Free OSINT Tools: 19 We Tested for Investigating Disinformation
Updated: 4 hours ago
In short: The best free OSINT tools for investigating disinformation are the Wayback Machine and archive.today for archiving, Google Lens for reverse image search, ICANN Lookup and crt.sh for domains, urlscan.io and VirusTotal for websites, and the Meta, Google and TikTok ad libraries for ads. Debunk.org analysts tested the 19 tools below on 23 October 2026; each needs no paid account.
Learn to use these tools on real cases: start FIMI 101 → debunkacademy.org Get new investigations by email → debunk.org/subscribe
Also known as: open source intelligence tools; OSINT websites; free investigation tools.
Key facts
OSINT tools are free or paid services that help investigators find, preserve and check publicly available information.
Debunk.org tested 19 free OSINT tools on 23 October 2026 by using each on a real query; tools that needed an upload, an account or a bot check were left out of the tested list.
None of the 19 tools in our tested list requires a paid plan or an account for the basic use described here.
Debunk.org test on its own domain, debunk.org, 24 October 2026: crt.sh listed 15 current security certificates, all for debunk.org and its own subdomains, and the Wayback Machine had captures back to November 2003.
Updated October 2026 · By Debunk.org, an independent non-profit that researches disinformation
Contents: The 19 best free OSINT tools by category · Search and fact-checks · Archives · Images and places · Domains and websites · Ads and social media · Sanctions and companies · Tools we couldn't test · How to choose · FAQ · Sources
The 19 best free OSINT tools for investigations, by category
These are the free tools Debunk.org analysts use most, grouped by the question they answer; each was used on a real query on 23 October 2026.
Category | Tool | Good for | Limits | Cost / account | Tested |
Search | Google search operators | Exact phrases, one site, exclusions, file types, dates | Results are a sample, not everything that exists | Free, no account needed | 23 Oct 2026 |
Search | Finding published fact-checks of a claim | Only fact-checks it has indexed; it may change your spelling (it turned "overload" into "overlord" in our test) | Free, no account needed | 23 Oct 2026 | |
Archives | Earlier versions of pages; saving evidence now | Not every page or date is archived | Free, no account needed | 23 Oct 2026 | |
Archives | A second archive; listing snapshots of a whole site | Only pages someone chose to save | Free, no account needed | 23 Oct 2026 | |
Archives | A third archive for important evidence | Only pages someone chose to save | Free, no account needed | 23 Oct 2026 | |
Images and places | Reverse image search: earlier and similar copies | Finds similar images, not always the original | Free, no account needed | 23 Oct 2026 | |
Images and places | A second reverse image search | Results vary; none for our test image | Free, no account needed | 23 Oct 2026 | |
Images and places | Checking shadows against a claimed place and time | Needs the exact place and time; doesn't analyse the photo | Free, no account needed | 23 Oct 2026 | |
Domains and websites | Registration dates and registrar (RDAP) | The owner is usually redacted | Free, no account needed | 23 Oct 2026 | |
Domains and websites | Certificate history; domains sharing a certificate | Only HTTPS certificates; big domains return long lists | Free, no account needed | 23 Oct 2026 | |
Domains and websites | Screenshots, links and servers from public scans | Only sites someone scanned (debunk.org had no public scans) | Free, no account needed (paid plans exist) | 23 Oct 2026 | |
Domains and websites | Whether security vendors flag a site; related domains | A clean result is not proof that a site is safe or honest | Free, no account needed (paid plans exist) | 23 Oct 2026 | |
Domains and websites | Technologies and some tracking codes a site uses | Sees only what the site's code reveals | Free, no account needed (paid plans exist) | 23 Oct 2026 | |
Domains and websites | Whether Google flags a site as unsafe | Covers malware and phishing, not disinformation | Free, no account needed | 23 Oct 2026 | |
Ads and social media | Ads on Facebook and Instagram; page transparency | Ads only, not organic posts | Free, no account needed | 23 Oct 2026 | |
Ads and social media | Ads by advertiser or website on Google | Ads only | Free, no account needed | 23 Oct 2026 | |
Ads and social media | Ads shown on TikTok | Ads only, not organic videos | Free, no account needed | 23 Oct 2026 | |
Ads and social media | Telegram public preview (t.me/s/channelname) | Reading a public channel's posts in a browser | Public channels only | Free, no account needed | 23 Oct 2026 |
Sanctions and companies | Whether a person, company or outlet is on official lists | Official lists only: not being listed proves nothing | Free for non-commercial use, no account needed (paid licences exist) | 23 Oct 2026 |
Source: Debunk.org tests, 23 October 2026: each tool was used on a real query (no account, no upload). Free tiers and features change; we re-test this list when we update the page. For a wider catalogue, see the EEAS's OSINT Guidelines (November 2024), written with EU DisinfoLab, which include a catalogue of OSINT tools for investigating identity-based disinformation and FIMI. [5]
Get new investigations by email. debunk.org/subscribe
Next: learn how these tools fit into an investigation, step by step, in our guide to OSINT investigation techniques.
Search and fact-checks
Precise search finds what general searches miss, and fact-check search tells you if a claim has already been checked.
Google search operators: put a phrase in "quotation marks", limit to one site with site:, exclude words with a minus sign, find documents with filetype:. [1] In our test, site:debunk.org "Operation Overload" -ads returned only debunk.org pages.
Google Fact Check Explorer: searches published fact-checks. Check the spelling it searched for: in our test it changed "overload" to "overlord".
Archives
Archives preserve evidence before it disappears and show how a page changed.
Wayback Machine: look up a page's history, or save it now. It also has a free interface for listing all captures of a site.
archive.today and Ghostarchive: independent archives. Save important evidence in more than one archive.
