How to Find Someone’s Email Address on LinkedIn (2026 Guide)

Key Takeaways

To find someone’s email address for outreach, start with their LinkedIn profile’s Contact Info section, then try the first-name pattern for their company domain (most companies use one consistent format), and verify any guess with a free email-verification tool before sending.

For scale, a LinkedIn-focused prospecting tool can pull verified emails directly from search results or Sales Navigator lists.

How to Find Someone’s Email Address on LinkedIn (2026 Guide)

Sometimes the only thing standing between you and a reply is your prospect’s email address, and if you found them on LinkedIn, you’re already most of the way there.

This guide covers how to find someone’s email on LinkedIn specifically: the free manual methods, how to verify a guess before you send, and how to automate the whole thing once you’re past a handful of leads.

You can find emails manually or automatically, and both are covered below. For under ten specific people, doing it manually is usually faster. But for a list of 100+ leads, dedicated software undoubtedly wins.

Here’s what we’ll cover:

• How to prepare for cold outreach before finding someone’s email address
• 5 ways to find someone’s email online for free
• How to find their email from their LinkedIn profile
• 4 tools that automate finding someone’s email
• How to validate an email address before outreach
• Is it legal to find someone’s email address?

How to prepare for cold outreach before finding someone’s email address

Before you go hunting for an address, get two things straight: who you’re targeting and what you’ll send. Finding the email is the easy part if the rest is ready.

1. Warm up your sending account

Skip this only if you’re sending a handful of emails by hand. At any real volume, it matters.

Email warmup means building a sending reputation for your account so your daily limit and inbox placement improve over time. Individual Gmail accounts cap at 500 emails per 24 hours, and hitting that ceiling cold (with no reputation behind the domain) is how you land in spam.

To send reliably at volume, authenticate your domain’s DKIM, SPF, and DMARC records first, then use a warmup tool that sends and receives low-volume email on your behalf to establish activity Gmail reads as legitimate.

Our email warmup guide walks through the full setup.

2. Know where your target audience lives

If you already have a point of contact, like a LinkedIn profile, a personal or company website, finding the email gets much easier, because you have the two inputs every method below needs: a name and a domain.

LinkedIn’s standard search works for this, and Sales Navigator gives you tighter filtering. Boolean operators sharpen either one:

• Quoted search — wrap a phrase in quotation marks for an exact match, e.g. “LinkedIn marketer” for that specific multi-word title.
• NOT — exclude a term, e.g. sales NOT manager.
• OR — match any item in a list, e.g. sales OR marketing OR advertising.
• AND — match every item, e.g. accountant AND finance AND CPA.

Once you’ve built a target list this way, you can automate outreach to it directly — our guide to LinkedIn message automation covers connecting with a filtered list on autopilot.

3. Have the email ready before you find the address

Knowing the address does nothing if you don’t know what to write.

The right message depends entirely on your goal, so start from a proven structure rather than a blank page — our cold message templates give you a starting point per objective.

One approach worth testing: send the cold email first, then follow up on LinkedIn, or the reverse. Running both channels against the same prospect is covered later in this guide.

5 ways to find someone’s email online for free

You might go manual because you don’t want to pay for software, you only need a few specific people, or it’s simply faster for a short list. Here are five methods, roughly in order of speed and reliability.

1. Make an educated guess based on the company’s email pattern

The simplest free way to find someone’s email address is to guess their email from the company’s standard format using the person’s name and domain. 

Most companies use one consistent pattern, most often [email protected]. If you know a lead’s first name, last name, and web domain, you can usually reconstruct it.

Common patterns include:

• [email protected]
• [email protected]
• [email protected]
• [email protected]

Confirm your guess with an email-verification tool (covered below), or paste it into Gmail. If it’s a Google-hosted address, you’ll often see the person’s profile photo and name, which tells you the guess is live. That last trick only works on Gmail-hosted addresses.

Best for: When you know the person’s name and where they work, but have no tool. If a name is all you have to start with, identify where the person works first (their LinkedIn profile or a quick company search will tell you), then apply the company’s pattern to their name.

2. Find their email on LinkedIn

The next free method you can try is to pull a publicly listed email straight from the person’s LinkedIn profile. 

Sometimes the address is out in the open. Click Contact info on the person’s LinkedIn profile and you may find their email, website, and other links. It isn’t always there, but it’s the first place to check.

Their LinkedIn About section, a linked company page, or other public profiles can carry the same information, so it’s worth a second look before moving on. There’s a dedicated walkthrough of this below, since it’s the method most people come to this guide for.

Best for: Reaching a few specific people you found on LinkedIn.

3. Use advanced Google searches

You can use search engines to surface an email the person has published somewhere public. 

If someone has published their email anywhere, Google can find it. Wrapping a query in quotation marks forces an exact match — searching “LinkedIn template” returns only pages containing that exact phrase.

