What Can Someone Discover About You Using Only Free OSINT Tools?

I tried looking at online privacy from an investigator's point of view. Here's how you can audit your own digital footprint without paying for expensive tools. Most of us share pieces of our lives online without thinking too much about them.

A photo from a family event. A LinkedIn profile showing where we work. An old username used on different websites. A birthday post. A picture taken outside an office, university, café, or home. Individually, these things may seem harmless. But what happens when someone puts all those pieces together?

That is where OSINT Open-Source Intelligence becomes interesting.

OSINT is the process of collecting and analyzing information from publicly available sources. Cybersecurity professionals, journalists, researchers, and investigators use it for legitimate purposes. Unfortunately, the same techniques can also be misused for stalking, social engineering, phishing, and other forms of abuse.

I find this especially interesting from a cybersecurity perspective because protecting an account is not always the same as protecting your privacy. Your account might have a strong password and two-factor authentication, yet you may still be sharing more information publicly than you realize. So, instead of just discussing OSINT theory, let's perform a simple experiment.

How much can you discover about yourself using only free tools and information you have permission to examine?

First, understand what OSINT can reveal

Imagine someone wants to learn more about a person before sending them a targeted phishing email. They may not need to hack anything. They might begin with information the person has already shared publicly.

For example, a public profile could reveal their profession. A public post could mention the name of their university. An old account could use the same username as their current profile. A photograph might reveal a workplace logo or a recognizable location.

By connecting these details, someone could build a rough picture of that person's life. Depending on what is publicly available, an OSINT investigation might reveal:

• Identity clues: Names, nicknames, usernames, profile photographs, and aliases.
• Professional information: Job titles, employers, skills, colleagues, and public work history.
• Interests and routines: Hobbies, events attended, public check-ins, and recurring activities.
• Digital footprint: Old forum posts, public comments, forgotten accounts, and indexed pages.
• Potential security risks: Public contact information, exposed documents, overshared recovery clues, or information that could make a phishing message more convincing.

This does not mean every person can be fully identified or located through OSINT. Results vary, and some information may be outdated, inaccurate, or belong to someone with a similar name. The important point is that separate pieces of information can become more revealing when combined.

My practical experiment: auditing a digital footprint

For this exercise, use your own accounts. If you are working with another person, get their explicit permission and agree on what you can examine. You do not need to buy an OSINT subscription or install complicated software. A browser and a few free resources are enough to get started. I would approach the exercise like a small security assessment: define the scope, collect evidence, assess the risk, and recommend improvements.

Step 1: Search your own name

Start with an ordinary search engine. Search for your name in quotation marks, then try your name with your profession, public username, or organization.

For example, use fictional details such as:

• "Ayesha Khan"
• "Ayesha Khan" cybersecurity
• "ayesha_cyber"
• "Ayesha Khan" LinkedIn

These are examples, not searches you should run against a stranger. Open a private browsing window or sign out first if you want to reduce the influence of your logged-in account and personalized results. Search results can still vary by location and other factors.

What are you looking for?

Check whether your public profiles, old blog posts, comments, portfolios, or documents appear. Look for information you forgot you had published. You may discover that an old account is still visible even though you stopped using it years ago. Record the type of information found, the source, and whether you still want it to be public. You do not need to copy sensitive details into your notes.

Step 2: Check how widely you use the same username

Many people reuse one username across several platforms because it is easy to remember. That convenience can also make accounts easier to connect. Suppose your public Instagram username is ayesha_cyber, and you used the same handle on a coding forum several years ago. If both profiles are public, a visitor may be able to connect your social media activity with your technical interests.

You can check your own username manually on search engines and public websites. You can also explore WhatsMyName, a free username-search resource, while understanding that results need to be verified. Do not assume that a matching username proves two accounts belong to the same person. Someone else may use the same handle.

Privacy question: Does one username connect parts of your life that you would prefer to keep separate?

For example, perhaps you want your professional cybersecurity profile to remain separate from an old gaming account. If the same public username links them, consider using different handles for different audiences.

Step 3: Review your public social media profiles

This is one of the most useful parts of a privacy audit because you control much of the information being shared. Review your own Instagram, Facebook, TikTok, LinkedIn, X, or other accounts you use.

Look beyond the profile bio. Check old posts, public comments, tagged photographs, highlights, and the information visible to someone who does not follow you.

Ask yourself:

• Does my profile reveal my personal phone number or email address?
• Have I posted photographs showing documents, badges, tickets, or screens?
• Do my posts reveal my daily schedule or regular locations?
• Can someone identify my workplace, educational institution, or family members?
• Are old posts public even though I would not share the same information today?
• Can people find my profile using my phone number or email address?

You do not have to stop sharing personal content. The goal is to decide what you want to share, rather than letting old settings make the decision for you. Remember that privacy is not only about your own account. A friend may tag you in a public photograph or reveal your location in their post. It is worth reviewing tagged content and discussing privacy boundaries with people close to you.

Step 4: Check old email addresses and public documents

Email addresses can connect professional accounts, public profiles, newsletters, and older online identities. Start with email addresses you own. Search for them in a search engine to see whether they appear in public pages, old posts, or documents.

Do not enter your email password into an OSINT website. A public search should not require you to hand over account credentials. You can also search for your name alongside a file type, such as a PDF, to see whether public documents are indexed. For example, you might search for your name and filetype:pdf to review documents associated with your public professional identity.

This can help you find an old résumé, presentation, conference document, or portfolio file that contains more personal information than you intended to publish.

