How to find someone's email on LinkedIn without breaking LinkedIn's rules: what a profile shows, what your own export holds, and when to simply ask.

How to find someone's email on LinkedIn, in short

There is one place on the platform where an address can appear. Open the person's profile, click Contact info in the introduction section, and read what is there. If the member published an email address, that is the answer, and no tool is needed.

Most of the time the field is empty, because LinkedIn hides the primary address from people who are not connected. That is a setting the member controls, not a lock you are meant to pick. Everything else in this guide happens outside LinkedIn, or with the member's help.

The honest set of methods is short: what the member published, what your own company already holds, your own connections export, the company website, an enrichment provider, and asking. This page covers all six, plus verification and the rules that decide what you may do with the result.

Where contact info lives on a LinkedIn profile

The Contact info section sits in the introduction area at the top of a profile. According to LinkedIn Help it can hold a direct link to the profile, an email address, a phone number, a website, instant messenger accounts and a birthday.

The email field is prefilled with whatever the member entered as their primary address at sign up. LinkedIn also says that some of this information is visible only to connections, while the rest is visible to other members.

• Websites: a personal site or a company page often carries a contact address, and members link them freely.
• The profile URL: useful for your records and for matching the person later, covered in our guide to changing a LinkedIn URL.
• Newsletter or About text: people who want to be reached write the address into the About section instead.
• Featured section: a pinned document, deck or article often has the author's contact details on the last page.

Read the whole profile before you reach for anything else. People who publish, speak or sell usually leave a way to be contacted, and finding it takes less time than any tool.

Why most profiles hide the address

LinkedIn Help states that by default the primary email address you registered with is visible only to your direct connections. Members can change that, and the choice is theirs to make in either direction.

There is a second, separate switch. LinkedIn lets members decide whether their connections may download their email address in a data export, with a simple yes or no. A person can show you the address on screen and still keep it out of your file.

To find your own settings, LinkedIn Help gives this path: the Me icon, Settings and Privacy, Visibility on the left rail, then Email visibility under visibility of your profile and network. Changes save automatically.

The practical consequence is worth stating plainly. An empty Contact info section is a decision, not an obstacle. Degree matters here, and our note on what 3rd means on LinkedIn explains how those circles are drawn.

The compliant methods, compared

The order matters. Each row costs more effort and gives less certainty than the one above, so start at the top. Teams that skip the first three rows pay a vendor for records they already owned.

Search what your company already holds first

Before any lookup, check the systems that already contain the person. This is the cheapest source of a correct address, and the only one where you can also see whether someone at your company has spoken to them before.

• The CRM: search by company domain, not only by name, since the record may sit under a colleague.
• Shared inboxes: support, billing and info addresses collect real contacts nobody logged.
• Calendar and meeting notes: invites carry the addresses of everyone who attended.
• Event and webinar lists: people who registered gave you an address and a reason to write.
• Your marketing database: the person may already be subscribed, which changes what you may send.

This step also protects you. Emailing someone who already asked your company to stop, or who is mid-deal with a colleague, costs more than a missed address ever does. Keeping that record clean is the whole point of lead enrichment.

Export your own connections' data from LinkedIn

LinkedIn lets you download your own account data, and that archive includes your connections. This is the one bulk route the platform itself provides, and it covers only people who accepted your invitation.

1. Open your data privacy settings

   Click the Me icon on the LinkedIn homepage, select Settings and Privacy, then click Data privacy in the left pane.

2. Request a copy of your data

   Under how LinkedIn uses your data, click Get a copy of your data, choose the larger archive, then click Request archive.

3. Wait for the email

   LinkedIn says a single category arrives within minutes and the larger download within 24 hours, sent to your primary address.

4. Download inside the window

   The files stay available for 72 hours. LinkedIn asks you to download from a personal computer, and the feature is not on mobile.

5. Read the connections file

   It lists your first-degree connections with company and title. Email addresses appear only where the connection permitted it.

LinkedIn Help is direct about the gaps: you will only see email addresses for connections who allowed their connections to see or download their email address. You also cannot export anyone who is not a first-degree connection.

Ask for the address instead of hunting for it

Asking is the method every guide skips and every experienced seller uses. It takes one message, it gives you a correct address, and it gives you something no database sells: a person who expects your email.

