Turn scattered public traces into verified findings.
A workbench for learning, teaching, and running open-source investigations — a structured curriculum, launchers that automate the tedious link-building, and a persistent casebook that documents your trail. Built for journalists, security researchers, analysts, and educators. (Hover the white bars.)
What's inside
01 Curriculum
Ten teachable modules from the intelligence cycle to reporting — each with techniques, a hands-on exercise, and notes for whoever's teaching.
02 Toolkit
Query builders, recon launchers, and a client-side metadata reader. Type a target once; get clean advanced-search strings and one-click links across dozens of public sources.
03 Casebook
A persistent notebook for entities, findings, and sources — timestamped and exportable. Documentation is the difference between OSINT and guessing.
The intelligence cycle
Every module and tool here maps to a stage of the loop that professional analysts run. It keeps investigations honest and repeatable.
P Plan
Define the question. What do you actually need to know, and what would count as an answer?
C Collect
Gather from open sources. Cast wide, then narrow. Preserve everything you touch.
Pr Process
Translate, decode, deduplicate, and organize raw material into workable evidence.
A Analyze
Corroborate, weigh, and connect. Distinguish what you know from what you suspect.
D Report
Communicate findings with confidence levels and a documented chain back to sources.
↻ Loop
New answers raise new questions. Feed them back into planning and go again.
The curriculum
Ten modules, sequenced so each builds on the last. Ethics and OPSEC come before technique on purpose. Click any module to expand its techniques, a practice exercise, and a teaching note.
Read module 02 first. Legality and ethics are not an appendix to OSINT — they define whether what you're doing is investigation or intrusion. Everything downstream assumes you have authorization and a legitimate purpose.
The toolkit
These tools automate the repetitive part of collection: constructing precise queries, opening the same set of public sources for a target, and reading what a file says about itself. They generate links you review yourself — nothing is scraped, uploaded, or stored remotely.
Everything here uses publicly available search interfaces and lookup services. Links open in a new tab so you decide what to visit. Use them only against targets you're authorized to investigate.
Advanced Search Builder
Compose precise search-operator queriesUsername Launcher
Check a handle across public profilesGenerates direct links to public profile URLs. A hit means the handle exists there — always confirm it's the same person before drawing conclusions (handle reuse ≠ identity).
Domain & Infrastructure Launcher
Public records for a domain or hostRegistration, DNS, TLS certificates, historical snapshots, and technology fingerprinting — all from public services.
Image & Geolocation Launcher
Reverse-search and place a photoReverse-image engines each catch different things — run all four. The geolocation set helps you place a photo from visual clues (signage, terrain, sun position, street-level imagery).
Image Metadata Reader
EXIF · XMP · IPTC — parsed in this tab, never uploadedThe file is read with FileReader in your browser. Nothing is fetched, uploaded, or stored — reload the page and it's gone. Metadata is trivially forged and stripped, so treat every field as a lead, not a fact.
Casebook
Track entities, log timestamped findings with their source, and map how it all connects. Every case has two lenses on the same data: a list for the record, and a web where you draw labelled relations and see exactly which conclusions rest on a guess. Cases live wherever you choose — locally in this browser, or synced to a backend you host.
Create a case to start logging entities and findings.
Storage backend
Choose where cases live. Everything else works the same — only the storage location changes.
Cases stay in this browser. No account, nothing leaves your device — ideal for solo work and teaching on one machine.
Sync cases to a backend you host, so a team can share cases across people and devices. A ready-to-run reference server ships alongside this app.
Your server must send permissive CORS headers so this page can reach it.
Zero dependencies — save it anywhere and run node signal-backend.js. It listens on localhost:8787 and writes one JSON file per case into ./signal-data.
API contract — reimplement this in any language
| GET | /cases | 200 · index array of {id,name,created,updated} |
| GET | /cases/:id | 200 · the full case, or 404 |
| PUT | /cases/:id | 200 · the full case (body is the full case; upsert) |
| DELETE | /cases/:id | 200 · {ok:true}, or 404 |
| OPTIONS | * | 204 · CORS preflight |
If an API key is set, every request must carry Authorization: Bearer <key>; without it the server answers 401.