Important: Search only for your own information or information you are authorized to audit. Do not download, redistribute, or publicize another person's sensitive documents just because a search engine finds them. If you discover a document you control that exposes unnecessary personal details, remove it or replace it with a safer version. If someone else hosts it, contact the site owner about correcting or removing it.

Step 5: Look at your profile photograph

A profile photo can sometimes connect accounts that use different names. You can use a reverse-image search service, such as Google Lens, to check whether your own photograph appears on other public pages. Try this with a photograph you own and are comfortable uploading to the service. Review the provider's privacy information before submitting images.

Look for legitimate matches: an old public profile, an outdated portfolio, or a photograph reposted somewhere you did not expect. A matching image is a clue, not proof. Similar-looking images and unrelated copies can produce misleading results.

You should also review photographs for background details. A picture might unintentionally show a workplace badge, a screen with notifications, a street sign, or a document on a desk. You do not need sophisticated facial recognition software to notice these everyday privacy leaks.

Step 6: Understand what your public profile tells a stranger

Now connect the findings from your audit. Imagine your public profiles reveal that you:

• Work in a particular industry.
• Use a certain software platform.
• Attend a recurring professional event.
• Have a public work email address.
• Recently posted about a project or a new role.

None of these facts necessarily creates a serious risk on its own. Together, however, they could help someone write a convincing message pretending to be a colleague, recruiter, service provider, or event organizer.

For example, a scammer might use a public job announcement to send a fake recruitment message. Someone might imitate a known vendor or reference a real project to make a malicious attachment appear legitimate. This is one reason OSINT matters to defenders: it helps explain how attackers make social engineering feel personal and believable. The objective of this exercise is not to learn how to target people. It is to recognize what information could make you or your organization easier to manipulate.

Free resources you can use

You do not need every tool available online. Start with a few and understand their limitations.

1. Search engines

Use Google or another search engine to review your name, usernames, public profiles, and documents. Search operators can help narrow results, but they do not reveal everything on the internet.

2. WhatsMyName

A resource for checking whether a username may appear across public websites. Results require manual verification.

3. Google Lens

Useful for reviewing public appearances of your own images and identifying visually similar content. It cannot guarantee that every copy of an image will be found.

4. Google Results about you

Google offers a tool to monitor certain personal information in Search and request eligible removals. Availability and supported information can vary by region. Removing a result from Google Search does not automatically delete the original information from the website hosting it.

5. Electronic Frontier Foundation: Manage Your Digital Footprint

A useful guide for searching your own public footprint, reviewing social accounts, and thinking about how separate pieces of information can create risks.

Treat tools as aids, not sources of unquestionable truth. A result may be stale, misattributed, incomplete, or generated by a service that collects data of its own.

Turn the experiment into a privacy audit report

If you want to make this a practical cybersecurity project, document the results without exposing the person you audited. The risk levels are examples, not an automatic scoring system. Consider the sensitivity of the information, who can access it, how easily it can be combined with other details, and what harm could result.

For a portfolio project, you can use your own accounts, a fictional identity, or a consenting test subject. Describe the method, findings by category, limitations, and remediation steps. Redact names, email addresses, photographs, URLs that expose private information, and other identifying details before publishing screenshots.

A good privacy audit should demonstrate what you learned and how you reduced risk not how much personal information you can expose.

What should you do if you find too much information?

Do not panic or try to erase your entire digital presence overnight.

Start with the highest-risk findings.

1. Remove what you control. Delete or edit old posts, public documents, and profile details you no longer want to share.
2. Review account privacy. Check who can see your posts, find you through contact details, tag you, or access your profile information.
3. Reduce unnecessary connections. Consider separate usernames for personal and professional activities when that separation matters to you.
4. Secure your accounts. Use unique passwords, a password manager, and multifactor authentication. These controls will not erase your public footprint, but they help protect account access.
5. Request removals where appropriate. Contact the original website or use the search engine's eligible removal process. Remember that a search-result removal is not necessarily deletion at the source.
6. Be careful with future posts. Avoid sharing live location updates, travel plans before you return, or photographs containing private documents and account details.

The Electronic Frontier Foundation also recommends reviewing the privacy settings of social platforms and thinking about what information you want to make public.

Keep the exercise Ethical:

OSINT is based on publicly available information, but that does not mean every use of it is harmless or lawful.

For this experiment, stick to your own accounts or obtain clear consent from the person you are auditing. Define the scope before starting. Use public sources, avoid accessing private accounts or bypassing access controls, and do not publish someone's address, contact details, family information, or other sensitive findings.

If you are conducting an assessment for a company, get written authorization and follow the agreed scope. And if you discover sensitive information about someone else by accident, do not share it just to prove that you found it.

The purpose of privacy auditing is to help people understand and reduce exposure not to embarrass, intimidate, or target them.

Final thoughts

One thing I find valuable about OSINT is that it changes how we look at ordinary online activity.

A username is not just a username. A photograph is not always just a photograph. An old public document might reveal details we have completely forgotten about. The real risk often comes from the connections between these small pieces of information.

You do not need expensive tools to begin checking your digital footprint. Start with your name, your usernames, your public profiles, and your old posts. Record what you find, decide what should remain public, and take action where necessary.

As someone learning cybersecurity, I see privacy audits as a useful way to understand the information an attacker might use before attempting a more direct attack. It also reminds me that good security is not only about detecting malware or blocking suspicious traffic. Sometimes, it begins with asking a much simpler question:

What can someone learn about me that I never intended to tell them?

Try the audit on yourself first. You might be surprised by what you find and by how many risks you can reduce with a few careful changes.

Tags: Cybersecurity, OSINT, Online Privacy, Digital Safety, Information Security