How to find someone's email address — 7 real methods

Finding an email address is half the job. The other half — the half most guides skip — is confirming the address is real before you send to it. A found-but-dead address still counts as a bounce, and bounces wreck the sender reputation that decides whether your future mail lands. So every method below ends the same way: verify what you find. Here are seven that actually work.

Google search operators (dorks) — practical examples

Search operators turn Google into a targeted email finder. They surface addresses that are published somewhere on the open web but not indexed under a tidy "contact" heading.

"john smith" "@company.com"
"john smith" email site:linkedin.com
"marketing manager" "@gmail.com" site:company.com
intext:"@company.com" filetype:pdf

Put the exact phrase in quotes, combine a name with a known domain, and narrow by site: or filetype:. Conference pages, team directories and PDF attendee lists are rich sources that a plain search misses. This is method one because it costs nothing and works for almost any target.

Check GitHub, LinkedIn and social profiles

Developers and technical people frequently expose a public email on GitHub — in the profile, or in the author field of their commits. LinkedIn rarely shows the address directly, but the person's role and company give you the domain and the naming pattern to work with. Twitter/X bios, personal sites and Behance portfolios round out the picture.

• GitHub — profile email, or git log author addresses on their repos.
• LinkedIn — confirms name, role and company (the inputs for a permutation guess).
• Personal site / portfolio — often a direct hello@ or contact@.

Guess-and-verify permutations

Most companies use one predictable pattern. Once you know a person's name and the domain, you can generate the handful of likely addresses and test them:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Don't send to all of them to see which sticks — that's five potential bounces. Run each through a verifier instead, and mail only the one that comes back valid. This is where finding and checking become the same workflow.

Use an email finder tool

Dedicated finders (Hunter, Apollo and similar) automate the permutation-and-verify loop for a single contact, usually on a monthly subscription. They're convenient for one-at-a-time prospecting. The trade-off is cost per lookup and a plan you pay for whether or not you use it — which is exactly the gap a pay-per-use approach fills.

Collect in bulk by niche

Manual methods don't scale past a handful of contacts. When you need a segment — every developer in a country, every creator in a niche — you need bulk collection from public sources. CharlyMail pulls addresses from GitHub, npm, PyPI, Hacker News, Reddit, Instagram, TikTok, Behance and Google or Bing search-operator queries, filtered by country, provider, gender or keyword during collection so you spend only on the segment you want.

What the filters actually do

Raw scraping produces noise — disposable domains, role addresses like info@, people in markets you can't service. Filtering during collection, not after, means you don't pay to collect addresses you'll immediately discard:

• Country — 40+ regions, so you only pull the geography you can act on.
• Provider — Gmail, Outlook, corporate; exclude what your sending setup handles poorly.
• Domain type — corporate for B2B, personal for B2C.
• Keyword / niche — scope the search to the segment you actually want.

Because the parser skips duplicates you already own for free and keeps collecting until it hits the number of genuinely new addresses you asked for, you end up paying for fresh leads only.

Sign-up and outreach loops

The addresses people give you willingly are the highest-quality ones you'll ever have. A gated resource, a newsletter, or a simple "reply to connect" in existing outreach builds a list of people who chose to hear from you. It's slower than scraping, but these addresses bounce least and convert most — worth running alongside the faster methods.

Whichever mix of the seven methods you use, treat the output the same way: candidates first, confirmed addresses only after verification. The next section is why that step is non-negotiable.

Always verify what you find

Every method above produces candidates, not confirmed addresses. Before a single send, run the list through validation: syntax, MX record, disposable-domain and role-address checks, and an optional deep SMTP check that confirms the mailbox without delivering anything. Skipping this is how good outreach turns into a blocklisted domain — see how to check an email without sending for the full method.

Frequently asked questions