Combine the person’s name with their likely domain, or with terms like “email” or contact, to surface press pages, podcast show notes, and guest-post bylines where people routinely list an address. A single podcast appearance is often enough to turn up a publicly listed email.

Best for: Prospects who’ve been on podcasts, guest posts, or press.

4. Search their public posts

You can search through someone’s public posts across platforms for an email they’ve shared. 

People sometimes share their email in a public post: in a LinkedIn comment, on X, or in a forum thread. Searching their post history can surface it.

On X, the advanced search operator from:@handle “email” still pulls older posts where someone shared contact info, though results are less reliable than they once were.

For example, from:@joelgascoigne “email” searches Buffer’s founder’s posts for the word email.

Treat this as a fallback for when the higher-confidence methods above have already failed.

Best for: A last resort when the higher-confidence methods come up empty.

5. Use automated guessing to find every combination

Lastly, you can try generating every plausible email permutation from a name and domain, then verifying. 

When method #1 doesn’t land, a free tool Email Permutator generates every plausible combination from:

• First name
• Last name
• Middle name (optional)
• Domain

Enter the details, hit Permutate, and you’ll get a full list of candidate addresses. From there, run them through an email-verification tool (below) or use the Gmail profile-photo check from method #1 to spot the live one.

For anything beyond a few names, a tool that takes a domain and returns the associated emails is faster than working through permutations by hand — which is what the next section covers.

Best for: When the standard pattern guess fails and you want to test all variants at once.

How to Find Someone’s Email From Their LinkedIn Profile

You can often get someone’s email straight from LinkedIn. If they’ve added it to their Contact info section, it’s visible to their connections and sometimes to anyone. If it isn’t listed, their name and company give you everything you need to work out the address another way.

Here’s the order to work through:

1. Contact info. Open the person’s LinkedIn profile and click Contact info near their name. If they’ve made their email public, it’s listed here alongside their website and other links.
2. About and Featured sections. People often put a work email in their About summary, or a “book a call” link that resolves to one.
3. Their posts and comments. Founders and creators frequently post “email me at…” in a comment or a lead-magnet post. Search their activity for the word email.
4. If it’s not on LinkedIn. Note their full name and company, then use the domain-pattern method from the section above; the profile gives you both inputs you need to guess and verify.

Once you have the address, the next step is writing something worth opening. Here’s a sample email to approach a new client to model the first message on.

Pro tip: Working backwards & finding a profile from an emailEverything above goes name-to-email, but the reverse works too. If you’re starting from an email address and want the person behind it, paste it into LinkedIn’s search bar to surface a matching profile, or drop it into Gmail to reveal a linked Google profile photo and name, then search that name on LinkedIn.

4 Tools That Automate Finding Someone’s Email

There are free and paid tools that find an email from a name and domain, and several let you launch an outreach campaign straight after. For finding contact info at scale, any of the four below will do the job. Listed in no particular order.

1. Hunter.io

Hunter.io is one of the longest-running email finders, around since 2015. It’s built around Domain Search: enter a company domain and it returns the email addresses and patterns associated with it. Hunter also bundles a cold-email sequencing tool, so you can find, verify, and send from one place. It does one thing well: find professional email addresses by company domain.

Who it’s for: SDRs, founders, and small teams who’ve already identified who they want to reach and need a verified address fast.

Top features: Domain Search, Email Finder, Email Verifier, bundled cold-email Sequences, AI Writing Assistant, browser extension, Google Sheets add-on, and a developer API. All paid plans include unlimited team members with no per-seat fee.

Pricing in 2026:

• Free — $0, 50 credits/month, 1 email account
• Starter — $34/mo annual ($49 monthly), 2,000 credits/month, 3 email accounts
• Growth — $104/mo annual ($149 monthly), 10,000 credits/month, 10 email accounts
• Scale — $209/mo annual ($299 monthly), 25,000 credits/month, 20 email accounts
• Enterprise — custom

2. GetProspect

GetProspect is a LinkedIn-first email finder paired with a large B2B database. Its Chrome extension pulls verified emails, phone numbers, job titles, and company data straight from LinkedIn profiles, Sales Navigator searches, and company pages.

Who it’s for: SDRs and sales teams who prospect primarily from LinkedIn and want reliable email export at volume.

Top features: LinkedIn email-finder Chrome extension (export up to 2,500 leads at once), 17+ search filters (job title, seniority, industry, revenue, tech stack), bulk email finding, data enrichment, built-in CRM, and native integrations with HubSpot, Salesforce, Pipedrive, and Google Sheets. All plans include unlimited users through workspace sharing.

