OSINT Framework explained, and the monitor to run next to it

OSINT Framework is a free website that sorts open-source intelligence resources into a clickable tree, grouped by what you start with: a username, an email address, a domain, an image or a company. It shows you where to look, not what changed, so pair it with a monitor such as AyeWatch for the subjects you need to keep checking.

What OSINT Framework is

Open-source intelligence means collecting and analyzing information that anyone can legally reach: news, public records, company sites, public social posts and web archives. OSINT Framework is a directory for that work. Justin Nordine built it from an information security point of view, and people from other fields now use it too. Its notes say the aim is to point you to free resources, with a warning that some listed sites ask you to register or charge for more data.

The project is open source under the MIT license on GitHub, and the whole list lives in a single JSON file. As of November 2026 that file holds about 1,170 links across 33 top-level branches, from Username and Domain Name to Public Records, Archives, Dark Web and AI Tools.

How the tree works

Click a branch to open it, and keep clicking until you reach a tool. Clicking a tool opens a side panel with:

• its path in the tree and an "Open Tool" button
• a status badge (live, degraded or down) and a pricing badge (free, freemium or paid)
• a description, the input it takes and the output it returns
• OPSEC notes saying whether the tool is passive or sends requests to the target

A search box at the top matches tool names and descriptions. The letters after some names are the legend: (T) means you install and run the tool locally, (D) is a Google dork, (R) needs registration, and (M) means you edit the search term into the URL by hand.

What it does not do

The framework is a map. It does not run lookups for you, keep your results, or tell you when a page, a filing or an account changes. Its own data marks 42 entries as down and 44 as degraded (as of November 2026), so read the status badge before you trust a link. And most investigations return to the same sources week after week, which is where the hours go.

Where AyeWatch fits

AyeWatch picks up once you know what to watch. Write the subject in plain English, paste the URL of a page, or point it at a public X profile, a subreddit, a YouTube channel, or a LinkedIn, Instagram or TikTok account. It checks on a schedule and sends a short brief of what changed, with links back to the sources. Its OSINT glossary entry says it covers the surface web, so treat it as a public web monitor, not a tool for forums or the dark web.

For ongoing research, set up AyeWatch first and keep OSINT Framework open as the reference for one-off lookups. If all you need today is a single lookup, the framework on its own is the better choice, and a monitor adds nothing.

Stay on public sources

Respect each site's terms and your local law. Keep the work on organizations, topics and your own exposure, and never use these tools to follow or profile private people.