How to find anyone's email address: 8 methods that actually work

Sending to the wrong email address isn't just a waste of time — it actively hurts you. Generic addresses like info@ or contact@ almost never get replies. Emails to wrong people get ignored or marked as spam. And invalid addresses cause bounces that damage your sender reputation.

The data is clear: emails sent to the right person at their direct address get 3-5x higher reply rates than emails sent to generic addresses. When you're running cold email for sales, that's the difference between a pipeline that works and one that doesn't.

LinkedIn is the most obvious starting point and often the most effective. Many professionals list their email address directly on their profile, especially if they're in sales, marketing, or business development.

Most companies use a consistent email format. If you know one person's email at a company, you can guess the pattern for everyone else. About 90% of companies use one of just 7 common patterns.

To find a company's pattern, look for any publicly available email from that company — on their website, in press releases, on GitHub, or in regulatory filings. Once you have one example, apply the same pattern to your prospect's name. Always verify the guessed email before sending to avoid bounces that hurt your deliverability.

It sounds basic, but many companies publish team email addresses on their website. Check these places:

• About / Team page: Smaller companies often list email addresses next to team member photos
• Contact page: May have individual department emails that reveal the company's naming pattern
• Blog author bios: Blog posts often include the author's email for press inquiries
• Press / Media page: PR contacts are almost always published with direct email addresses
• Job postings: Sometimes include a hiring manager's email for applications
• Privacy policy / Legal pages: Required to list a data protection officer email in many jurisdictions

Google indexes an enormous amount of publicly available email addresses. With the right search operators, you can find emails that aren't easily visible through normal browsing.

This technique works especially well for executives who speak at conferences, publish research, or contribute to industry publications. Their email often appears in speaker bios, PDFs, whitepapers, and regulatory filings.

When you need to find emails at scale — hundreds or thousands of contacts — manual methods don't cut it. Email enrichment tools automate the process by cross-referencing multiple data sources.

These tools typically work by searching their own database of verified business emails, crawling public sources, and using pattern matching to find the most likely email for a given name + company combination.

The advantage of an integrated solution like Beeving's contact management is that found emails are automatically verified and scored before they enter your campaigns. This eliminates the bounce risk that comes with unverified third-party data.

Tech founders, developers, and startup people often share their email more freely on Twitter/X and GitHub than on LinkedIn.

• Twitter/X bio: Many founders and VPs include their email directly in their bio or pinned tweet
• GitHub profile: Developers frequently have their work email in their GitHub profile or in their git commit history
• GitHub commits: Every git commit contains an email address. Check the commit history of someone's public repositories
• Product Hunt: Makers who launch products often have their email visible on their Product Hunt profile

An email permutator takes a person's first name, last name, and company domain, then generates all possible email combinations. You then run the list through a verification tool to find which one is valid.

This is a brute-force approach, but it works surprisingly well. If you know someone's name is "Jane Smith" and they work at "acme.com", a permutator generates:

Run these through a verification service and you'll typically get exactly one valid result. Never send to unverified permutations — sending to multiple guesses will spike your bounce rate and look like spam.

The most underrated method. If you can reach someone through another channel — LinkedIn DM, Twitter reply, a mutual connection, or even a phone call to the company — simply ask for their email.

This works especially well for high-value prospects where you want a warm introduction. A quick LinkedIn message like "I'd love to send you something about [specific topic]. What's the best email to reach you?" is direct, respectful, and effective. People who respond are already semi-qualified — they've shown interest by sharing their contact info.

For tips on crafting effective outreach messages through any channel, see our guide on how to write a cold email.

No matter which method you use, always verify emails before sending. This is the single most important step in the process. An unverified email is a potential bounce, and bounces destroy your domain reputation.

Finding someone's email is legal. Spamming them is not. Here's how to stay on the right side of the law and professional ethics:

Under GDPR, B2B cold email is generally permitted under the "legitimate interest" legal basis, provided your message is relevant to the recipient's professional role and you offer a clear opt-out. CAN-SPAM (US) requires accurate sender info, a physical address, and an unsubscribe mechanism. Always err on the side of respect — a great cold email template provides value, not annoyance.

For a deeper understanding of how cold email fits into the legal landscape, read our complete beginner's guide to cold email.