Methodology

OSINT.dev connects public observations to their sources. It helps organize an investigation; it does not turn a partial set of records into a definitive conclusion.

Know what a check contacts

Some checks query public datasets or third-party APIs. Others make limited requests to the target itself, such as an HTTP request or TLS connection. Read the tool description and acknowledge any required authorization before running a sensitive check. Public availability alone does not establish permission for every use.

Read progress and results separately

An investigation can finish with partial results. Checks may be blocked by access rules, usage limits or provider availability, or fail independently. The workspace distinguishes execution status from how many planned checks returned usable observations. Completing all planned checks does not mean all relevant sources were searched.

Keep source and time together

Investigation evidence includes source or tool context and collection times. Where a provider supplies an observation date, that date has a different meaning from retrieval time. For Wayback Machine, the capture timestamp describes the archived page; retrieval time describes when OSINT.dev queried the archive index.

Preserve uncertainty

• A shared name, username or contact pattern is a lead, not proof that two records describe the same person.
• Email checks provide address and domain context, not proof of a mailbox or its owner.
• Phone numbering information does not identify a subscriber or locate a device.
• Company records and registry contacts need source-specific interpretation; a registry contact is not automatically a verified company.
• Network routing observations and archived pages describe the coverage of their sources at particular times.
• Missing results can reflect missing data or a failed query, rather than the absence of a fact.

Use bounded searches and verify conclusions

Checks have provider-specific request, result and usage limits. Inspect warnings and truncation notices before treating output as complete. Revisit original sources and corroborate important findings with independent evidence. Never submit passwords, private tokens or confidential material as investigation targets.