OSINT Framework explained, and the monitor to run next to it
The free tree tells you which tool to open for a username, domain or image. AyeWatch keeps watching the sources you find and alerts you when they change.
By ClaudeGPT Si Newsroom, Editorial team3 min read
OSINT Framework is a free website that sorts open-source intelligence resources into a clickable tree, grouped by what you start with: a username, an email address, a domain, an image or a company. It shows you where to look, not what changed, so pair it with a monitor such as AyeWatch for the subjects you need to keep checking.
What OSINT Framework is
Open-source intelligence means collecting and analyzing information that anyone can legally reach: news, public records, company sites, public social posts and web archives. OSINT Framework is a directory for that work. Justin Nordine built it from an information security point of view, and people from other fields now use it too. Its notes say the aim is to point you to free resources, with a warning that some listed sites ask you to register or charge for more data.
The project is open source under the MIT license on GitHub, and the whole list lives in a single JSON file. As of November 2026 that file holds about 1,170 links across 33 top-level branches, from Username and Domain Name to Public Records, Archives, Dark Web and AI Tools.
How the tree works
Click a branch to open it, and keep clicking until you reach a tool. Clicking a tool opens a side panel with:
- its path in the tree and an "Open Tool" button
- a status badge (live, degraded or down) and a pricing badge (free, freemium or paid)
- a description, the input it takes and the output it returns
- OPSEC notes saying whether the tool is passive or sends requests to the target
A search box at the top matches tool names and descriptions. The letters after some names are the legend: (T) means you install and run the tool locally, (D) is a Google dork, (R) needs registration, and (M) means you edit the search term into the URL by hand.
What it does not do
The framework is a map. It does not run lookups for you, keep your results, or tell you when a page, a filing or an account changes. Its own data marks 42 entries as down and 44 as degraded (as of November 2026), so read the status badge before you trust a link. And most investigations return to the same sources week after week, which is where the hours go.
Where AyeWatch fits
AyeWatch picks up once you know what to watch. Write the subject in plain English, paste the URL of a page, or point it at a public X profile, a subreddit, a YouTube channel, or a LinkedIn, Instagram or TikTok account. It checks on a schedule and sends a short brief of what changed, with links back to the sources. Its OSINT glossary entry says it covers the surface web, so treat it as a public web monitor, not a tool for forums or the dark web.
| Job | OSINT Framework | AyeWatch |
|---|---|---|
| Find a lookup tool for a username, domain or image | Yes, by branch | No |
| Check a source again tomorrow and next week | No | Yes, on a schedule |
| Tell you what changed, with sources | No | Yes |
| Cost (as of November 2026) | Free site; some listed tools are paid | Free preview; paid plans from $9 a month |
For ongoing research, set up AyeWatch first and keep OSINT Framework open as the reference for one-off lookups. If all you need today is a single lookup, the framework on its own is the better choice, and a monitor adds nothing.
Stay on public sources
Respect each site's terms and your local law. Keep the work on organizations, topics and your own exposure, and never use these tools to follow or profile private people.
FAQ
Is OSINT Framework free?
The site is free and open source. It focuses on free resources, but some listed tools need registration or charge for more data, and each tool's panel shows a free, freemium or paid badge.
Who made OSINT Framework?
Justin Nordine created it from an information security point of view. The code and the tool list are on GitHub under lockfale/osint-framework with an MIT license.
Does OSINT Framework send alerts?
No. It lists tools and does not watch anything. For alerts when a public page, topic or account changes, add a monitor such as AyeWatch.
Originally published on claudegpt.si