# How to do OSINT on yourself: find what is public about you

Published: 2026-11-12 · By HackerGPT Team
Canonical: https://hackergpt.org/blog/osint-on-yourself/

> A hands-on self-audit of your name, email addresses, usernames and photos in public sources: the checks to run, the real output they give, and how to remove or lock down what you find.

**TL;DR:** To do OSINT on yourself, write down your seeds (your name, every email address, every username, the photos you have shared), then look each one up in the public sources anyone else would use: search engines, breach notification services, profile and code-hosting sites, and the metadata inside your own files. Note what each search turns up and which finding leads to the next one, then remove, lock down or change it, starting with whatever helps someone reset your passwords or find your home.

This guide is for learners who want to practise OSINT on the one target they are fully entitled to look up: themselves. You will run the same checks an attacker preparing a phishing email would run, see the real output of each one, and finish with a list of things to fix. Keep the scope to yourself. Looking up other private people is a different activity with its own legal and ethical limits, and it is not what this article teaches.

## What does OSINT on yourself mean?

OSINT on yourself means collecting what public sources say about you, the way a stranger would, and treating the result as a list of things to fix. [OSINT](https://hackergpt.org/learn/osint/), open-source intelligence, is information gathered from sources anyone can reach and then analysed to answer a question. Here the question is "what could someone learn about me without asking me?"

Attackers ask the same question first. MITRE ATT&CK lists [Gather Victim Identity Information](https://attack.mitre.org/techniques/T1589/) (names, email addresses, credentials) as a reconnaissance technique in its own right, done before any phishing email or password guess. Doing it to yourself first lets you see the same picture and act on it.

If you run a company or a website, there is a second half to this: your domain, DNS records and certificate logs. That is covered in [OSINT on your own company](https://hackergpt.org/blog/intelligence-gathering/). This article stays with the person.

## How do I find out what information about me is publicly available?

Start from four seeds and look each one up in the public sources it reaches. The diagram shows the plan for a fictional persona, Alex Rivera; replace the values with your own.

![Four seeds (name, email, username, photos) mapped to the public sources to check and the fix for each](https://hackergpt.org/blog/osint-on-yourself/self-osint-pivots.webp) *The audit in one picture, for a fictional persona. Each finding can become the next seed: a profile found by email names a username, and that username leads to more profiles and photos.*

Before you search, write the seeds down in a plain text file:

- **Name**: every spelling you use, plus your city and employer.
- **Email addresses**: current, old, work and school ones.
- **Usernames**: gaming tags, forum names, code-hosting handles, including the ones you stopped using years ago.
- **Phone numbers** and **photos** you have posted or sent as files.

Then work the list one seed at a time, and record each finding with where you found it. The record matters, because most of the useful results come from pivoting: one finding gives you a new seed.

### Your name in search engines

Search your name in quotes, then add context: `"Alex Rivera" Lisbon`, `"Alex Rivera" "Example Corp"`. Check the Images tab as well. Google documents the [`site:` operator](https://developers.google.com/search/docs/monitor-debug/search-operators/all-search-site), which narrows the search to one site, for example `"Alex Rivera" site:linkedin.com`.

Look out for pages that show your home address or phone number, often on people-search sites. Google's [Results about you](https://support.google.com/websearch/answer/12719076?hl=en) tool lets you add your phone number, home address and email address, see the results that contain them and ask for their removal. The same help page notes that removal from Google Search does not remove the information from the web page itself; for that you contact the site owner.

To catch new results later, a [Google Alert](https://support.google.com/websearch/answer/4815696) on your name in quotes emails you when new results appear.

## What can someone learn from just my email address?

From an email address alone, someone can check which breaches it appeared in, whether it has a public profile attached to it, and which public code or documents carry it. Here is what each check returned on our side for a fictional address, run on 2026-11-12.

### Profile sites that key on your email

Some services look a profile up by a hash of your email address. A hash is not a secret: anyone who has your address can compute it. Gravatar's documentation says to [trim the address, lowercase it and hash it with SHA-256](https://docs.gravatar.com/rest/hash/), then query its public profile API with the result:

```bash
EMAIL="alex.rivera@example.com"
HASH=$(printf '%s' "$EMAIL" | tr 'A-Z' 'a-z' | shasum -a 256 | cut -d' ' -f1)
echo "$HASH"
curl -s "https://api.gravatar.com/v3/profiles/$HASH"
```

```text
73793e1868d3a535efc21cd73d873de29ead15bb7f234dfe1622d090478500c7
{"error":"Profile not found"}
```

A `Profile not found` result is what you want for your own addresses. If a profile comes back instead, read it as a stranger would: a display name, a photo, links to other accounts, often a username you can add to your seeds. Run it for each address you use, and edit or hide what you would not hand to a stranger.

