Best OSINT Tools: The Free Stack That Does 80 Percent of Real Investigations

The honest answer to "what are the best OSINT tools?" is: the best tool is the one you check every day, and the free stack covers 80% of real investigations. The paid tools earn their price in the last 20% — at scale, with SLAs, and when someone has to be accountable for missing something.

The free layer I actually use weekly

• Web preview collectors (t.me/s/, forum previews, registries) — no keys, no accounts, plain HTML. This is where public monitoring starts, not where it ends.
• Certificate transparency logs (crt.sh) — infrastructure timelines: who a domain talked to, when, with what cert. Cheap, public, chronologically queryable.
• Code search (GitHub code search, grep.app) — leaked configs, internal tool names, employee handles. Public code is the loudest gossip in tech.
• Paste sites + leak aggregators — credential exposure monitoring for a domain. Watchlist, not dump-downloading; the compliance story is "alert," not "harvest."
• WHOIS/RDNS + historical DNS — registration patterns cluster infrastructure together. One registration email = a graph edge.
• The boring spreadsheet — entity resolution and provenance in a table beats a tool you'll re-learn every quarter.

Where paid tools genuinely pay

Historical depth (the free layer has no time machine), unified ingestion at scale, alerting you can page on, and audit trails for when a lawyer asks. If your budget is one decision: buy alerting before buying archives. A free source you check is worth ten archives you never open.

The buyer's checklist (any vendor demo)

1. Show me the change this produced in the last hour — not the dashboard.
2. What's the population? (Coverage claims without denominators are marketing.)
3. What does it miss? A tool that can't answer this has never been audited.
4. What's the export story? Data you can't leave with is rent, not ownership.

The path I'd hand a beginner

Start with the free layer: pick 10 public sources, poll them unattended, store raw, alert on deltas. Two weekends of work. Then price the gap you feel — history, scale, alerting — and buy exactly that gap. Builders who skip straight to paid subscriptions are paying for the part they'll never use.

I package the collection layer — polling cadence, cursor pagination, repost-ring flags, wording-diff alerting, raw-storage discipline — as a $5 playbook: https://heyuhe.gumroad.com/l/poddr. A real sample brief (flags and timelines applied to a live channel) is free, pay what you want, $0 fine: https://heyuhe.gumroad.com/l/ruldgm.