People Search & Public Records

What this covers

Finding the records that name a person: civil registries, corporate filings, court dockets, electoral rolls, phone books, and the commercial aggregators that resell all of it. Coverage is wildly uneven by country, and the aggregators are frequently wrong, so this is an area where knowing which source is authoritative matters more than knowing many sources.

Method

1. Start with the authoritative registry, not an aggregator. If a country publishes its company register or land registry, use it — the aggregator is a stale copy with errors added.
2. Establish the jurisdiction first. People-search coverage is national. A US-focused aggregator has close to nothing on a Swedish resident, and Nordic registries are far more open than most.
3. Cross-reference two independent sources before accepting an address, date of birth or relationship. Aggregators copy each other, so two of them agreeing means nothing.
4. Pivot through documents. A court filing names an address, an employer and often relatives. One good document beats twenty aggregator hits.
5. Treat breach data as intelligence, not evidence. It tells you an email existed on a service at some point. It does not tell you who typed it in.

Regional registries worth knowing

Nordic countries publish personal data that is closed almost everywhere else, which makes them unusually productive:

• Sweden — Ratsit, Hitta.se, and the Swedish Name Register give addresses, income brackets and dates of birth.
• Norway / Finland / Denmark — equivalents exist; tax records are partly public in Norway.
• Nigeria — NigeriaPhonebook for telephone-to-name lookups.
• United States — county-level court and property records are the real source; national aggregators are convenience layers over them. Search Systems is a directory of the underlying databases, organised by state and record type.

None of these publish an API. They do take their search term in the query string, which is worth knowing because it means a registry lookup can be scripted into a browser or a note template rather than retyped:

https://www.hitta.se/sök?vad=Anna+Andersson        name or address; returns people and companies
https://www.hitta.se/sök?vad=08-555+012+34         reverse telephone, same parameter

The vad parameter is the only one you need; the rest of the query string the site adds is UI state. Note that the path segment is the Swedish word sök, so it percent-encodes to s%C3%B6k when you paste it into curl — a shell that mangles the UTF-8 is the usual reason a hand-built Hitta URL 404s. Ratsit and the US brokers sit behind bot protection that returns 403 to anything without a browser fingerprint, so for those, drive the search box rather than the URL.

Key tools

Have I Been Pwned

The reference for which breach corpora hold an address, and the only tool in this area with a stable documented API. Account lookups sit behind a paid key now — the cheapest tier is a few dollars a month — while the breach catalogue and the password range endpoint stay free and need no key at all.

The keyless half, which is where to start because it costs nothing and tells you what the corpus even is:

# the breach catalogue: free, no key, useful for dating a corpus
curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breaches' \
  | jq -r '.[].Name' | head

# one breach in detail — when it happened, how big, what fields leaked
curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breach/Adobe' \
  | jq '{BreachDate,AddedDate,PwnCount,IsVerified,DataClasses}'

# which breaches carried the field you actually care about, sorted oldest first
curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breaches' \
  | jq -r '[.[] | select(.DataClasses | index("Physical addresses"))]
           | sort_by(.BreachDate)[] | "\(.BreachDate)  \(.PwnCount)  \(.Name)"'

# every breach attributed to one domain — the pivot when you know the employer, not the person
curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breaches?Domain=adobe.com'

# the field vocabulary, so a report says "Physical addresses" and not "address data"
curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/dataClasses' | jq -r '.[]'

# what was added most recently, for deciding whether a re-run is worth the quota
curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/latestBreach' \
  | jq '{Name,AddedDate}'

Then the keyed half. user-agent is mandatory on every call and hibp-api-key on everything that names an account:

# confirm which tier the key actually buys before you plan a run around it
curl -s 'https://haveibeenpwned.com/api/v3/subscription/status' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' \
  | jq '{SubscriptionName,Rpm,DomainSearchMaxBreachedAccounts}'

# which breaches hold this address; truncateResponse=false is what gets you the dates
curl -s 'https://haveibeenpwned.com/api/v3/breachedAccount/target@example.com?truncateResponse=false' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' \
  | jq -r '.[] | "\(.BreachDate)  \(.Name)"'

# include unverified corpora — more hits, weaker provenance, so record the flag you used
curl -s 'https://haveibeenpwned.com/api/v3/breachedAccount/target@example.com?truncateResponse=false&IncludeUnverified=true' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' | jq 'length'

# k-anonymity account search: the address never leaves your machine, only six hex characters do
H=$(printf 'target@example.com' | shasum -a 1 | cut -c1-40 | tr 'a-f' 'A-F')
curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/range/${H:0:6}" \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' \
  | jq -r --arg suffix "${H:6}" '.[] | select(.hashSuffix == $suffix) | .websites[]'

