Press enter to see results or esc to cancel.

6 Secret Ninja Tricks for Finding Prospects’ Email Addresses

As a content marketer, outreach is one of the most important things you’ll do. In fact, Social Triggers founder Derek Halpern believes we should spend just 20% of our time creating content, and the other 80% promoting it (of which outreach is highly likely to play a huge part).

What’s your ratio? If you’re like most people, it’s probably nowhere near that 80-20 split. But it should be. It’s much faster and more valuable to get more eyes on content you’ve already made than it is to create new stuff.

It might sound too easy, maybe even lazy. If so, you’re vastly underestimating the time and effort it takes to do promotion properly. It’s not a schedule-on-Hootsuite-and-be-done situation.

Unfortunately, even when all the ingredients are in place – an awesome piece of content and a great outreach email – one little problem can still manage to trip you up. Any guesses?

Not being able to find the email address of the person you want to contact.

Thankfully, if you know a few insider tricks of the trade, tracking down that elusive email address is much easier than you might think. In fact, anyone can do it.

Here are 6 super secret ninja tricks that you can use to help you find prospects’ email addresses.

1. Use a Tool

Using a tool isn’t exactly a trick, but the more tools you have in your arsenal, the better equipped you’ll be for finding virtually anyone’s email address.

While this isn’t a comprehensive list of all the email-finding tools out there, these are the ones I use or have used, and can personally vouch for.

Contact Out
Contact Out is one of the best email-finding tools I’ve used, by far. It’s a Chrome plugin that automatically pulls in any available contact details (typically an email address and phone number at a minimum) when you visit a prospect’s LinkedIn Page. It gets multiple email addresses for most LinkedIn users, including personal (ie. addresses and business addresses.

The extension is used by recruiters at about 30% of the Fortune 500.

Voila Norbert
Norbert is fairly new to the email-finding game, but has quickly amassed a loyal following. It promises to “find anyone’s corporate email” using its email identification algorithm. Trusted by Facebook, Airbnb, Twitter, and Intel among others, you can try the service for yourself. Sign up and you get 50 leads for free.

Pricing comes in two varieties: pay-as-you-go at $0.10/lead, or a monthly subscription starting at $49 for 1000 leads. Additionally, Norbert can also verify your entire email list, helping you remove old and dead addresses.

Find That Email
Another Chrome extension, Find That works right from the browser and promises a 90% delivery rate.

Plans start at $29/month for 500 leads.

Email Checker
This one’s really useful if you think you know the email address of the person you want to contact, but you want to double check that it’s correct before you waste time sending an email that’s just going to bounce right back.

Email Hunter doesn’t check whether any of the addresses are correct or live; it simply searches the web for mentions of addresses that match the domain in question.

That means that once you have an address you *think* is correct, you can head over to Email Checker and confirm it’s genuine and live.

“How to write a good email: 1. Write your email 2. Delete most of it 3. Send.” ~Dan Munz

2. Check Twitter

People – especially journalists and bloggers who are open to emails from cold contacts – often put their address in their Twitter bio.

If you’re on their website, and they use Twitter, chances are the icon will feature pretty prominently on their site (often in the header, but if not, try the footer). Sometimes it’s a little more hidden (often on their contact page). Seek it out.

Alternatively, you can search Google for “[their name] + twitter.” Of course, if there are lots of people on Twitter with their name, it might be a little tricky to pinpoint the person you’re trying to find.

You can often get around this by adding the industry they work in to your search. For example, to find my Twitter profile you could search for “sujan patel marketing + twitter.”

But, if your prospect’s email address isn’t in their Twitter bio, all is not lost.

You can try performing an advanced Twitter search to see if they’ve ever been mentioned in a tweet.

Simply enter (at) (dot) in the “all of these words” box, and the Twitter handle of the person’s email address you’re after in the “from these accounts” box. If they’ve ever mentioned an email address in a tweet, you’ll find it.

Twitter search screenshot

Finally, you can use All My Tweets to view and search all your prospect’s tweets on a single page.

3. Find the Company Format and Take a Guess

Most companies use a standard format for email addresses, so if you can’t find the address for the specific person you want to contact, find the email address for someone at the company, and edit it accordingly.

If you know their first name, last name, and the company domain name, this should be easy enough. A bit time-consuming, yes, but it’s been the go-to method for years.

You can also use the aforementioned Email Checker – or the very similar MailTester or Email Verifier – to check if it works before writing your email and hitting send.

Email has an ability many channels don’t: creating valuable, personal touches – at scale.” ~David Newman

4. Use an Email Permutator

An email permutator uses a person’s name and the domain they’re associated with to generate as many permutations (i.e. combinations) of addresses that, based on common email formats, could be correct.

I use this Google Sheets permutator. To try it yourself, open the doc, click “File,” then “Make a Copy.”

From there you enter your prospect’s name and domain into the yellow boxes. As you do this, possible permutations of the address will appear in the green box on the left-hand side.

Screenshot of Google Sheets permutator

What you’ll also notice is that the suggested permutations appear in order, according to how common the formats are (most common at the top; least common at the bottom).

