How do I find someone's email address when it isn't public?
Start with the obvious: their site, LinkedIn contact info, or a plain guess at the company's email pattern (first@, first.last@), then verify before sending so you don't burn deliverability on bounces. Email-finder tools help, but treat their output as a guess, not a fact, and always run it through a verifier. As a starting point, if you can only find a generic info@ address, a warm reply on LinkedIn or a real intro usually beats guessing an inbox that may not exist.
Go deeper
19 resources, 18 link-checked.
▶️ Video
✓ Link checkedFreeBeginner
Michael Seibel runs YC and has read thousands of these, so this is the receiving end talking back: what actually makes an investor open, read, and reply. It is a short, direct talk that pairs well with the written pieces if you would rather hear the reasoning than read it. Useful precisely because it comes from the person you are trying not to annoy.
Addresses a practical downstream risk in our answer: guessing wrong or being too aggressive with unverified addresses tanks your reply rate and your deliverability together. Steli walks through a specific template that still gets replies from cold, imperfectly sourced contacts.
An Indian founder story where the early demand test was manual, cold emails and direct outreach to find the first customers before the product had proven itself. It is a grounded counterpoint to the landing page: sometimes the fastest way to measure intent in a B2B market is to ask people to commit directly. Useful if your buyers are enterprises who will never fill in a consumer style waitlist form.
A grounded conversation about when cold email is even worth the effort of finding an address for. Steli's rule of thumb is deal size, not whim, which is a useful gut check before you spend twenty minutes hunting down one person's inbox.
Written by the team behind one of the most used email finder tools, so it walks through the same order of operations our answer recommends: check the site and LinkedIn first, guess the company's pattern, then verify before you send. It states plainly that a large share of guessed addresses turn out wrong, which is exactly why the verification step matters.
Check the company website, LinkedIn, and social bios before you start guessing.
Most companies use one of a handful of predictable patterns like first@ or first.last@, so guessing is a reasonable first move once you know the domain.
Never send to a guessed or found address without running it through a verifier first.
A clear rundown from a company that does outreach at scale for its own work, covering lookup tools, pattern guessing, and newsletter sign ups as a backdoor route to a personal address. It also shows a free way to sanity check a guess yourself before you touch a paid tool.
Written from the recipient's side of the inbox by someone who gets hundreds of cold emails a week. It makes the case that finding the right address is only half the job: a generic, templated pitch sent to a correct email still gets deleted, so what you say once you've reached someone matters as much as how you found them.
Once you've found or guessed someone's email, this is what to actually put in it, with word for word scripts from a founder who has built and sold sales tools for a living. It's the step right after this question is answered: a good email to a hard won contact is wasted if it reads like spam.
The authoritative handbook on founder-led sales, written for technical/first-time sellers building B2B SaaS. Readable free online via membership, and covers the whole motion end to end.
When your first ten will come from cold outreach, this guide gives you the full mechanics: building a target list, qualifying, writing the email, and running follow-ups without being annoying. It is the operational counterpart to the Lenny and YC pieces, showing the actual day-to-day of prospecting. Work through it as a checklist for your outbound.
Ferrazzi's core argument is that the people worth reaching are found through relationships, not databases, so a connector who already has the email beats any lookup tool. It's the book length version of the last line in our answer: a real intro or a generous reply outperforms a guessed inbox, and this is the classic text on building the network that gets you the intro in the first place.
A blunt, contrarian counterpoint from working founders and investors: several commenters argue you shouldn't be hunting down a cold email at all, since a warm introduction or visible traction beats a guessed inbox every time. Worth reading precisely because it argues against the premise, which is the same trade off our answer makes explicitly.
When you have a name and a company but no address, Hunter is the default first stop: type the person and the domain, and it returns the verified email or its best guess with a confidence score. The free tier gives you 50 searches a month with no card, which is plenty when you are reaching out one founder at a time rather than blasting a list. It works off publicly available data and shows its sources, so you are not scraping anyone manually.
A straightforward alternative to Hunter that independent tests rate as more accurate on harder to find addresses. Useful as a second opinion when your first tool comes up empty or you want to cross check a guess before sending.
This is the plain guess at the company's email pattern from our answer, made mechanical. Feed it a name and domain and it generates every plausible combination instead of you typing them out by hand. Pair its output with a verifier rather than mass sending to every guess it gives you.
A large contact database that's worth trying when Hunter or VoilaNorbert come back empty, since it draws on a different index of public profiles and records. A good fallback for the person whose company site and LinkedIn contact info genuinely have nothing.
When you need to reach the active or influential people in your niche cold, this helps you build a targeted list and find their contact details. The free tier is enough to assemble your first outreach list without spraying. Use it to reach outward once your warm network is tapped.
Once you have a verified address, these are ready to adapt templates from a CRM built specifically for small sales teams, including an asking for an introduction format built for the exact case where you're not fully sure the address is even the right person. Good for the moment right after this question is answered.
This is the verification step our answer insists on. Paste in a guessed or found address and it tells you whether the inbox is real before you burn a send on it. Skipping this is exactly how founders quietly damage their domain's deliverability with a stack of bounces.