LinkedIn's Professional Community Policies put a limit around all of this. The platform does not allow untargeted, irrelevant, obviously unwanted or gratuitously repetitive commercial messages, and asking for an address is not a loophole around that rule.

Company sites and the things people publish themselves

Once you have the name and employer from the profile, the rest of the search happens on the open web. You are looking for places where this person chose to publish a way to reach them.

• Team and about pages: smaller companies list names with addresses; larger ones list a pattern you can read.
• Author bylines: writers on a company blog often have a contact line at the end of their posts.
• Conference and webinar pages: speaker bios frequently carry a work address for press or questions.
• Published documents: reports, whitepapers and slide decks put the author's address in the footer.
• Press and investor pages: useful when you need the right department rather than the right person.
• Job ads from that team: hiring posts often name the manager and give an address for applications.

Two cautions. A shared inbox is not a personal address, and writing to it should read differently. And a published address does not mean published consent to receive marketing, which the legal section below covers.

Company email patterns, and the line not to cross

Most companies use one format for everyone. If you already hold one correct address at that domain, you can usually tell which format it is and build a candidate for your contact from their name.

The inference is legitimate: you are reasoning from an address you already had. What is not legitimate is turning it into volume. Generating addresses from lists of names and sending to all of them is a different activity with a different legal name.

The Federal Trade Commission lists dictionary attacks among the aggravated violations that can carry criminal penalties, describing them as sending email to addresses made up of random letters and numbers in the hope of reaching valid ones. Harvesting addresses appears in the same list.

Verification: what a checker can and cannot prove

Verification runs in two layers. The first checks the domain: does it exist, and does it publish MX records that say where its mail should go? A domain with no mail route cannot receive anything, and that check is cheap and reliable.

The second layer asks the receiving server whether a specific mailbox exists, and this is where certainty ends. The SMTP standard expects a server that has disabled address verification to answer with reply code 252, which means it cannot verify the user but will accept the message and attempt delivery.

RFC 5321 is explicit that a server which disables these commands must not appear to have verified addresses that are not in fact verified. Many operators disable them precisely to stop address harvesting, so a large share of domains can only ever return an honest "unknown".

Two labels deserve care. A catch-all domain accepts everything, so a pass tells you nothing about the mailbox. And a verifier that reports certainty on a catch-all domain is reporting its own optimism.

Free ways to find emails from LinkedIn

Every free method to find emails from LinkedIn is already in this guide. Gathered in one place, so you can work through them before anyone asks for a budget:

• Contact info: the free and correct answer whenever the member chose to publish an email address.
• Your own CRM and inboxes: a free search that often ends the hunt in seconds.
• Your connections export: LinkedIn gives you your own data at no cost, including connection emails where permitted.
• A web search for the name and the company domain: free, and it surfaces bylines, decks and speaker pages.
• The company website: team, press and support pages publish addresses on purpose.
• One LinkedIn message: free to send to a connection, and it returns a confirmed address rather than a guess.

Free email finder tools exist too, usually as a small monthly quota inside a paid product. They are a fine way to test a provider on a sample of your market, and a poor way to build a prospect list, because the quota runs out before the research does.

Email finder tools and enrichment services, as a category

An email finder tool takes a name, a company or a profile URL and returns a likely work address with a confidence signal. Enrichment services do the same at list scale. This page names no tool and prices none. What matters is the category and the questions you ask before buying.

• Where does the data come from? A provider that cannot describe its sources cannot help you answer a regulator.
• Is it collected from LinkedIn? The User Agreement forbids copying information obtained through data aggregators or brokers without the owner's consent.
• Does it run inside my browser session? Extensions that read profiles while you browse are the exact category LinkedIn prohibits.
• Can I pass suppressions back? You need a way to record objections so the same address does not return next month.
• Does it name the source per record? European rules expect you to tell people where you got their data.
• How is coverage split by region? Most providers are strongest in the United States and thin elsewhere.

Buying a record and scraping a record are different acts with different risks, and the difference lies in where the provider got it. Our entries on data enrichment APIs and B2B data cover how these systems are built and where the records originate.