Images and places
Reverse image search shows where a picture appeared before; sun and map tools check when and where it was taken.
Google Lens: paste an image or its address to find visual matches and the earliest copies.
Yandex Images: a second opinion; results vary by image, and it found no matches for our test picture.
SunCalc: shows the sun's direction and shadow length for any place and time, to check whether shadows in a photo fit its claimed date.
Our guide how to spot AI images and deepfakes explains what to look for.
Domains and websites
Domain tools show when a site was registered, what it runs on and what it is connected to.
ICANN Lookup: registration dates, registrar and status; owners are usually hidden.
crt.sh: every security certificate issued for a domain. In our test on debunk.org, crt.sh listed 15 current certificates, all for debunk.org and its own subdomains. [2]
urlscan.io: public scans of websites with screenshots, outgoing links and servers; searchable without an account.
VirusTotal: whether security vendors flag a domain, plus related domains and history.
BuiltWith: the technologies a site uses, sometimes including analytics codes that can link sites.
Google Safe Browsing: whether Google currently flags a site as dangerous.
Our step-by-step guide how to find out who owns a website shows how to combine them.
Ads and social media
Ad libraries show who paid to promote what, to whom and when.
Meta Ad Library: ads on Facebook and Instagram. The EU's Digital Services Act requires very large platforms to keep ads in a public repository "until one year after the advertisement was presented for the last time". Page transparency shows creation dates, name changes and admin countries. [4]
Google Ads Transparency Center: ads by advertiser or website across Google.
TikTok Commercial Content Library: ads shown on TikTok.
Telegram public preview: add /s/ to a public channel's address (t.me/s/channelname) to read its posts in a browser.
Sanctions and companies
Sanctions databases show whether a person, company or outlet is officially listed.
OpenSanctions: searches sanctions lists and other official datasets in one place. In our test it found the Internet Research Agency, the Russian troll farm sanctioned by the US, the EU and the UK.
Practise these tools on real cases. FIMI 101 teaches the open-source checks analysts use, step by step. → Start FIMI 101
Tools we couldn't test (yet)
These well-known tools are useful, but we couldn't test them on 23 October 2026, so they are not in our tested list.
Tool | Why not tested |
InVID-WeVerify verification plugin | Browser extension (not installed for this test) |
FotoForensics | Needs an image upload |
DNSDumpster | Needs a form submission |
Bellingcat wayback-google-analytics | Command-line tool |
EUvsDisinfo database, TinEye, ViewDNS.info, OpenCorporates | Blocked our test with a bot check |
OCCRP Aleph | Needs a free account |
SpiderFoot | Open-source (MIT licence) tool you install and run yourself; a separate paid cloud version (SpiderFoot HX) exists [6] |
Bing Visual Search, WhatsMyName, Google Earth, Mapillary | Opened but not used in this test |
How to choose OSINT tools
Pick tools by the question you need to answer, not by how long the list is.
Start free: the tools above cover most first checks; paid tools add history and scale.
Use two sources for every finding: archives, image search and domain data can be wrong or incomplete.
Mind your own safety: use separate research accounts and devices, and don't open suspicious files.
Stay legal and ethical: use public information only; no hacking, no fake identities to get into closed groups.
FAQ
What are OSINT tools? Free or paid services that help investigators find, preserve and verify publicly available information, such as archives, reverse image search, domain lookups and ad libraries.
What is the best OSINT tool? There isn't one: the best tool depends on the question. For disinformation work, an archive (Wayback Machine), a reverse image search (Google Lens) and a domain tool (crt.sh or ICANN Lookup) cover most first checks.
Can I do OSINT for free? Yes. All 19 tools in our tested list work without a paid plan for the uses described here.
Which OSINT tools can find a person? We didn't test people-search tools, and we don't use them on private individuals: searching for private people raises data-protection (GDPR) issues. In disinformation work, the legitimate checks are about accounts and organisations: whether a username appears on other platforms (tools such as WhatsMyName, not tested by us), who runs a page (ad-library page transparency) and what a site said in the past (archives).
Can AI tools help with OSINT? AI chatbots can help translate and summarise material, but treat what they produce as a lead to check, not a finding: confirm every name, date and number in a primary source before you use it.
Is using OSINT tools legal? Generally yes, when you use publicly available information and respect the tools' terms and data-protection law. This is general information, not legal advice.
What is the difference between OSINT tools and OSINT techniques? Tools are the services; techniques are how you use them in an investigation. See our guide to OSINT investigation techniques.
Written by Debunk.org. Updated October 2026. Tools tested on 23 October 2026. Debunk.org is an independent non-profit that researches disinformation and FIMI and an EU Digital Services Act trusted flagger.
Sources
Google, Refine Google searches (Google Search Help). https://support.google.com/websearch/answer/2466433
Debunk.org checks of its own domain, debunk.org, 24 October 2026 (crt.sh, RDAP, Wayback Machine; data saved with checksums).
Debunk.org tool tests, 23 October 2026 (log kept with this page).
Regulation (EU) 2022/2065 (Digital Services Act), Article 39(1). https://eur-lex.europa.eu/eli/reg/2022/2065/oj
EEAS Data Team, OSINT Guidelines: How to Detect and Analyse Identity-Based Disinformation/FIMI, November 2024 (with EU DisinfoLab). https://www.eeas.europa.eu/sites/default/files/documents/2024/EEAS-DataTeam-OsintGuidelines-04-Digital.pdf (saved, sha256)
SpiderFoot, GitHub repository (MIT licence, v4.0). https://github.com/smicallef/spiderfoot (accessed 23 Oct 2026)
Comments