Free OSINT Tools That Survive Contact With a Real Investigation

Every six months someone posts "the 50 best OSINT tools" and gets thousands of upvotes. Every six months someone opens that list, clicks twelve links, signs up for three free tiers, and learns nothing. The tool list isn't the problem. The absence of a stack is.

Here is the free stack I actually run, in the order it matters.

Layer 1: Collection (free, public web)

• t.me/s/<channel> — Telegram web preview. Last ~20 posts as HTML, subscriber count, view counts, forward chains. No login. (Full walkthrough: https://dev.to/yuhehe/telegram-viewer-in-your-browser-reading-public-channels-without-the-app-and-what-builders-can-do-114k.)
• Certificate transparency logs (crt.sh) — subdomain discovery for org recon, free and boring and reliable.
• GitHub code search — leaked config files, internal hostnames, forgotten admin panels. Free.
• Archive.org + archive.today — the "what did this page say last month" layer. Free.
• Google dorks (site:, intitle:, inurl:) — fifteen years old, still finding dashboards.

Layer 2: Processing (free, your machine)

• requests + re (yes, really) — for public previews, a 20-line Python loop beats a framework. Example collector: https://dev.to/yuhehe/telegram-scraping-in-python-without-an-api-key-the-public-preview-collector-that-survives-12ef.
• SQLite — every collector needs a store; SQLite is zero-ops and every language speaks it.
• git for datasets — raw snapshots committed on a timer. Auditable, diffable, free.

Layer 3: Analysis (free, your brain, structured)

• Baselines before alerts: 30 days of a channel's normal posting volume, then alert on z-scores, not vibes.
• Wording diffs: for advisories and filings, the changed sentence is the news.
• Corroboration rule: two independent public sources, provenance logged, or it's a rumor.

The honest list of what free does NOT do

Historical archives of ephemeral platforms, private groups, bulk media, entity graphs at scale, SLAs. Vendors charging for those are selling real things; make them show the collection layer first (ask where the data enters their system — the answer tells you if you're buying data or a UI on top of your own free layer).

The purchase order I'd hand a new analyst

Week 1: collection loop for 10 channels, raw HTML to disk. Week 2: baselines + subscriber time series. Week 3: wording-diff alerts on one document stream. Week 4: a one-page report someone non-technical acts on. Tools serve that order; buy nothing that doesn't slot into it.

I package the collection-layer recipes (cadence design, cursor paging for backfill, repost-ring flags, storage discipline) as a $5 bundle: https://heyuhe.gumroad.com/l/poddr. A real sample brief — a 48-hour read of a live channel with the flags applied — is free, pay what you want, $0 fine: https://heyuhe.gumroad.com/l/ruldgm.

Skip the 50-tool list. Build the stack.