Find LinkedIn profile by email: the reverse direction

The opposite question comes up just as often. You hold an address from a form, a conference badge or an old CRM record, and you want the person's profile so you can see their role before you write.

LinkedIn provides no search that takes an email address and returns a member. There is no field for it, and the platform does not publish one. Anyone selling a reverse lookup is matching your address against a database they built elsewhere.

What still works

• Read the address: the local part often carries the name and the domain names the employer, which is enough to search by name.
• Check your own systems: the CRM, the marketing database or a colleague's inbox may already store the profile URL beside the address.
• Ask the person: a reply to an existing thread costs one line and gives you a confirmed profile.
• Buy the match: people data providers sell email to profile resolution, with the same provenance questions as above.

Using a search engine to find the profile URL

Once the address has told you a name and an employer, a plain web search usually finds the profile faster than any reverse email lookup. Public LinkedIn profiles are indexed, so a search engine is reading the same pages a logged out visitor would see.

Search for the name together with the company, and add the site to narrow it. A Google query restricted to linkedin.com slash in returns member profiles rather than company pages, posts or jobs. Confirm the match on the profile itself: the employer, the tenure and the city should agree with what the address implied.

• Name plus company: the simplest query, and enough for most professional profiles.
• Name plus the job title from your record: useful where the name is common.
• The full address in quotes: rarely a hit, but people do publish their own emails in posts and profiles.
• The domain plus the site restriction: returns colleagues, which helps you confirm the email pattern too.

At list scale this stops being a search and becomes a matching problem. Resolving thousands of emails to LinkedIn profile URLs for outreach campaigns is what people data providers sell, and the provenance questions in the previous section apply to every one of those records.

One older route is closing. LinkedIn Help now states that the feature for syncing contacts from other address books has started to be removed and that members should expect it to no longer be available, so importing a mailbox to surface matching profiles is not a plan to build on.

When you do find the profile, the useful part is not the connection. It is the context: role, tenure, what they post about. That is the raw material for LinkedIn prospecting that does not read like a mail merge.

What Sales Navigator does and does not give you

Sales Navigator is a search and research product, not a contact database. Its help pages say contact details are visible for your connections and for contacts you synced or imported, and only if that person opted to share those details.

That is the same rule as the free product, with better filters in front of it. The value is in finding and tracking the right people, which our guide to LinkedIn Sales Navigator covers in detail. The address still has to come from somewhere else.

Third party apps connected to your account are governed separately. LinkedIn lets you manage and disconnect them under Permitted Services, and warns that after you disconnect, the app owner may keep the LinkedIn data it received before the change.

What LinkedIn's User Agreement actually forbids

The User Agreement, effective November 3, 2025, lists what members may not do. Three items decide almost every question about collecting addresses from the platform.

LinkedIn Help repeats the point for browser tools: crawlers, bots, plug-ins and extensions that scrape, modify the appearance of, or automate activity on the site are not permitted. Members who use them risk having their accounts restricted or shut down.

The asymmetry is the part people miss. The vendor keeps its revenue; you lose the account, the network and the history. Our guides to LinkedIn automation and to a restricted LinkedIn account cover what that costs and how recovery works.

The legal side: GDPR, UK PECR and CAN-SPAM

Finding an address and using it are separate questions. A work email that identifies a named person is personal data in Europe, and the UK regulator says so plainly: you are processing personal data if the address you use identifies an individual.

Europe and the United Kingdom

The European Commission's guidance is clear about data you did not collect from the person. You must tell them which sources it came from and whether those sources were publicly accessible, at the latest within one month, or when you first communicate with them.

The UK regulator adds the same duty and the exceptions: you can omit the notice if the person already has the information, or if providing it would be impossible or involve disproportionate effort. In cold outreach, none of those usually apply, because you are writing to them anyway.

The UK's PECR rule on marketing by electronic mail does not apply to corporate subscribers, which the regulator defines as bodies with separate legal status such as companies and limited liability partnerships. Sole traders and many partnerships count as individual subscribers and are treated like consumers.

Even for corporate subscribers, the regulator says you must not disguise or conceal your identity, you must give a valid address for opting out, and data protection law still applies. People have an absolute right to object to direct marketing at any time.

