How to Find Any Decision-Maker's Email Without Paying for a Database
Seven practical methods - ranked by effort and accuracy - that B2B sales teams use to find verified contact info in 2026. No ZoomInfo. No Apollo subscription. Just the actual process.
HOW TO USE THIS CHEATSHEET
Methods are ordered fastest-to-most-thorough. For one-off lookups, start at Method 1. For batch prospecting (50+ contacts), jump to Method 4 or 5. Always finish with Step 7 - sending to an unverified email bounces, hurts your sender reputation, and wastes the effort of the six steps before it.
1. Company website - About, Team, Leadership pages
The most underused method. Many companies list direct emails on their leadership pages, and even when they don't, they reveal the email pattern used across the domain - which is just as useful.
What to look for:
- → /about, /team, /leadership, /our-team pages
- → Blog author bios - editors often include contact emails
- → Press/media pages (usually have a direct PR contact)
- → Any listed email - even generic ones reveal the format
2. LinkedIn profile + Contact Info section
LinkedIn is step one for identifying who the right person is at a company. A surprising number of executives also list their direct email in the "Contact Info" section of their profile - it takes 10 seconds to check and most people skip it entirely.
How to find the right person:
- → Search: [Company Name] + [Title/Seniority]
- → Filter by "Current company" to exclude past roles
- → Seniority signals: VP, Director, Head of, Chief, Lead
- → Check "Contact Info" tab on their profile
3. Google search operators
Google indexes a huge amount of publicly available contact information - press releases, speaking bio pages, podcast show notes, and cached contact pages. Search operators let you query it precisely instead of scrolling through noise.
site:company.com "email" OR "@company.com""John Smith" "company.com" email"John Smith" "company.com" "@" filetype:pdf4. Email pattern guessing + verification
Once you know one real email at a company (from any method above), you know the entire org's email format. You can then construct any email address at that company and verify it before sending.
The 6 most common B2B formats:
Free tools to find patterns:
- ✓Hunter.io domain search (free 25/mo) - paste domain, shows email format and verified examples.
- ✓Email Permutator - generates all format variations from a name and domain.
5. Free-tier browser tools comparison
You don't need a paid subscription to use the best contact-finding tools. All major platforms have usable free tiers that cover the typical prospecting needs of solo founders and small sales teams.
| TOOL | FREE LIMIT | BEST FOR | ACCURACY |
|---|---|---|---|
| Hunter.io | 25 searches/mo | Domain patterns, B2B emails | STRONG |
| Apollo.io Chrome | 100 credits/mo | LinkedIn profile lookups | STRONG |
| Snov.io | 50 credits/mo | Name + domain lookup | GOOD |
| Lusha | 5 credits/mo | Ad-hoc C-suite lookups | GOOD |
| Prospeo | 75 credits/mo | Generous free tier | STRONG |
Stacking free tiers: 25 + 100 + 50 + 75 = 250 free verified lookups per month without paying a single dollar.
6. Public signals: podcasts, press releases & conferences
Decision-makers who appear on podcasts, speak at conferences, or are quoted in press releases are publicly active. Finding them gives you both their contact info AND a ready-made non-cold opening hook.
Podcasts
Show notes almost always list guest LinkedIn and direct emails. Search "[Name] podcast".
Press Releases
PR Newswire releases list media contacts with direct domain emails, revealing full email formats.
Conferences
Speaker directories list names, titles, and bios with direct contact links.
7. Verify every email before sending
⚠ MANDATORY PROTOCOLThis isn't a method for finding emails - it's the mandatory final step. Sending to unverified lists with 5%+ bounce rates get your domain throttled or suspended. Always run emails through a verifier before campaign launch.
Free Verification Options:
- ✓Hunter.io Verifier - 50 free checks/mo for syntax, domain, and SMTP handshake.
- ✓Mailmeteor Verifier - Instant one-off lookups with zero signup required.
- ✓Snov.io Bulk Verifier - Upload CSV lists for batch checking.
Which method should you use?
Finding 1 specific person right now.
- 1. Check LinkedIn Contact Info
- 2. Check Company About page
- 3. Hunter.io free search
- 4. Verify with Mailmeteor
Building an outreach campaign for a segment.
- 1. LinkedIn title filtering
- 2. Get email pattern on Hunter
- 3. Generate via Email Permutator
- 4. Bulk verify via Snov.io
Consistent volume without database fees.
- ⚡ Free tool limits exhaust
- ⚡ Manual research bottleneck
- ⚡ Outsource to BeBaat
5 mistakes that waste all your research effort
Research that leads to "Hi [FirstName], I wanted to reach out..." is wasted. Contact research and opening hooks must come from the same process.
Bounce rates over 5% trigger domain throttling across Google Workspace and Microsoft 365. Always verify every address.
Junior staffers have no purchase authority. Contacting them wastes sending volume and alerts decision-makers to block your domain.
Emails on public sites are often outdated by 12–18 months. Finding an email is not the same as verifying it.
Manual research ROI degrades fast after 15 minutes. High-value accounts need depth, but batch prospecting requires a system.
We execute all 7 steps. You get the pre-researched spreadsheet.
BeBaat finds your exact decision-makers, verifies every email address with 0% bounce guarantee, and writes custom research notes and openers for every prospect.
No dashboard subscriptions. No annual lock-in. Just ready-to-send prospect dossiers.