### Breach notification services

[Have I Been Pwned](https://haveibeenpwned.com/) lets you check whether an email address appears in known breaches. Use its website for your own addresses. A hit tells you which service lost data and what kind of data it was, which tells you which password to change. Do not go looking for the leaked data itself: you only need the fact that your address was in a breach.

Passwords can be checked too, without sending them anywhere. The free [Pwned Passwords API](https://haveibeenpwned.com/API/v3) uses k-anonymity: you send only the first five characters of the password's SHA-1 hash and compare the returned suffixes on your own machine. We ran it with a typical "strong-looking" password that we made up for this test:

```bash
P='Summer2024!'
H=$(printf '%s' "$P" | shasum -a 1 | cut -d' ' -f1 | tr 'a-f' 'A-F')
curl -s "https://api.pwnedpasswords.com/range/${H:0:5}" | grep -i "^${H:5}"
```

```text
A3433F1210A9699D85420E363A1B162ECAC:3614
```

That suffix was one of 1,957 that came back for the prefix `7E8B0`, and the number after the colon says this exact password appeared 3,614 times in the breach corpus when we ran it on 2026-11-12. A random 16-character password from a password manager returned no match. If one of your real passwords matches, change it everywhere you used it. Type real passwords only into a script you have read, as here, where only the hash prefix leaves your computer.

### Git commits and documents

If you have ever pushed code, your commits may carry your email address. Git records whatever `user.email` was set to, and anyone can read it from a public commit. In a scratch repository with the persona's settings:

```bash
git log --format='%an <%ae>'
git format-patch -1 --stdout | head -3
```

```text
Alex Rivera <alex.rivera@example.com>
From faccf0a4339eba5661385ef9e288bbfbb4e09d8e Mon Sep 17 00:00:00 2001
From: Alex Rivera <alex.rivera@example.com>
```

GitHub lets you [set a noreply commit email address](https://docs.github.com/en/account-and-profile/how-tos/email-preferences/setting-your-commit-email-address) for future commits, and its documentation says commits made before the change keep the old address. That is the general rule of self-OSINT: you can stop new exposure more easily than you can erase old exposure.

## What do my usernames and photos give away?

A reused username links accounts you thought of as separate, and a photo can carry the place and time it was taken. Both turn small findings into a profile of your habits.

### Usernames

Search each handle in quotes, and open the profile page at the sites you remember using. Read bios and linked accounts: a code-hosting profile that links to a personal site, which names a city, which matches a running-app profile, is a chain. If a handle connects a professional account to a private one, split them or remove the links.

Watch for the answers to security questions. Pet names, schools and first cars come up in public posts more often than people expect. In [this CyberGym walkthrough](https://hackergpt.org/blog/osint-ctf-security-question-reset/) a password is reset by answering a security question from public information, and the [password OSINT walkthrough](https://hackergpt.org/blog/password-osint-ctf-walkthrough/) recovers a password built from a public fact. NIST's current guidance says verifiers [must not prompt users to use knowledge-based authentication or security questions](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/) when choosing passwords. Where a service still asks, give a random answer and store it in your password manager.

### Photos and their metadata

Phone cameras can write the GPS position, the camera model and the time into a photo's EXIF metadata. To see what that looks like, we wrote the tags a phone writes into a test image (the coordinates are a public landmark, not anyone's home), then read them back with [ExifTool](https://exiftool.org/):

```bash
exiftool -Make -Model -DateTimeOriginal -GPSPosition holiday.jpg
```

```text
Make                            : Apple
Camera Model Name               : iPhone 15
Date/Time Original              : 2026:07:14 18:32:05
GPS Position                    : 48 deg 51' 30.24" N, 2 deg 17' 40.20" E
```

Removing it is one command. After it, the same read prints nothing:

```bash
exiftool -all= holiday.jpg
exiftool -Make -Model -DateTimeOriginal -GPSPosition holiday.jpg
```

Some platforms strip this data when you upload, and others keep it, so check the file as it will actually be published or sent, not the copy on your phone. Then look at the picture itself: street signs, the view from a window and reflections give a location away even with no metadata. The [photo geolocation OSINT walkthrough](https://hackergpt.org/blog/photo-geolocation-osint-ctf/) shows how much a single image can reveal.

