Kerlooo/FreeOSINTUI

 _____               ___  ____ ___ _   _ _____     _   _ ___
|  ___| __ ___  ___ / _ \/ ___|_ _| \ | |_   _|   | | | |_ _|
| |_ | '__/ _ \/ _ \ | | \___ \| ||  \| | | |_____| | | || |
|  _|| | |  __/  __/ |_| |___) | || |\  | | |_____| |_| || |
|_|  |_|  \___|\___|\___/|____/___|_| \_| |_|      \___/|___|

OSINT-UI is a great collection of open-source intelligence tools, but only a handful of them are free, and even those are capped at a few uses per month. Everything else sits behind a subscription.

Most of those lookups don't need a paid service at all: they only need the right free public sources and a clean interface. FreeOSINT-UI brings them together:

• 🆓 Free forever. Every tool, with no limits apart from the rate limits of the public APIs themselves.
• 🔒 Browser-first. 15 of the 20 tools run entirely in your browser. Files you analyze never leave your device, and passwords you check are never sent anywhere (only 5 characters of their hash are).
• 👁️ Passive only. Public sources and public data. No active scanning, no logins, no bypassing access controls.
• 🧩 Connected. Tools link to each other: go from an email to its breaches, or from a phone number to ready-made Google dorks, in one click.

* Needs the Python backend (see below). † Works with the static site alone; some sections need the backend. Every other tool works entirely with the static site.

• Node.js 20.19+ or 22.12+ and npm
• For the backend only: uv and Python 3.14+ (uv can install Python for you)

git clone https://github.com/Kerlooo/FreeOSINTUI.git
cd FreeOSINTUI
npm install
npm run dev

Open http://localhost:5173. That's it: 15 tools are already fully working, and 3 more partly.

In a second terminal:

cd backend
uv sync
uv run uvicorn app.main:app --reload --port 8000

In development, Vite forwards /api requests to http://127.0.0.1:8000, so there is nothing else to configure. Interactive API docs are at http://localhost:8000/api/docs.

npm run dev:all

Starts both servers in one terminal, with [web] / [api] prefixed logs. Ctrl+C stops both, and if one of them crashes the other is stopped too.

The frontend is a fully static site: upload the build/ folder to any static host (GitHub Pages, Netlify, Cloudflare Pages, Vercel, nginx…).

The backend is optional. If you host it on another origin:

The rate limiter is in memory and keyed on the client IP. Behind a reverse proxy, all users would share one limit.

Frontend

• SvelteKit + Svelte 5 (runes), plain JavaScript and CSS
• @sveltejs/adapter-static: every page is prerendered
• Vite, Vitest, ESLint, Prettier
• hash-wasm (hashing), exifr (image metadata), fflate (Office/PDF decompression), libphonenumber-js (phone numbers)

Backend

• FastAPI + uvicorn, httpx, Beautiful Soup
• uv for dependency management, pytest + respx for tests

Architecture in one line: tools run in the browser whenever a public API allows it. The backend exists only for what a browser can't do (sites blocked by CORS, pages that must be inspected server-side). It exposes one endpoint per tool with fixed targets and is never a generic proxy.

src/
├── routes/<tool>/+page.svelte   # one page per tool
├── lib/<tool>/                  # tool logic in plain JS, with *.spec.js tests
├── lib/components/              # UI components (one per file)
├── lib/tools.js                 # the list of tools shown in the home page and navbar
└── lib/net.js, dns/, rdap.js    # shared helpers for public APIs
backend/
├── app/                         # FastAPI app, one router per tool
├── data/wmn-data.json           # WhatsMyName site list
└── tests/

FreeOSINT-UI stands on the shoulders of these free public services and projects:

WhatsMyName (CC BY-SA 4.0) · XposedOrNot · Have I Been Pwned – Pwned Passwords · Shodan InternetDB · rdap.org · Google Public DNS · crt.sh · Cert Spotter · Internet Archive · ipwho.is · Gravatar · disposable-email-domains · mempool.space · litecoinspace.org · Blockscout · GitHub REST API · AlienVault OTX · StopForumSpam · Tor Project · Spamhaus DROP · abuse.ch URLhaus & ThreatFox · urlscan.io · Common Crawl · IEEE Registration Authority

Inspired by OSINT-UI.

FreeOSINT-UI only queries public sources, but the results can still concern real people. Use it for legitimate purposes: security research, investigations you are authorized to carry out, and checking your own exposure. Respect the terms of service of each data source and the privacy laws of your country (e.g. GDPR). Results can be wrong or out of date: treat them as leads to verify, not as proof.

FreeOSINT-UI is released under the Apache License 2.0 with the Commons Clause.

• ✅ Use it freely, for personal or business purposes, inside your company included.
• ✅ Modify and share it, as long as you keep the LICENSE and NOTICE files, which credit the original author.
• ❌ Don't sell it. You may not offer FreeOSINT-UI, or a product or service whose value comes substantially from it, for a fee (paid hosting and paid support included).

Because of the no-selling condition this is a source-available license, not an OSI-approved open-source one. The bundled WhatsMyName data (backend/data/wmn-data.json) keeps its own CC BY-SA 4.0 license.

Made by kerlo: GitHub · LinkedIn

If you find it useful, leave a ⭐ on the repository!