That makes the next step – using a tool like Email Checker, Email Verifier, or MailTester to find out if an address works – much easier. Simply start from the top, and work your way down.

If you prefer a website app to a Google document, check out Email Permutator+ from Metric Sparrow. Enter what you know, hit the blue button, and get a complete list of possible combinations.

5. Subscribe to Their Newsletter

A lead that happens to be an influencer or industry leader – or even someone on their way to becoming one of those – will more than likely have a personal website and/or blog that allows you to subscribe. Sign up.

Not only is this an opportunity to get to know them a little better before first contact, but you’ll receive that much sought-after address in either the from: field, or at the bottom of the email message.

If #socialmedia is the cocktail party, then #emailmarketing is the ‘meet up for coffee’. The original 1 to 1 channel.” ~Erik Harbison

6. Ask Them

If you’ve tried all of the above and you still can’t find your prospect’s email address, there’s one last thing you can try…

Asking them.

Data means « given » in Latin. So kindly ask your clients to share it with you.” ~Benoît De Nayer

Chances are your prospect has listed a social media profile you can use to contact them, or if not, a phone number. Contact them through one of these channels and ask for their email address (it helps to explain why you’d like it, too).

Better yet, this is also a great opportunity to “warm them up” to your real ask, and that means you won’t be sending a cold email.

That’s 6 ninja tricks for finding prospects’ email addresses, but there are plenty more. Do you know of any other tricks or tools you’d like to share? How do you find an address you need? Leave your thoughts in the comments below:



Bo Lais

I use these methods myself and it works. Sometimes you have to roll up the sleeves and put the time in, but it’s worth it! Email Hunter is one of my latest favorite tools.


Hi Sujan, this is a great article and come in at the right timing.

I am an active user of Mailshake and always find it trouble to find prospect emails efficiently.

Currently, I am using Ninja Outreach to extract the emails and domain hunter to extract second round for those who failed in Ninja Outreach.

I will implement some of your tricks in conjunction of what I am using.



A nice combination is email hunter with the rapportive Gmail extension to check the validity of the email.


And Email Hunter can be combined to Mailshake, as I wrote it on my blog 😉

Sujan Patel

Great write up Fred!


Nice bio 😉

Sujan Patel

LOL thanks 🙂

Danny Donchev

Hi Sujan,

Great post! Actually, emails often can be found at website’s Facebook page or YouTube About page. You may want to include these two when you update the article.


Sujan Patel

Great addition Danny. I’ll add those in the next update.


Quite educative, I specially like Fred’s tip on combining Hunter and Mailshake.

A question, Sujan. Does Mailshake allow multiple campaigns? I’ve tweeted you a message on this as well.

Sujan Patel


Sorry for not answering earlier I must have missed your tweet. Yes, you can have multiple campaigns running on Mailshake.


Email checking tools that check the mail servers MX records are not particularly helpful in practice.

This is because most mail servers have a catchall configured. Without this, spammers would be able to brute-force scan mail servers and spam real mailboxes. So just because a mail server accepts mail to a particular mailbox, does not mean its going to the person you intended to send it to.

Simon Zaku

So cool, Sujan.

This article came at the right time.

Using the tips here for a campaign I’m working on.

Thanks, Sujan!

Simon Zaku.


Email hunter can’t be used as an extension on Linkedin 🙁
That’s a pity. It was my favourite tool to use.


I use ScoutZen and Followerwonk to get CSV files of Twitter followers of influencers in my industry and then run those CSV files through

Sujan Patel


Awesome process!

5 Reasons Your Emails Fail That Have Nothing to Do with the Email Content - Mailshake Blog

[…] wondering if your emails are going to spam folders instead of inboxes, send a few tests to various email addresses with different […]

How to Leverage Email Outreach to Get the Most Out of Your Conference Experiences - Mailshake Blog

[…] Check their social media profiles or personal websites. Contact details are often listed in the “About” section. If not, try a tool like Voila Norbert or ContactOut to assist. Just find it. […]

Neeraj Kadam

Hi Sujan,

Thank you for sharing this, the article is great. I use ClearBit chrome extension to find the emails. Its the most easiesst tool I found out to be.

The best thing is, it gives you the Company email address of the desired person, and not his personal address.

You might want to add it to your list, it probably will make the top spot.

A Happy MailShake User! 🙂

Ryan Buckley

I’ll add one more email finder to your list:

Toofr has a few features the others don’t which are really helpful for recruiters and sourcers. First, it will find emails and it will also verify emails. In addition to that, you can buy or sell lists on the Toofr marketplace ( and use Toofr’s email finder API and bulk email processing for batch uploads.

There’s also which will give you the right email address for any of your bounced emails. Super helpful when someone changes jobs!


Interesting tools here. I come across I really like that tool for Linkedin leads


There’s another ninja out there named OxyLeads ( Give it a try in case of the update.


This is interesting tools. Easy to understand and helpful. But I’m just not good at it. Cold emails, seems not for me. Thank you so much Sujan.

Jahangir Alam

Hello sir,
My first question is, how many emails can I send within 24 hrs ( per day ) ?
And how many in one hour should I send?


Leave a Comment