A case is {id, name, created, updated, subjectId, entities[], findings[], relations[]}. The server only needs to store and return it verbatim — this app fills in any missing field when it reads a case, so a server written against an older shape keeps working.
Ethics & law
OSINT lives on a legal and ethical edge. The same techniques that expose corruption can enable stalking. What separates them is authorization, purpose, proportionality, and restraint. These principles are the price of using the rest of this platform.
Have a lawful basis and a legitimate purpose
Know why you're investigating and under what authority — a journalistic assignment, a security engagement with a signed scope, a due-diligence mandate, consent, or clear public interest. "It's technically public" is not a purpose. If you can't state your basis in one sentence, stop.
Respect the law where you and your subject are
Data-protection regimes (GDPR in the EU, and equivalents elsewhere), anti-stalking and harassment statutes, computer-misuse laws, and platform terms of service all apply. Accessing something because a login was weak is not "open source" — it's unauthorized access. Stay strictly on the public side of every wall.
Minimize — collect only what the question needs
Just because you can pull someone's entire digital footprint doesn't mean you should. Scope collection to your question, avoid incidental third parties, and don't retain sensitive data you don't need. More data is more risk, for them and for you.
Do no harm — weigh consequences before you publish or act
Consider the safety of the people in your findings, including bystanders. Unmasking someone can put them at physical risk. Being wrong can destroy a reputation. Corroborate before you conclude, and think hard about who is endangered by what you release.
Verify before you believe — then say how sure you are
Open sources are full of stale, spoofed, and coincidental data. Two accounts sharing a username is not proof they're one person. Attach a confidence level to every claim and keep the trail that supports it.
The line, concretely
- Searching public search engines, archives, and registries
- Reading public profiles, posts, and filings anyone can see
- Reverse-image searching a publicly posted photo
- Documenting sources and preserving what you find
- Investigating with authorization and a clear purpose
- Reporting findings responsibly, with confidence levels
- Guessing passwords or using leaked credentials to log in
- Social-engineering, pretexting, or deceiving people for data
- Accessing private accounts, DMs, or paywalled/gated content
- Buying or using breached personal data dumps
- Surveilling, tracking, or exposing private individuals to harass
- Publishing home addresses or identities to endanger someone
If a task requires crossing that right-hand column, it's outside the scope of this platform and, in most places, outside the law. This tool won't help with it, and neither will I.
For instructors
If you're using this to teach, here's how the pieces fit into a course, plus classroom-tested guidance for running OSINT training without creating little privacy hazards.
Suggested arc
Wk 1 Frame & ground rules
Modules 1–2. Ethics and law before a single tool. Have students write their own one-sentence "lawful basis" statement and defend it.
Wk 2 OPSEC & search
Modules 3–4. Set up research personas and practice the Search Builder against a benign target (a public agency, a historical event).
Wk 3 People & images
Modules 5–6 with the Username and Image launchers. Use consenting volunteers or fictional personas only — never a real classmate without opt-in.
Wk 4 Infra, verify, report
Modules 7–10. Students run a full mini-investigation in the Casebook and hand in the exported report graded on sourcing and confidence, not just conclusions.
Running it safely
Use fabricated personas, public institutions, CTF-style scenarios, or volunteers who've explicitly opted in. Never assign students to investigate a real private individual — including each other. This is the single most important classroom rule.
Grade the process: documented sources, corroboration, stated confidence, and knowing when to stop. A well-reasoned "I couldn't confirm this" should outscore a confident guess that happens to be right.
Explicitly teach stopping. Run a scenario that turns sensitive (a minor, a safety risk, someone in crisis) and reward students who escalate or halt. Knowing when not to dig is a core professional skill.
Close every session by flipping perspective: how would students reduce their own footprint? It reinforces technique and builds the empathy that keeps investigators ethical.
Ready-made prompts
Drop-in discussion questions:
- →Two accounts share a rare username. What would actually prove they're the same person?
- →You find a subject's home address. Under what circumstances, if any, does it belong in your report?
- →A photo's metadata says one location; the shadows say another. Which do you trust, and why?
- →Where is the line between investigating a public figure and surveilling a private one?