# paste sites that carried the address, which often predate the breach being named
curl -s 'https://haveibeenpwned.com/api/v3/pasteAccount/target@example.com' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'

# every breached address under a domain you have proven you control
curl -s 'https://haveibeenpwned.com/api/v3/breachedDomain/example.com' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'

# which domains you have actually verified, when a run comes back suspiciously empty
curl -s 'https://haveibeenpwned.com/api/v3/subscribedDomains' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' | jq -r '.[].DomainName'

# stealer-log hits — infostealer output, so far more recent than breach corpora
curl -s 'https://haveibeenpwned.com/api/v3/stealerLogsByEmail/target@example.com' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'

# the same, across a verified domain: which of your subject's colleagues ran malware
curl -s 'https://haveibeenpwned.com/api/v3/stealerLogsByEmailDomain/example.com' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'

# which sites a stealer-infected machine had credentials for — a browsing-history proxy
curl -s 'https://haveibeenpwned.com/api/v3/stealerLogsByWebsiteDomain/example.com' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'

The password range endpoint needs no key, is not rate limited, and never sees the password:

# only the first five SHA-1 characters leave your machine
printf 'hunter2' | shasum -a 1 | tr 'a-f' 'A-F' | cut -c1-5 \
  | xargs -I{} curl -s "https://api.pwnedpasswords.com/range/{}" | head -3

# pad the response with dummy rows so its size tells an observer nothing about the
# prefix; padded rows always carry a count of 0, so discard them before reading
curl -s -H 'Add-Padding: true' 'https://api.pwnedpasswords.com/range/5BAA6' \
  | awk -F: '$2 != 0' | head -3

# NTLM suffixes instead of SHA-1, for checking a dumped AD hash against the corpus.
# NTLM suffixes are 27 characters where SHA-1 suffixes are 35 — a length mismatch
# when you diff against a local list means you queried the wrong mode
curl -s 'https://api.pwnedpasswords.com/range/8846F?mode=ntlm' | head -3

The k-anonymity account endpoint is the one worth building a habit around: it sends six hex characters of a SHA-1 and matches the remaining suffix locally, so the address you are investigating is never transmitted. The response carries hashSuffix and websites — not breaches, which is the field name people assume and then silently get null from.

Omitting user-agent returns 403 rather than a useful error. breachedAccount truncates by default, returning only breach names — if your output has no dates in it, you forgot truncateResponse=false, and a report built on that output cannot say when anything happened. A 429 carries a retry-after header in seconds; honour it, because the limit is per key and hammering it gets the key suspended. And the output tells you a corpus containing that address was published — not that your subject created the account, not that they still use the address, and not what the password was.

Intelligence X

Web-first, and the broadest selector search available without a corporate contract: it indexes leaks, darknet pages, document dumps and its own historical web crawl, and it searches by selector type rather than free text. Reach for it when an identifier returns nothing elsewhere.

Paste the selector at intelx.io and read the result pane by bucket — the left-hand facets split hits into leaks, darknet, web and documents, and the bucket matters more than the hit count. Selectors it understands:

target@example.com          email address
example.com                 domain, including subdomain hits
198.51.100.0/24             CIDR range
+14155550123                phone number, E.164
1BoatSLRHtKNngkdXEeobR76b53LETtpyT   cryptocurrency address
d41d8cd98f00b204e9800998ecf8427e     hash or document selector

For the record, capture the item’s date added and its bucket, not just the snippet — Intelligence X keeps items long after the source is gone, so the snippet alone cannot be re-verified. The API takes the key from the developer tab of your account in an x-key header; phonebook (bulk selector extraction) and most export volume are paid tiers, and the free tier is metered tightly enough that you will feel it inside an hour.

OCCRP Aleph and Library of Leaks

Aleph is a document-and-entity index built for cross-border corruption work: leaked archives, scraped registries, sanctions lists and court filings normalised into one searchable entity graph. It beats a people-search aggregator whenever the subject appears in documents rather than directories. Library of Leaks is the same software over a different, leak-heavy corpus.

pipx install alephclient

# register free, then take the key from your Aleph user profile — anonymous API calls get a 401
export ALEPHCLIENT_HOST=https://aleph.occrp.org
export ALEPHCLIENT_API_KEY=REPLACE_ME

# people matching a name, across every dataset you can read
curl -s -G 'https://aleph.occrp.org/api/2/entities' \
  -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" \
  --data-urlencode 'q=Sergei Ivanov' --data-urlencode 'filter:schema=Person' \
  | jq -r '.results[] | "\(.properties.name[0])  \(.collection.label)"'

