explaingit

lockfale/osint-framework

11,341JavaScriptAudience · researcherComplexity · 1/5Setup · easy

TLDR

OSINT Framework is a JavaScript-powered website that organizes hundreds of free open-source intelligence tools into a searchable directory, helping researchers and investigators find the right tool for any task without searching across dozens of sites.

Mindmap

mindmap
  root((osint-framework))
    Purpose
      Tool directory
      Free resources only
      Category browsing
    Tool Markers
      T means local install
      R means registration
      Passive vs active
    Input Types
      Names and people
      Domains and IPs
      Email addresses
    Contribute
      Pull requests
      JSON data file
Click or tap to explore — scroll the page freely

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

Things people build with this

USE CASE 1

Browse free tools by category to research a person's online presence, domain name, IP address, or email address

USE CASE 2

Filter by passive tools that gather data without alerting the subject of an investigation

USE CASE 3

Identify tools that require local installation, registration, or manual URL editing before using them

USE CASE 4

Add a new free OSINT tool to the framework by submitting a JSON entry to the data file via pull request

Tech stack

JavaScript

Getting it running

Difficulty · easy Time to first run · 5min

In plain English

OSINT stands for Open-Source Intelligence, which is the practice of gathering information from publicly available sources. This repository is a JavaScript project that powers a website at osintframework.com. The site organizes hundreds of free tools and resources into categories so that researchers, investigators, and security professionals can find the right tool for a given task without having to search across dozens of separate websites. The project began with an information security focus, but has since expanded to include resources from other fields. Every tool in the framework is available for free public use, at least in part. Some require registration to unlock additional data, and a few have paid tiers for more coverage, but the framework explicitly focuses on tools where you can get useful results at no cost. Each tool entry in the framework's data file can carry structured metadata beyond a name and a link. Fields include a description, a pricing label (free, freemium, or paid), what the tool accepts as input, what it returns as output, and an operational security tag that marks whether the tool works passively or actively. Passive tools query existing databases without alerting the subject, active tools make direct contact that the target might detect. This distinction matters in professional contexts where being noticed would compromise an investigation. Four letter markers appear next to tool names to set expectations before you click. T means the tool must be installed and run locally. D means it uses a Google search technique. R means registration is required. M means you need to manually edit the URL to include your search term. Contributions are welcome via pull requests to the arf.json data file. New tools must be publicly and freely accessible. The README includes a JSON template showing all available metadata fields for a new entry.

Copy-paste prompts

Prompt 1
I need to research someone's social media presence using only free, passive OSINT tools that won't alert the target. Based on the OSINT Framework categories, what tools should I use and in what order?
Prompt 2
I want to add a new free OSINT tool to the osint-framework arf.json file. The tool accepts email addresses as input and returns breach data. Write the complete JSON entry using all available metadata fields.
Prompt 3
I'm investigating a domain name using the OSINT Framework. Walk me through which categories to check and what each type of tool will reveal about the domain's registration, DNS history, and linked infrastructure.
Open on GitHub → Explain another repo

← lockfale on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.