Pricing (2026):

• Free — $0, 50 valid emails + 100 verifications/month
• Starter — $49/mo (~$34 annual), 1,000 valid emails, 2,000 verifications, 5 phone numbers
• Growth 5k — $99/mo (~$69 annual), 5,000 valid emails, 10,000 verifications, 5 phone numbers
• Growth 20k — $199/mo (~$139 annual), 20,000 valid emails, ~40,000 verifications
• Growth 50k — $399/mo (~$279 annual), 50,000 valid emails, ~100,000 verifications

3. Snov.io

Snov.io is an all-in-one outreach platform covering email finding, verification, drip campaigns, warm-up, and a built-in CRM. Email finding, verification, campaigns, warm-up, and CRM all live under one roof: the breadth is its selling point.

Who it’s for: Sales teams and marketers who want their finder and their sending engine in the same place, with a heavier emphasis on running outreach campaigns than on raw database size.

Top features: Email Finder and Verifier, multi-step drip campaigns with conditional logic based on opens/clicks/replies, free email warm-up on all plans, campaign tracking, browser extension, and a sales CRM. All paid plans include unlimited team seats, and warm-up is bundled free where competitors charge separately.

Pricing (2026):

• Trial — $0, 50 credits, 100 recipients, 1 warm-up slot
• Starter — $39/mo ($29.25 annual), 1,000 credits, 5,000 recipients, 3 warm-up slots
• Pro S — ~$74/mo annual, 5,000 credits, 25,000 recipients
• Pro M / Pro L / Pro Ultra — scaling up to 100,000 credits with unlimited recipients
• Custom Ultra — custom pricing, 200,000+ credits, unlimited seats

4. FindThatLead

FindThatLead  A B2B lead-gen platform that bundles an email finder, verifier, a Prospector for building lists by criteria, and a cold-email Sender in one subscription. One subscription, one login, one billing line: email finding, verification, list building, and cold email all in one tool.

Who it’s for: Solo founders and small agencies that would rather not stitch four vendors together; the appeal is bundling and a low entry price rather than best-in-class data depth.

Top features: Email finder and verifier, Prospector (search by company, domain, industry, job title, location, or keyword), bulk processing, cold-email Sender with drip sequences, and a built-in CRM. Integrates with HubSpot, Pipedrive, Salesforce, Salesflare, and Zapier.

Pricing (2026):

• Free trial — $0, 7 days, capped at 20 successful emails, no card required
• Growth — $49/mo, 5,000 monthly credits, 1 user, 2 campaign accounts, up to 400 daily emails
• Startup — $150/mo, 18,000 monthly credits, 4 users, 4 campaign accounts, up to 500 daily emails
• Suite — $399/mo, 30,000 monthly credits, 6 users, 10 campaign accounts, up to 750 daily emails

For choosing a tool for email specifically, our guide to AI for email marketing goes deeper on what to weigh.

How to validate an email address before cold outreach

There’s nothing worse than writing the perfect cold email and sending it to an address that bounces. Whether you’re running a full automated sequence or sending a few messages by hand, verify the address first.

Any of the tools above will verify addresses, and standalone email verifiers work too. Most outreach tools include verification, and most let you check up to 50 addresses free.

The process is simple: enter an address in the tool, or upload a spreadsheet of them. Keep in mind that most free verifiers cap the number of checks and often don’t accept spreadsheet uploads, so for a large list you’ll want a paid tier or a tool with verification built into the sending workflow.

Cleaning the list before you send protects the sender reputation you spent time warming up.

How to automate LinkedIn & email outreach

Email alone competes with everything else in a crowded inbox — a prospect in B2B or sales can field dozens of cold emails a day.

Reaching the same person across more than one channel gives you more chances to land, which is the logic behind running LinkedIn and email together instead of leaning on either one on its own.

This is where a LinkedIn-focused outreach tool earns its place. In Expandi, you build the sequence in Smart Sequences, combining up to 10 actions and 10 conditions that branch based on how each prospect behaves.

A connection request, a LinkedIn message, an email follow-up, and an InMail step all live in the same flow, so the campaign reacts to what the prospect actually does rather than firing every step blindly.

A typical multichannel sequence looks like this:

1. Connect on LinkedIn. Send a personalized connection request.
2. Condition: did they accept? If yes, continue on LinkedIn. If not, the sequence branches.
3. Follow up by email. Connect any email provider in Expandi and add an email step to reach prospects who didn’t accept, or to reinforce those who did. Email follow-ups are built to lift open rates on the second touch.
4. InMail as a fallback. For prospects who still haven’t engaged, an InMail step reaches them without a connection in place.

You can run the order either way: LinkedIn first with an email follow-up, or email first moving into LinkedIn. The flow visualization shows where prospects drop off at each step, so you can fix the weak points instead of guessing.

One thing that separates this from generic sequencing: Expandi can trigger outreach from social signals (a profile view, a post engagement, a comment) so the first touch lands on someone who’s already shown interest rather than a cold name on a list.

That’s the difference between outreach that reads as spam and outreach that reads as a timely follow-up.

Want to build a sequence like this yourself? Start a free, 7-day Expandi trial and launch your first LinkedIn and email campaign.

Frequently Asked Questions