# companies instead of people — the usual pivot off a director's name
curl -s -G 'https://aleph.occrp.org/api/2/entities' \
  -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" \
  --data-urlencode 'q=Sergei Ivanov' --data-urlencode 'filter:schema=Company' | jq '.total'

# which datasets exist, so you can say what you did and did not search
curl -s 'https://aleph.occrp.org/api/2/collections?limit=50' \
  -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" \
  | jq -r '.results[] | "\(.foreign_id)  \(.label)"'

# one entity in full, including the documents it was extracted from
curl -s 'https://aleph.occrp.org/api/2/entities/ENTITY_ID' \
  -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" | jq '.properties'

# push your own case documents in so they are indexed alongside the public corpora
alephclient crawldir --foreign-id my-case-2026 ./case-documents

Names in Aleph are transliterated inconsistently because the sources are, so run the variants from username and account work before concluding a name is absent. An entity is an extraction from a document, which means both the spelling and the role can be wrong; open the source document before you cite it. Uploading case documents sends them to someone else’s server — check that is acceptable for your material first.

CourtListener and RECAP

Free, keyless-to-browse access to US federal dockets, opinions and PACER filings that other researchers have paid for and donated. For a US subject this is the best single documentary source on this page, because a filing names addresses, employers, counsel and relatives in one place.

# token from your free account profile; note the literal word "Token"
export CL_TOKEN=REPLACE_ME

# federal dockets mentioning a name (type=r gives dockets with nested documents)
curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
  -H "Authorization: Token $CL_TOKEN" \
  --data-urlencode 'q="Dana Whitfield"' --data-urlencode 'type=r' \
  | jq -r '.results[] | "\(.dateFiled)  \(.court)  \(.caseName)"'

# case law opinions instead of dockets
curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
  -H "Authorization: Token $CL_TOKEN" \
  --data-urlencode 'q="Dana Whitfield"' --data-urlencode 'type=o' | jq '.count'

# narrow to one court and a date window
curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
  -H "Authorization: Token $CL_TOKEN" \
  --data-urlencode 'q=Whitfield' --data-urlencode 'type=d' \
  --data-urlencode 'court=txwd' --data-urlencode 'filed_after=2020-01-01'

# judges, for checking who heard a case
curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
  -H "Authorization: Token $CL_TOKEN" \
  --data-urlencode 'q=Whitfield' --data-urlencode 'type=p'

# the docket itself, including the parties
curl -s 'https://www.courtlistener.com/api/rest/v4/dockets/?id=12345' \
  -H "Authorization: Token $CL_TOKEN" | jq '.results[0] | {case_name,date_filed,assigned_to_str}'

# page with the cursor the previous response handed back, not an offset
curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
  -H "Authorization: Token $CL_TOKEN" \
  --data-urlencode 'q=Whitfield' --data-urlencode 'type=r' --data-urlencode 'cursor=CURSOR'

RECAP holds what somebody has already fetched from PACER, so absence means nobody bought that document, not that the case does not exist — check PACER’s own index before saying there is no case. Search results are cached for ten minutes, so polling for new filings wastes your quota; use the Alert API for monitoring. State courts are mostly absent, which is where most US litigation actually happens.

OpenSanctions

Sanctions lists, politically-exposed-person data and criminal watchlists, merged and deduplicated into one entity model with a matching API. Use it to answer “is this person on a list” properly, rather than eyeballing a dozen national PDFs — and to record a clean negative.

export OS_KEY=REPLACE_ME

# full-text search, for when you only have a name
curl -s -G 'https://api.opensanctions.org/search/default' \
  -H "Authorization: ApiKey $OS_KEY" --data-urlencode 'q=Sergei Ivanov' \
  | jq -r '.results[] | "\(.caption)  \(.schema)  \(.datasets|join(","))"'

# proper screening: describe the entity and let the matcher score candidates
curl -s -X POST 'https://api.opensanctions.org/match/default' \
  -H "Authorization: ApiKey $OS_KEY" -H 'Content-Type: application/json' \
  -d '{"queries":{"q1":{"schema":"Person","properties":{"name":["Sergei Ivanov"],"birthDate":["1965"],"country":["ru"]}}}}' \
  | jq -r '.responses.q1.results[] | "\(.score)  \(.caption)  \(.datasets|join(","))"'

# one entity in full, with every list that carries it and why
curl -s 'https://api.opensanctions.org/entities/NK-A7z1Z' \
  -H "Authorization: ApiKey $OS_KEY" | jq '{caption,datasets,properties}'

# which lists are in the index, so your negative result has a defined scope
curl -s 'https://api.opensanctions.org/catalog' | jq -r '.datasets[].name' | head -30

A date of birth or a country code moves the score far more than extra name tokens; a bare name query on a common name returns confident nonsense. The score is a similarity, not a finding — anything you publish needs the underlying list entry read by a human. Trial keys come free with a business email and public-interest keys are granted for journalism and research; if the metering gets in the way, the matching engine (yente) is open source and self-hostable against the same free bulk data.