## How do I remove what I found?

Fix what helps someone take over an account or find you physically first, then reduce the rest. A practical order:

1. **Passwords and recovery.** Change every password that appears in a breach or in Pwned Passwords, use a unique one per site, turn on multi-factor authentication, and replace security-question answers with random ones.
2. **Home address and phone number.** Use Google's [Results about you](https://support.google.com/websearch/answer/12719076?hl=en) to request removal from search, and contact the site owner to remove it at the source. In the EU, the GDPR gives you a [right to erasure](https://gdpr-info.eu/art-17-gdpr/) in defined cases. California residents can send one deletion request to registered data brokers through the state's [Delete Request and Opt-Out Platform (DROP)](https://cppa.ca.gov/data_brokers/); brokers must process those requests from August 1, 2026.
3. **Profiles.** Delete accounts you no longer use, make the rest private where that fits, and remove cross-links between professional and personal profiles.
4. **Code and files.** Switch to a noreply commit address, and strip metadata from photos and documents before you share them.
5. **Repeat.** Keep the seed file and run the audit again every few months; the alert catches the new results in between.

None of this makes you invisible. Archived copies, data you shared with a company, and posts by other people about you may stay out of your reach. The aim is to make the obvious path harder: fewer facts for a phishing pretext, no reused passwords, no answers to your security questions in public.

To keep practising OSINT on legal targets after this, the OSINT challenges on [CyberGym](https://cybergym.hackergpt.app) are built for it.

## Key takeaways

- Write your seeds down first: every name, email address, username and phone number you use, old ones included.
- Record each finding with its source, and turn each finding into a new seed. Most exposure appears through pivots, not the first search.
- Check passwords with the k-anonymity range API, and change any that appear in a breach corpus, everywhere they were used.
- Strip metadata from photos and files before you share them, and set a noreply email for code commits.
- Fix what enables account takeover or physical location first, then repeat the audit on a schedule.

## FAQ

### Is it legal to do OSINT on yourself?

Yes, looking up public information about yourself is legal in general, and it is a common privacy and security practice. Stay with public sources: do not log in to accounts that are not yours, and do not download leaked breach data, even when it is about you. Checking whether your address appears in a breach through a notification service is enough.

### What is the first thing to search when doing OSINT on yourself?

Start with your full name in quotes plus your city or employer, then each of your email addresses. These two seeds usually lead to the profiles, usernames and photos you check next. Write down each finding and where you found it before you move on.

### Can I remove my personal information from Google?

You can ask Google to remove search results that show your phone number, home address or email address through its Results about you tool. Removal takes the result out of Google Search only; the page still exists until the site owner removes it. Contact the site directly, or use a legal right to erasure where one applies.

### How often should I check my digital footprint?

A full self-audit every few months is a reasonable rhythm for most people, plus a search-engine alert on your name for new results in between. Run it again after a breach notification, a job change or a move, because those change which seeds matter.

### Does deleting a post remove it from the internet?

Not necessarily. Copies can remain in web archives, search caches, screenshots and other people's reposts, and old Git commits keep the email address they were made with. Deleting stops new people finding it on the original page; it does not recall copies that already exist.

## Sources

- MITRE ATT&CK: [Gather Victim Identity Information, T1589](https://attack.mitre.org/techniques/T1589/)
- Google Search Central: [The site: search operator](https://developers.google.com/search/docs/monitor-debug/search-operators/all-search-site)
- Google Search Help: [Find and remove personal info in Google Search results](https://support.google.com/websearch/answer/12719076?hl=en)
- Google Search Help: [Create an alert](https://support.google.com/websearch/answer/4815696)
- Gravatar: [Creating the identifier (hash)](https://docs.gravatar.com/rest/hash/)
- Have I Been Pwned: [website](https://haveibeenpwned.com/) and [API v3, including Pwned Passwords](https://haveibeenpwned.com/API/v3)
- GitHub Docs: [Setting your commit email address](https://docs.github.com/en/account-and-profile/how-tos/email-preferences/setting-your-commit-email-address)
- NIST SP 800-63B-4: [Authenticators](https://pages.nist.gov/800-63-4/sp800-63b/authenticators/)
- ExifTool: [official site](https://exiftool.org/)
- GDPR: [Article 17, right to erasure](https://gdpr-info.eu/art-17-gdpr/)
- California Privacy Protection Agency: [Data brokers and the DROP](https://cppa.ca.gov/data_brokers/)