Free OSINT Tools: 19 We Tested for Investigating Disinformation

Three free tools cover many first checks in a disinformation investigation: an archive such as the Wayback Machine to save a page and see its earlier versions, a reverse image search such as Google Lens to find where a picture appeared before, and a domain tool such as ICANN Lookup to see when a website was registered. Ad libraries add who paid to promote a message. Below are the 19 free tools Debunk.org analysts tested, grouped by the question they answer, each with what it is good for and its limits. None needs a paid account.

Which tool for which question?

The 19 best free OSINT tools for investigations, by category

Search and fact-checks

Precise search finds what general searches miss, and fact-check search tells you if a claim has already been checked.

• Google search operators: put a phrase in "quotation marks", limit to one site with site:, exclude words with a minus sign, find documents with filetype:. In our test, site:debunk.org "Operation Overload" -ads returned only debunk.org pages that mention Operation Overload, which is a quick way to see what one site has published on a topic. Google shows a sample of matching pages, not every one.

• Google Fact Check Explorer: a Google tool that searches only published fact-checks, so you can see whether a claim has already been checked. Check the spelling it actually searched for: in our test, it changed "overload" to "overlord".
  

Archives

Archives preserve evidence before it disappears and show how a page changed.

Online evidence can be edited or deleted at any time, and once it's gone it may not come back. Save what you find before you analyse it, and use archives to see what a page said earlier.

• Wayback Machine: look up a page's history, or save it now. You can check whether the same content was captured before, and on which dates. It also offers a free interface to list all captures of a site.

• archive.today and Ghostarchive: independent archives. Save important evidence in multiple archives. archive.today sometimes shows a bot check before it loads.

If a page needs a login, as many social media pages do, an archive may save only the login screen. Open the capture to check it, and take a screenshot.

Images and places

Reverse image search shows where a picture appeared before; sun and map tools check when and where it was taken.

In fact-checking, the first question about an image is often whether it is authentic, or old, edited or taken somewhere else. Analysts compare it with earlier copies and other images from the same event, look closely at details that may have been altered, and check whether the lighting and location fit the claim.

• Google Lens: paste an image or its web address (URL) to find visual matches and the earliest copies.

• Yandex Images: a second opinion; results vary by image, and it found no matches for our test picture.

• SunCalc: shows the sun's direction and shadow length for any place and time, to check whether shadows in a photo fit its claimed date.

Our guide on how to spot AI images and deepfakes explains what to look for.

Domains and websites

Domain tools show when a site was registered, what it runs on and what it is connected to.

Websites leave traces, and these tools bring them together: you can see whether a "news outlet" appeared last week, or whether sites with different names run from the same place. A single clue rarely proves anything; the value is in links between several.

• ICANN Lookup: registration dates, registrar and status; owners are usually hidden.

• crt.sh: every security certificate issued for a domain.

• urlscan.io: public scans of websites with screenshots, outgoing links and servers; searchable without an account.

• VirusTotal: whether security vendors flag a domain, plus related domains and history.

• BuiltWith: the technologies a site uses, sometimes including analytics codes that can link sites.

• Google Safe Browsing: whether Google currently flags a site as dangerous.

Our step-by-step guide on how to find out who owns a website shows how to combine them.

Ads and social media

Ad libraries show who paid to promote what, to whom and when.

Ads are one of the few places where someone has to put a name to a message. A post can look like grassroots opinion, but if money is behind it, an ad library will often show who paid, when it started and where it ran. That changes the question from "is this true?" to "who wants this seen?" Start with a page, advertiser or website you already suspect, then widen the search to related pages, because campaigns often run through several accounts. Save screenshots and links as soon as you find something: ads are taken down, and libraries don't keep everything forever. If the same advertiser appears in more than one library, compare them, because they don't all show the same details.

