How to Find Any Decision-Maker's Email Without Paying for a Database
Seven practical methods — ranked by effort and accuracy — that B2B sales teams use to find verified contact info in 2026. No ZoomInfo. No Apollo subscription. Just the actual process.
How to use this cheatsheet
Methods are ordered fastest-to-most-thorough. For one-off lookups, start at Method 1. For batch prospecting (50+ contacts), jump to Method 4 or 5. Always finish with Step 7 — sending to an unverified email bounces, hurts your sender reputation, and wastes the effort of the six steps before it.
The 7 methods
Company website — About, Team, Leadership pages
Effort: Low Accuracy: HighThe most underused method. Many companies list direct emails on their leadership pages, and even when they don't, they reveal the email pattern used across the domain — which is just as useful.
What to look for:
- → /about, /team, /leadership, /our-team pages
- → Blog author bios — editors often include contact emails
- → Press/media pages (usually have a direct PR contact)
- → Any listed email — even a generic one reveals the format
john@company.com
john.doe@company.com
jdoe@company.com
j.doe@company.com
# Find one → know them all
LinkedIn profile + Contact Info section
Effort: Low Best for: Decision-maker IDsLinkedIn is step one for identifying who the right person is at a company. A surprising number of executives also list their direct email in the "Contact Info" section of their profile — it takes 10 seconds to check and most people skip it entirely.
How to find the right person:
- → Search: [Company Name] + [Title/Seniority]
- → Filter by "Current company" to exclude past roles
- → Seniority signals: VP, Director, Head of, Chief, Lead
- → Check "Contact Info" tab on the profile — often has email
- → Check their featured posts/articles for contact details
Free LinkedIn limits
Sales Nav starts at ~$99/mo — worth it if you're doing 50+ prospects/week
Google search operators
Effort: Medium Best for: Indexed emailsGoogle indexes a huge amount of publicly available contact information — press releases, speaking bio pages, podcast show notes, and cached contact pages. Search operators let you query it precisely instead of scrolling through noise.
site:company.com "email" OR "@company.com"
# Find a specific person's contact
"John Smith" "company.com" email
# Find cached contact pages
site:company.com intitle:"contact"
# Find press mentions with emails
"John Smith" "company.com" "@" filetype:pdf
# Conference speaker bios (often list emails)
"John Smith" "VP Sales" "company" "email"
Pro move: Add the target's name, company, and "email" to Google Images search — speaker profile photos on conference sites often appear with full bios that include contact info.
Email pattern guessing + verification
Effort: Low High scale valueOnce you know one real email at a company (from any of the methods above), you know the entire org's email format. You can then construct any email address at that company and verify it before sending — no database required.
The 6 most common B2B formats
firstname.lastname@
firstnamelastname@
f.lastname@
flastname@
firstname_lastname@
Free tools to find the pattern
- → Hunter.io domain search (free, 25/month) — paste the company domain, it shows the email format and real verified examples.
- → Email Permutator (free web tool) — generates all format variations from a name and domain for bulk checking.
⚠ Critical rule
Always verify before sending. Guessing without verifying means bounce rates above 5%, which can get your domain suspended. Never send to an unverified guessed address.
Free-tier browser tools (Hunter, Apollo, Snov)
Effort: Very Low Best for: Quick lookupsYou don't need a paid subscription to use the best contact-finding tools. All three major platforms have usable free tiers that cover the typical prospecting needs of a solo founder or a small sales team.
| Tool | Free limit | Best for | Accuracy (2026) |
|---|---|---|---|
| Hunter.io | 25 searches/mo | Domain patterns, B2B emails | Strong |
| Apollo.io Chrome ext. | 100 credits/mo | LinkedIn profile lookups | Strong (US) |
| Snov.io | 50 credits/mo | Name + domain lookup | Good |
| Lusha | 5 credits/mo | Ad-hoc C-suite lookups | Good |
| Prospeo | 75 credits/mo | Most generous free tier | Strong |
Stack free tiers across tools — 25 + 100 + 50 + 75 = 250 free lookups/month with no paid subscription
Public signals: press releases, podcasts, conferences
Effort: Medium Best for: Warm contextThis method doubles as your personalization research. Decision-makers who appear on podcasts, speak at conferences, or are quoted in press releases are publicly active — which means their contact info is more findable and you have a natural, non-cold hook to reference in your opening line.
Show notes almost always list the guest's LinkedIn and often a direct website or email. Search "[Name] podcast" or "[Company] founder podcast" — Apple Podcasts and Spotify index show notes.
PR Newswire, BusinessWire, and GlobeNewswire releases always include a media contact with direct email. Even if the contact is in PR, you now know the company's email format.
Speaker directories list name, title, company, and often a bio page with contact. Industry conference speakers are high-value prospects — they're publicly active and the event is a ready-made opener.
Why this matters beyond the email: Finding someone through a podcast or press release gives you a genuine, specific context for your opening line — which is what separates a 3% reply rate from a 15% one. The contact info and the personalization come in one step.
Verify every email before you send
⚠ Non-negotiableThis isn't a method for finding emails — it's the mandatory final step that determines whether all the work above was wasted. An unverified list with a 5%+ bounce rate will get your sending domain throttled or suspended. Recovery can take weeks. Verification costs close to nothing. There is no good reason to skip it.
Free verification options
- → Hunter.io — 50 free verifications/month. Checks syntax, domain, and mail server response.
- → Mailmeteor — free one-off lookups and verifications, no signup. Good for checking a handful of addresses.
- → Snov.io — bulk email verifier on the free tier. Upload a CSV and check multiple addresses at once.
What verification checks
Decision tree
Which method to use, when
You need to find one specific person's email right now.
You're building a campaign for a specific ICP segment.
You need consistent volume without a data subscription.
Before you start
5 mistakes that waste all the effort above
Finding the email, then sending a generic opener
Research that results in "Hi [FirstName], I wanted to reach out about our solution" is wasted research. The contact info and the personalization should come from the same process — you can't separate them and still get replies.
Skipping email verification
A bounce rate above 5% can get your domain suspended by your email service provider. Always verify before any batch goes into a sequence.
Emailing the wrong person at the right company
Junior employees have no purchase authority. Emailing them doesn't just fail — it can actively hurt your chances if they flag you as a nuisance before you ever reach the decision-maker.
Treating a found email as verified
An email that appears on a company page can be 18 months out of date. People change roles, leave companies, and switch domains. Finding ≠ verified. Always run it through a checker.
Spending 3 hours finding one email
If you've spent more than 15 minutes on one contact, move on. The ROI of manual research degrades fast — it makes sense for high-value strategic accounts, not batch prospecting.
The faster alternative
We do all 7 steps. You get the spreadsheet.
Everything in this cheatsheet is what Bebaat does — at scale, for your exact ICP, with a human reviewing every batch before it reaches you. We find the decision-maker, verify the contact info, and write a personalized opener based on what we actually found about them. New leads land in your Google Sheet on the schedule you set.
- ✓ Verified contact info per lead
- ✓ Personalized opener per lead — no mail-merge
- ✓ Delivered to your Google Sheet, weekly
- ✓ Human QC before every batch ships
No subscription. No dashboard. Just leads.