EDGAR full-text search

Free, keyless, and routinely forgotten in people work: every SEC filing since 2001 is full-text searchable, and filings name directors, officers and beneficial owners with addresses. A Form D or a proxy statement is a dated, signed document naming a person — which is exactly the kind of source an aggregator hit is not.

# the SEC requires a descriptive User-Agent with contact details; without one you get blocked
UA='osint-research research@example.com'

# every filing mentioning a name
curl -s -A "$UA" 'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22' \
  | jq -r '.hits.hits[] | "\(._source.file_date)  \(._source.display_names[0])"'

# restrict to a form type — Form D names the directors of a private placement
curl -s -A "$UA" 'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22&forms=D'

# date-bounded, which is how you tie a person to a company in a given year
curl -s -A "$UA" \
  'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22&dateRange=custom&startdt=2019-01-01&enddt=2021-12-31'

# every filing by one company, from its CIK
curl -s -A "$UA" 'https://data.sec.gov/submissions/CIK0000320193.json' \
  | jq '{name,addresses,formerNames}'

The browsable version is at sec.gov/edgar/search, and it is the right place to read a hit. Full-text coverage starts in 2001; older filings are indexed by company but not searchable by content. A name in a filing is the name as filed, so middle initials and suffixes are inconsistent across years.

Ratsit

Web only, Sweden only, and far more revealing than anything equivalent elsewhere: registered address, year and month of birth, income bracket, property and vehicle flags, and who else is registered at the address. Swedish population-register data is public, so this is a legitimate primary source rather than a broker’s guess.

Search the name at ratsit.se, narrow by county when the name is common, and read the profile page. For the record, capture these fields and nothing inferred from them:

Folkbokförd adress    registered address, i.e. where the state believes they live
Född                  birth year and month (day is withheld on the free view)
Inkomst / Taxeringsår income bracket AND the assessment year it belongs to
Fordon / Fastighet    vehicle and property flags, each a pointer to another register
Personer på adressen  others registered at the same address — household, not family

The income figure is always a year or two behind and is meaningless without the assessment year printed beside it.

Search logged out. Ratsit sells subjects a paid feature listing the logged-in users who looked them up; anonymous searches leave no entry in that log. Mrkoll, the nearest competitor, shows subjects a profile-view count but not identities. Either way, an account turns a passive lookup into something the subject can notice.

US people-search aggregators

FastPeopleSearch, That’s Them and Radaris are free, web only, and the fastest route to a candidate address and phone for a US subject. They are also data brokers reselling scraped and purchased records of unknown age.

Enter the name plus a city or state — a bare name on a common surname is unusable. Read the result page as three separate claims with separate reliability: current address, phone numbers, and “possible relatives”. The first two are checkable against a county property or voter record; the third is inference from shared addresses and surnames and is wrong often enough that repeating it is reckless.

Dana Whitfield Austin TX        name + city: the only query form that works
Dana Whitfield 78701            name + ZIP, when the city name is ambiguous
(512) 555-0123                  reverse phone, usually the highest-precision entry point
1200 Example St, Austin TX      reverse address, to enumerate the household

Capture the page with an archiving tool, because broker pages change without notice — see archiving and evidence.

These sites are also the mechanism by which your subject’s data is public in the first place; most carry an opt-out form, and a subject who has used it will be absent from the broker while still present in the underlying county record. Absence here means nothing.

Pipl

Sales-gated since its pivot to enterprise identity resolution. There is no self-serve tier, no web search for individuals, and contracts start in the thousands of dollars a year. Treat the Pipl entry in the table below as historical. For the same job without a contract, the live options are the registry-first route above, Intelligence X for selector search, and OSINT Industries or Osintly if you need a commercial aggregator with per-query pricing.

Breach and leak data

Useful for confirming that an identifier was in use, and for pivoting between an email, a username and a phone number. Handle carefully: this is other people’s stolen data.

Do not put a live target’s credentials into a third-party lookup you do not control, and do not treat a password from a breach as authorisation to use it.

