Email lookup

How to find someone's social media accounts by email

You have an email address and want to know which social accounts use it. Here's how to search for free without alerting anyone, what a match really proves, and where the law draws the line.

By Benicio Marcos Updated September 30, 2026 10 min read

What does searching social media by email actually find?

A social media search by email checks which platforms have an account registered with, or publicly linked to, a given address. It returns account names, profile links and sometimes a photo or display name. It answers "where is this address used?", which is a narrower question than "who owns this address?"

A reverse email lookup starts from the address and tries to put a name and a context on its owner, using breaches, domain records and message headers. This guide covers the other half: finding the social accounts that use the address, then deciding whether they belong to the person you think they do.

A careful search can surface:

Registrations: confirmation that an account exists on a site, even when the profile itself is private.
Public profiles that print the address, or that connect to it through a service such as Gravatar.
Handles that repeat the part of the address before the @, which often lead to more accounts.

What it won't give you: private messages, friend lists hidden by privacy settings, or a way into the account. A service that claims to show those is either misleading you or breaking the platforms' rules, and probably the law.

Illustrative example · masked data

Social accounts registeredInstagram, X, Pinterest
Profile photoGravatar match
Handle from the addressfound on 3 more sites
Password reset sent to ownernever

Type your own email address above and press Enter to run the same checks.

Why an email address still leads to social profiles

Nearly every social account is created with an email address or a phone number, and most people keep the same address for years. In 2025, 84% of US adults said they use YouTube, 71% Facebook and 50% Instagram (Pew Research Center). So one address often sits behind several accounts at once.

Platforms used to make the link easy, and it was abused. Meta says data from more than 530 million Facebook users was scraped before September 2019 through its contact importer, the feature that lets you upload an address book to find friends, and that it changed the feature once it saw the abuse (Meta). In 2022, Twitter disclosed that a code change from June 2021 let anyone enter an email address or phone number into the login flow and learn which account it belonged to. It was fixed in January 2022 after a bug bounty report (Twitter Privacy Center).

Direct email-to-profile search is now limited and mostly up to the account owner. On Facebook, a setting controls who Facebook can suggest your profile to based on your email address or phone number. The default is "Possible connections", and users can switch it to "No one" (Facebook Help Center). An email can still surface a profile, just not reliably, and never for someone who has opted out.

The same reach is why scammers like social platforms. People reported losing $2.1 billion to scams that started on social media in 2025, more than through any other contact method, and nearly 30% of people who lost money to a scam said it started there (FTC). If you're checking an account that reached out to you, our guide to finding out who is behind a fake profile picks up where this one stops.

US adults who use each platform, 2025Share of US adults

Platform	Share of US adults
YouTube	84%
Facebook	71%
Instagram	50%

Source: Pew Research Center, Social Media Fact Sheet (November 20, 2025)

How to find social media accounts by email for free

Start with checks that are free and passive, meaning nothing reaches the owner of the address. Work in this order, because each step hands you names and handles for the next one. Keep the URL and the date of every finding. You'll need that trail when you try to confirm a match later.

Passive checks: search, username, Gravatar

Search the exact address in quotes. Put the full address in quotes on Google and Bing, for example "[email protected]". Public profiles, forum posts, résumés and old club pages sometimes print an address in full. Repeat the search with site:linkedin.com, site:facebook.com or site:github.com to narrow it down.
Pivot on the username. Take the part before the @ (jane.doe87) and search it on its own, with and without the dot. People reuse handles for a long time. The open-source tool Sherlock checks one username across more than 400 social networks from the command line (Sherlock). Treat a matching handle as a lead only: common handles collide all the time.
Check Gravatar. Gravatar attaches a photo and a public profile to an email address and has more than 80 million profiles (Gravatar). It identifies each address by a SHA-256 hash of the trimmed, lowercased address. In a terminal, run echo -n "[email protected]" | shasum -a 256, then open https://gravatar.com/avatar/HASH?d=404 with the result in place of HASH. A picture means the address has a Gravatar account; an error means it doesn't. A public profile can also list social accounts its owner has verified.

Registration and contact checks

Save the address as a contact on your own phone. Some messaging and social apps show which of your contacts have accounts, if the owner left that discovery setting on. Add the address to a test contact and see which apps suggest a profile, then delete the contact. Phone numbers work the same way, and our reverse phone lookup guide covers that route.
Run a registration check. Holehe is a free Python tool (pip3 install holehe) that checks whether an address is registered on Twitter, Instagram, Imgur and more than 120 other sites. It reads how each site's forgotten-password function responds, and its README states that it does not alert the target email (Holehe). The output says "registered" or "not registered". It doesn't tell you which profile it is.
Open what you found and compare. Line up photos, display names, locations, bios and linked accounts across everything you collected. If nothing lines up, stop. Record it as unconfirmed.

Don't type the address into "forgot password" forms. It's a popular shortcut for checking whether an account exists, and it's the method most likely to reach the owner. Facebook, for example, sends the account owner a reset email and tells people who receive one they didn't ask for that someone has probably entered their email or username (Facebook Help Center). It worries someone who may have done nothing wrong, and it leaves your attempt on their side.

