause a hard bounce. A hard bounce is an email that comes back because the address does not exist.

Too many hard bounces hurt your sending reputation, which is how much email providers trust mail from you.

Method 4: Check LinkedIn's Contact info section

LinkedIn is worth a look, but do not count on it. Most people do not show an email on their profile.

Open the person's LinkedIn profile.
Click "Contact info" under their name and headline. LinkedIn fills this section with the main email the person signed up with. Some of it is shown only to their connections.
If you see nothing, check their About section and featured posts for an email.

How to know it worked: if you find an email, check that it matches the company's email pattern. Some people list a personal email here instead of a work one.

Because some of this section is shown only to connections, a stranger often sees less than a direct connection does.

So a short connection request can work better than a cold email.

Method 5: Check the company's own website

Small companies and agencies often have a "Team" or "Our people" page with direct emails. This is common at consulting firms, law firms, and universities.

Go to the company's website. Look for "Team," "About," "Staff," or "Our people" in the menu.
Search the page for the person's name with Ctrl+F or Cmd+F.
If the person is not listed, check the "Contact" or "Press" page to see the company's email pattern.

This is the last place to look for work emails. It works better for creators and public figures.

Check the bio on X/Twitter or Instagram, or the "About" or "Contact" page on a personal website.
Many creators list a separate email for business. Look for words like "business inquiries" or "for collaborations."
If there is no email, send a short message asking for the best way to reach them.

How to know it worked: trust an email from a bio only if the account posted recently. A bio that has not changed in three years may be out of date.

The six methods compared

This table shows what each method works for, what you need, and what you get.

Method	Works for	What you need	What you get
Email finder tool	Work emails	Name and company domain	Strong match, often in under a minute
Search operators	People who are public online	Company domain	Free, but only if the email is public
Guess and check	Companies with one pattern	One known pattern	Reliable once checked
LinkedIn Contact info	Profiles that share it	A LinkedIn account	Free, but often empty
Company website	Small teams, agencies	Company website	Very reliable, but few people listed
Social bios	Creators, public figures	Their username	Fast, but not always current

What happens if you send to a guessed address

If you skip the check and guess wrong, one of three things happens.

Best case, the email bounces right away, so you know at once.

Worse, it lands in a "catch-all" mailbox.

That mailbox accepts anything sent to the company. You get no bounce and no reply, so it looks like it worked when it did not.

Sometimes it reaches a real person, but the wrong one.

Many hard bounces also hurt your sending reputation. So one skipped check can affect every email you send after it.

Finding the address is only the first step. The five-stage cold email outreach process shows what to set up and send once the address checks out.

Common problems

Why does the email finder find nothing?

Usually there are three reasons. The company uses an unusual email domain, the person has left, or you spelled the name differently. Check the domain first. That fixes it most often.

Why does my guessed address keep bouncing?

The pattern you guessed is not the one this company uses. Find two or three real emails from other people at the same company and copy their exact pattern.

Why does LinkedIn show no contact info?

Most profiles do not show an email to everyone. Direct connections can often see more. Go back to Methods 1 to 3.

Why can't I find the company's email domain?

Some companies use a different domain for email than for their website, often after a name change. Check their news releases or job ads. These often show it.

Why does no single method work every time?

Each method needs a different clue to be public. On Quora, a long thread asks this same question.

The answers range from search tricks to just messaging the person. That is why it helps to know more than one method.

FAQ

Is it legal to find someone's email address?

Yes, in most places, if you use public information for honest outreach. But there are rules.

CAN-SPAM in the US, GDPR in Europe, and CASL in Canada all require honest sender details and an easy way to opt out.

How do I check an email address without sending to it?

Use a free email verifier. It asks the mail server if the address exists, without sending a message. Many email finder tools do this for you and show the result before you send.

Can I find someone's personal Gmail or Yahoo address this way?

Not reliably. These methods work on work emails tied to a company domain, because that is where patterns exist. Personal emails with no public link are hard to find, and that is on purpose.

What is the fastest free way to find one email address?

A Google search like "name" "@companydomain.com". It costs nothing and takes under a minute. It only works if the email is public somewhere, so treat it as a first try.

Do I need to know where the person works?

For a work email, yes. You need at least the company name, so a finder tool can work out the domain. Without it, you can only check social profiles and bios, which find an email much less often.

Where to start

Start with an email finder tool. It is the fastest, and it gives you a score instead of a blind guess. If that finds nothing, use a search operator and then guess and check.

Those two together cover most people with a real work email. LinkedIn, the company website, and social bios are backups.

Whatever method you use, check the address before you send. A "deliverable" result takes thirty seconds and saves you a bounce.

Guidance reviewed 2 October 2026.

About the author

Michael Doyle writes about B2B sales at Leaderr. He covers prospecting, cold outreach, sales data, and pipeline building, with a focus on what actually works for SDRs, founders selling on their own, and small sales teams. Connect with him on LinkedIn.