The United States

CAN-SPAM covers all commercial messages, not just bulk email. The FTC's compliance guide lists honest headers, a subject line that reflects the message, a disclosure that it is an advertisement, a valid physical postal address, and a working way to opt out.

The opt-out mechanism has to keep working for at least 30 days after you send, and you must honor a request within 10 business days. You cannot charge a fee or require personal information to opt out, and hiring a sender does not move the responsibility off you.

The FTC states that each separate email in violation is subject to penalties of up to 53,088 dollars. Harvesting addresses and dictionary attacks appear among the aggravated violations that can carry criminal penalties, including imprisonment.

A source line for the first email

If you write to someone whose address you did not get from them, tell them where it came from. It satisfies the European notice duty in one sentence, and it makes the message read like a person rather than a list.

You are getting this because {{source}} lists you as {{role}} at {{company}}. We hold your name, work address and job title, nothing else. Reply with the word remove and the record goes, with no further email from us.

This example was written for this page. Adapt the wording to your own privacy notice and to the advice of whoever owns compliance where you work.

Record where every address came from

Provenance is the field most teams never fill in, and the one that answers every later question: a regulator's, a prospect's, or your own when the list stops performing.

Write these fields into the CRM as required, not optional. A record with no source is a liability that looks like an asset, and the cost only appears when someone asks.

How to find someone's email on LinkedIn, step by step

1. Open the profile and read Contact info

   Click Contact info in the introduction section. If the member published an address, a website or a newsletter, you are finished and nothing else is needed.

2. Check what your company already holds

   Search the CRM, the shared inbox, the support desk and old calendar invites. A colleague has often emailed this person before.

3. Export your own connections if you are connected

   Request your data archive from LinkedIn, then read the connections file. It carries the addresses of connections who allowed the download.

4. Look at what the person published themselves

   Company team pages, author bylines, conference speaker pages, newsletters and public documents carry addresses people chose to publish.

5. Work out the company pattern and verify it

   Use addresses you already know at that company to infer the format, build the candidate, then verify it before sending anything.

6. Use an enrichment service, or just ask

   If volume justifies it, buy from a provider that names its sources. Otherwise send one short LinkedIn message asking where to write.

Nothing in that sequence requires a scraper, and nothing in it breaks the User Agreement. It is slower than a browser extension and it keeps your account, which is the trade most teams would make if anyone put it to them in those words.

What to do with the address once you find it

A verified email address is permission to try once, not a relationship. The first message decides whether the search was worth anything, and most prospect research is wasted at exactly this point.

• Use the LinkedIn research, not just the address: role, tenure and recent posts give you a first line no list can sell you.
• Say why this person: if the email would read the same to anyone at that company, it is not outreach, it is a mail merge.
• Keep the first email short: one reason, one question, one easy way to say no.
• Do not run both channels at once: a LinkedIn message and a cold email in the same hour reads as a system, not a person.
• Log the outcome: bounced, ignored, declined or replied, so the next search starts from what you learned.

The sequence that follows belongs in a plan, not in a tool's default settings. Our cold email hub covers the message itself, and how to introduce yourself in an email covers the opening line that decides whether the rest is read.

Common mistakes

• Installing a browser extension that reads profiles, then treating a restricted account as bad luck.
• Buying a list without asking where the records came from, and having no answer when someone asks you.
• Sending to a guessed address with no verification, and burning the sending domain on bounces.
• Treating a connections export as an opt-in list because the people are connections.
• Writing to a shared inbox in the same voice you would use with a named person.
• Recording the address and not the source, so the file cannot answer a single later question.
• Spending an hour on the address and five minutes on the reason for writing.
• Ignoring an objection because it arrived as a LinkedIn message instead of an unsubscribe click.

The message that asks for the address

Here is the message from the first method, written out. It works because it offers something specific, gives the person an easy way to decline, and does not pretend the address is the point of the conversation.

Subject: Sending you {{thing}}: which address?

Hi {{firstName}},

You mentioned {{topic}} in {{place}}, so I put together {{thing}}. It reads much better as a document than as a LinkedIn message.

Which address should I send it to? If you would rather not give one out, say so and I will paste the short version here instead.

{{senderName}}

Frequently asked questions