• Meta Ad Library: ads on Facebook and Instagram. The EU's Digital Services Act requires very large platforms to keep ads in a public repository "until one year after the advertisement was presented for the last time". Page transparency shows creation dates, name changes and admin countries.

• Google Ads Transparency Center: ads by advertiser or website across Google.

• TikTok Commercial Content Library: ads shown on TikTok.

• Telegram public preview: add /s/ to a public channel's address (t.me/s/channelname) to read its posts in a browser.
  

Sanctions and companies

Sanctions databases show whether a person, company or outlet is officially listed.

Before you write that someone is "sanctioned", check that they are on an official list. A sanctions database tells you who has been listed, by which government, and when, so you can separate a provable claim from one that only sounds right. Search the name, then open any match to see which list it comes from.

• OpenSanctions: searches sanctions lists and other official datasets in one place. In our test, it found the Internet Research Agency, the Russian troll farm sanctioned by the US, the EU and the UK.
  

How to choose OSINT tools

Pick tools based on the question you need to answer, not the length of the list.

There is no single best OSINT tool, only the right tool for the question in front of you. Before you open anything, decide what you need to find out: where a photo was taken, who runs a website, who paid for an ad. That question points you to a short list of tools, and the habits below help you use them well.

• Start free: the tools above cover most first checks; paid tools add history and scale, such as larger archives or cross-platform analysis.

• Use two sources for every finding: archives, image search and domain data can be wrong or incomplete.

• Mind your own safety: use separate research accounts and devices, keep research browsing apart from your personal logins, and don't open suspicious files.

• Stay legal and ethical: use public information only: no hacking, no leaked data, no fake identities to get into closed groups. Public data about people can still be protected by data-protection law (GDPR), so collect only what you need. If a step feels like a grey area, stop and check your organisation's rules.

See a real OSINT case: the Sprinter network on X.

Where to go next

• Run a full investigation: OSINT investigation techniques takes you from a clear question to a sourced report, step by step.

• Find out who is behind a website: how to find who owns a website shows how to combine the domain tools above.

• Check a suspicious image or video: how to spot AI images and deepfakes explains what to look for.

FIMI 101 is a 10-hour, self-paced online course with the skills and practical tools to recognise, analyse and counter FIMI campaigns.

FAQ

What are OSINT tools? Free or paid services that help investigators find, preserve and verify publicly available information, such as archives, reverse image search, domain lookups and ad libraries.

What is the best OSINT tool? There isn't one: the best tool depends on the question. For disinformation work, an archive (Wayback Machine), a reverse image search (Google Lens) and a domain tool (crt.sh or ICANN Lookup) cover most first checks.

Can I do OSINT for free? Yes. All 19 tools in our tested list work without a paid plan for the uses described here.

Which OSINT tools can find a person? We didn't test people-search tools, and we don't use them on private individuals: searching for private people raises data-protection (GDPR) issues. In disinformation work, legitimate checks focus on accounts and organisations: whether a username appears on other platforms (tools such as WhatsMyName, not tested by us), who runs a page (ad-library page transparency), and what a site said in the past (archives).

Can AI tools help with OSINT? AI chatbots can help translate and summarise material, but treat what they produce as a lead to check, not a finding: confirm every name, date and number in a primary source before you use it.

Is using OSINT tools legal? Generally yes, when you use publicly available information and respect the tools' terms and data-protection law. This is general information, not legal advice.

What is the difference between OSINT tools and OSINT techniques? Tools are the services; techniques are how you use them in an investigation. See our guide to OSINT investigation techniques.

Note: The tools were tested on 23 October 2026. Each tool was used on a real query (no account, no upload). Free tiers and features change; we re-test this list when we update the page. For a wider catalogue, see the EEAS's OSINT Guidelines (November 2024), written with EU DisinfoLab, which include a catalogue of OSINT tools for investigating identity-based disinformation and FIMI.

Get our new analysis by email

We'll tell you when we publish a new article, with a short summary, and invite you to upcoming Debunk.org events.