Which free method finds which social accounts?

Each free method answers a different question. Search engines and Gravatar show public profiles. Registration checks confirm an account exists but not what it looks like. Username pivots find accounts that may never have used the address at all. Combine at least two methods before you draw any conclusion about a person.

Method	What it finds	Skill needed	Alerts the owner?
Exact-match search	Public pages that print the address	None	No
Username pivot (Sherlock)	Accounts that share the handle, even under other emails	Command line	No
Gravatar	Photo, public profile, verified accounts	Basic terminal	No
Contact sync	Profiles on apps where the owner left discovery on	None	Depends on the app
Holehe	Sites where the address is registered	Python	No, per its README
"Forgot password" forms	Whether one site knows the address	None	Often yes
Rocksosint	Registrations and public profiles from 200+ open sources, each linked to where it was found	None	No

The difference between manual and automated searches is coverage. By hand, you check a dozen sites for one address in the time a tool checks hundreds. Someone still has to read the results and decide what they mean.

What does an email match on social media prove?

A registration proves that someone created an account with the address. It doesn't prove that the owner of the address created it, still uses it, or is the person you're looking for. Treat every result as a lead until two independent sources point to the same person.

Why a registration isn't an identity

Many sites don't verify the email at signup, so anyone can open an account with someone else's address. Old accounts stay up for years after their owners walk away. And a matching handle on a second site may belong to a stranger who had the same idea.

How to confirm a match

Find two sources that don't depend on each other. A LinkedIn profile and a Gravatar profile with the same face is strong. Two scraper sites that copied the same bio is one source counted twice.
Look for links the owner made. A profile that lists its own website, another handle or a verified account ties the pieces together better than any outside tool can.
Check the dates. An account last active in 2015 tells you about 2015. Give recent activity more weight.
Write down what doesn't fit. A different city, an age that's off by twenty years, a photo that also appears on a stock image site. Any one of them is grounds to drop the match.

If you can't get two independent confirmations, record the result as unconfirmed and don't act on it. Contacting or accusing the wrong person causes real harm, and it's the most common way these searches go wrong.

Is it legal to find social media accounts by email?

Searching public information tied to an email address is legal in the US and most other countries. What you do with the results is regulated. Hiring, housing and credit decisions fall under the Fair Credit Reporting Act, and using what you find to follow, threaten or harass someone can be a crime.

On the FCRA: a company that assembles reports for third parties to use in decisions such as employment is a consumer reporting agency, and the FTC has said that a disclaimer claiming otherwise doesn't get it off the hook (FTC). So don't screen a job applicant, a tenant or a borrower with social media search results. Use a background check provider that follows the FCRA's rules on consent and disputes.

On harassment: the federal stalking statute, 18 U.S.C. § 2261A, covers using email, social media or other electronic communication services for a course of conduct that causes someone substantial emotional distress, and every state has its own stalking laws. In the EU and UK, the GDPR applies when you store or process what you find about a person, even if it came from public pages.

Legitimate reasons include checking a sender who contacted you, vetting a business contact, investigating fraud and reviewing your own exposure. Our responsible use policy spells out what we allow on Rocksosint. This isn't legal advice.

Searching social media by email with Rocksosint

Rocksosint runs this kind of search in one step. Enter an email address and it checks more than 200 open sources for registrations and public profiles tied to it. Each finding comes with the source it came from, so you can open it and confirm the match yourself with the steps above.

All checks are passive. Rocksosint never triggers password resets and sends nothing to the address, so the owner isn't notified. It still returns leads, not verdicts: a registration is reported as a registration, and deciding who is behind it stays with you. How each check works, and what it can miss, is on our methodology page.

Frequently asked questions

Can you find someone's social media accounts with just their email address?

Often, yes, but not always. An exact-match search, a check of the username before the @, Gravatar and a registration check will find accounts for many addresses. Private or single-use addresses return little. Platforms have also cut back direct email search, so a missing result doesn't mean there is no account.

Is there a free way to search social media by email?

Yes. Searching the address in quotes on Google and Bing, running the username through Sherlock, checking Gravatar and running the open-source tool Holehe all cost nothing. The last three need a terminal. A paid tool mainly saves time and checks many more sites in one pass.

Will the person know I searched for their email?

Not if you use passive checks such as search engines, Gravatar, username searches and registration checks that don't send anything. What does alert people is typing their address into a "forgot password" form, because many services email the account owner right away. Rocksosint never triggers password resets.

Why can't I find someone on Facebook by email anymore?

Because Facebook limits it. After contact import was abused for scraping before September 2019, Meta changed the feature. Users now choose who Facebook can suggest their profile to based on their email address or phone number, and "No one" is one of the options.

Is it legal to find someone's social media by email?

Searching public information is legal in most countries. The use is what's regulated. In the US, results can't be used for hiring, housing or credit decisions outside the FCRA, and stalking and harassment laws apply to what you do next. In the EU and UK, the GDPR covers what you store. See our responsible use policy.