DeHashed is the one worth a note on access: it is credit-metered now, and the old basic-auth api.dehashed.com/search?query= endpoint that circulates in every scripted wrapper is retired. The current API is v2, documented behind a login at dehashed.com/docs, so check the endpoint there rather than copying a wrapper. The web search works without any of that. Leak-Lookup’s free tier is a hash-only check; its searchable API is paid.

Tool reference

Pitfalls

• Aggregators invent relatives. “Possible relatives” lists are inference from shared addresses and surnames. They are frequently wrong and occasionally defamatory.
• Stale addresses. Someone moved five years ago; the aggregator still shows the old address as current. Date every claim.
• Name collisions. Common names across a large population produce confident, wrong matches. Require a second identifier — date of birth, middle initial, employer.
• Jurisdiction and legality. Accessing some records requires a declared lawful purpose. Bulk collection of personal data about EU residents engages the GDPR regardless of the data being public.

Worked example

One datum: the name Dana Whitfield, typed under a signature on a PDF that also carries a Travis County, Texas address block. Nothing else.

1. Establish the jurisdiction’s real sources. Search Systems lists the Travis County clerk, district clerk and appraisal district portals. That tells you where the authoritative property and civil records live before you touch an aggregator.
2. Federal dockets. type=r search on CourtListener for "Dana Whitfield" returns one 2021 docket in the Western District of Texas. The docket’s party block gives a street address and the name of a law firm — two new pivots, from a dated court document.
3. Filings. EDGAR full-text search for the same name, forms=D, returns a 2022 Form D naming her as a director of a private company, with a business address in Austin and a company CIK.
4. Company side. The CIK into data.sec.gov/submissions/CIK….json gives the company’s former names and address history, which is how you find out the entity was renamed in 2023 — the reason a plain name search missed it.
5. Screening, including the negative. The OpenSanctions /match/default call with name, country=us and the birth year inferred from the docket returns no result above 0.6. Record that as a checked negative with the datasets listed, not as “nothing found”.
6. Identifier confirmation. The business email in the Form D goes into HIBP breachedAccount. Two corpora dated 2019 and 2021 hold it, which confirms the address was in use across that window — and nothing more.
7. Aggregator, last. That’s Them on “Dana Whitfield, Austin TX” returns three candidate addresses, one matching the docket. The other two, and the whole “possible relatives” block, stay in the notes as unverified inference.

The whole run, as commands:

UA='osint-research research@example.com'
export CL_TOKEN=REPLACE_ME OS_KEY=REPLACE_ME HIBP_KEY=REPLACE_ME

curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' -H "Authorization: Token $CL_TOKEN" \
  --data-urlencode 'q="Dana Whitfield"' --data-urlencode 'type=r' | jq -r '.results[].caseName'

curl -s -A "$UA" 'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22&forms=D' \
  | jq -r '.hits.hits[] | "\(._source.file_date)  \(._source.display_names[0])"'

curl -s -A "$UA" 'https://data.sec.gov/submissions/CIK0001234567.json' | jq '{name,formerNames}'

curl -s -X POST 'https://api.opensanctions.org/match/default' -H "Authorization: ApiKey $OS_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"queries":{"q1":{"schema":"Person","properties":{"name":["Dana Whitfield"],"country":["us"]}}}}' \
  | jq -r '.responses.q1.results[] | "\(.score)  \(.caption)"'

curl -s 'https://haveibeenpwned.com/api/v3/breachedAccount/dana@example.com' \
  -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' | jq -r '.[].Name'

What you can assert: a named person, tied by two independent dated documents to one company and one city, with one address corroborated by a court filing. What you cannot: anything the aggregator alone said, and any relationship nobody filed.

What would falsify it: the docket and Form D resolving to different people once a middle name, date of birth or signature is compared; the apparent address match being a forwarding or business address shared by unrelated parties; or the filing being amended or withdrawn. The company-and- city link survives only while the two primary documents point to the same natural person.

Broader catalogues

• People OSINT
• Public Records OSINT
• Breached Data Provider OSINT

More tools

Further tools for this area from the OSINT Newsletter Tools Library (People OSINT, Public Records OSINT, Breached Data Provider OSINT), excluding those already listed above.

Sources

Both catalogues below are maintained by other people and are considerably larger than this page. Use them as the canonical index; this sheet is a working route through them.

• Bellingcat’s Online Investigation Toolkit — ~340 tools, each with its own review page covering cost, difficulty, requirements and limitations.
• OSINT Newsletter Tools Library — ~280 tools, organised by investigative goal.

Neither publishes a licence, so nothing here is copied from them: tool names, one-line descriptions, cost flags and links are catalogue facts, and the method and commentary are this site’s own. See credits.