- Key Takeaway
- Tom's OSINT Workbench is a free, portable Windows desktop tool for open source intelligence investigations. It runs entirely offline with no account required, supports 7 live APIs, generates self-contained HTML reports, and stores all case data locally in SQLite. Single EXE download, no installation needed.
Best Free OSINT Tool for Windows: A Practical Guide
Most OSINT tools fall into one of two camps. The first is expensive commercial platforms designed for enterprise teams with monthly billing, cloud accounts, and pricing that assumes a corporate budget. The second is command-line scripts and Python frameworks that assume you're comfortable in a terminal and happy to spend an afternoon getting dependencies installed. Neither is much use if you want a capable investigation tool that runs on Windows, costs nothing, and doesn't require a login.
This guide covers what to look for in a free Windows OSINT tool, why most options fall short, and how Tom's OSINT Workbench fills the gap for investigators, researchers, security professionals, and anyone who needs to gather open source intelligence without a SaaS subscription or a Linux VM.
What Makes a Good Free OSINT Tool for Windows
Free OSINT tools vary enormously in quality, depth, and practical usability. Before looking at specific tools, it helps to define what actually matters for day-to-day investigative work.
The first question is whether the tool is genuinely free or free in name only. Many tools offer a free tier that limits the number of searches, locks core features behind a paywall, or requires a credit card to sign up. A truly free tool has no usage caps, no locked tabs, and no account requirement of any kind.
The second question is platform. A large proportion of well-regarded OSINT tools are built for Linux or rely on Python environments that are awkward to set up on Windows. Kali Linux tools, terminal-based frameworks like theHarvester or SpiderFoot CLI, and browser-based tools that require a server running locally all add friction that slows down real investigations. A native Windows desktop application removes that friction entirely.
The third question is data privacy. Cloud-based OSINT tools send your queries to a remote server. For sensitive investigations — whether corporate due diligence, law enforcement work, or personal privacy research — that matters. An offline-first tool that keeps all case data on your own machine is inherently more secure.
The fourth is case management. Running a single lookup is easy. Managing a multi-entity investigation across domains, IP addresses, usernames, and social profiles is harder. Tools that provide a structured case system, a visual graph, and exportable reports are dramatically more useful than tools that just return raw data with nowhere to store it.
Why Most Free Windows OSINT Options Fall Short
When you search for free OSINT tools for Windows, the results tend to surface a familiar list: Maltego Community Edition, SpiderFoot, theHarvester, Shodan, and various browser-based aggregators. Each has limitations worth understanding.
Maltego is the benchmark for graph-based OSINT but the free Community Edition is heavily restricted. Transform limits, API throttling, and the requirement to create an account before you can use it all reduce its practical value for non-enterprise users. The full version runs to hundreds of dollars per year.
SpiderFoot is powerful and genuinely open source, but it runs as a local web application rather than a native desktop tool. Setting it up on Windows requires Python, pip, and some comfort with the command line. It's not difficult for a technical user, but it's a barrier for investigators whose expertise is investigation rather than software deployment.
Browser-based tools like Maltego's web interface or newer entrants like Webvetted Workbench require an internet connection for every query and store case data in the cloud. Free tiers typically cap the number of nodes, entities, or exports per session.
What the market largely lacks is a capable, native Windows desktop OSINT tool that is genuinely free, requires no account, runs offline, and provides proper case management with visual analysis and exportable reports.
Tom's OSINT Workbench: Free OSINT for Windows
Tom's OSINT Workbench is a free portable Windows application built specifically for open source intelligence investigations. It is a single EXE file — no installation, no dependencies, no account required. Download it, run it, and start investigating.
The tool is built around a case-based workflow. Every investigation lives in its own SQLite database stored locally on your machine. Cases are self-contained, portable, and entirely under your control. Nothing is sent to a cloud server. Nothing requires authentication. The tool works fully offline for case management and activates APIs only when you explicitly run a lookup.
Core Investigation Features
OSINT Workbench supports seven public APIs covering the most common investigative data sources: RDAP for domain registration data, DNS for name server and record lookups, ip-api for IP geolocation and ISP data, Shodan for internet-facing device and port data, crt.sh for SSL certificate transparency logs, GitHub for public repository and user data, and Reddit for public post and account data. Each API can be queried individually from within a case, with results stored against the relevant entity.
The entity model supports domains, IP addresses, usernames, email addresses, people, organisations, URLs, and custom notes. Entities are added to a case and can be linked to one another to build out a picture of how different pieces of intelligence relate. This is the core of any investigation — not just collecting data points, but understanding the connections between them.
Force-Directed Graph Visualisation
One of the more distinctive features of OSINT Workbench is its built-in force-directed graph. Entities and their relationships are rendered as an interactive node graph that you can explore visually. The graph updates in real time as you add entities and links, and opens in a dedicated pop-out window so it doesn't crowd the main investigation interface. Both dark and light themes are supported.
Visual link analysis is how complex investigations become comprehensible. When you're dealing with ten interconnected domains, six IP addresses, three usernames, and a cluster of social accounts, a list view becomes impossible to reason about. A graph makes the structure of the investigation immediately visible.
Timeline and Case Management
OSINT Workbench includes a timeline view for tracking the chronology of investigation events. Cases can contain structured notes, tagged entities, and investigation logs. The dual dark and light theme means the tool works comfortably in any working environment without eye strain during long sessions.
Who Is OSINT Workbench For
The tool is designed for investigators, security researchers, journalists, due diligence professionals, and privacy researchers who need to gather and organise open source intelligence on Windows without paying for an enterprise platform.
It is particularly well suited to private investigators who need a discreet offline tool that leaves no cloud footprint, cybersecurity analysts running domain and IP investigations as part of incident response, journalists researching individuals or organisations using public records, HR and compliance professionals conducting background research, and individuals who want to audit their own digital footprint.
It is not a replacement for Maltego at scale. If you are running hundreds of automated transforms against enterprise data sources with a team of analysts, you need an enterprise platform. But for individual investigators and small teams who need a capable, free, offline-first Windows tool, OSINT Workbench covers the core workflow without the cost or complexity.
How It Compares to Other Free Options
Compared to Maltego Community Edition, OSINT Workbench has no usage limits, no account requirement, and no locked features. It does not have Maltego's extensive commercial transform marketplace, but for investigators using public APIs it covers the most common data sources without restriction.
Compared to SpiderFoot, OSINT Workbench is a native Windows application rather than a local web server, requires no Python setup, and provides a built-in graph and case management system rather than a raw results dashboard.
Compared to browser-based tools, OSINT Workbench stores all data locally, works offline, and does not require a cloud account or subscription at any tier.
- Tip
- OSINT Workbench stores each case as a separate SQLite file on your machine. You can back up, archive, or move cases simply by copying the file. No export process required.
Getting Started
OSINT Workbench is a single portable EXE. Download it from tomdahne.com, place it anywhere on your Windows machine, and run it. No installer, no admin rights needed, no dependencies. Create a new case, add your first entity, and start investigating.
The full user guide is available at tomdahne.com and covers every feature in detail including API configuration, graph navigation, report generation, and advanced case management techniques.
- Note
- Some APIs used by OSINT Workbench have their own free tier limits. Shodan free accounts are limited to basic data. All other integrated APIs — RDAP, DNS, ip-api, crt.sh, GitHub public data, and Reddit public data — are free with no account required.
Final Thoughts
The gap in the market for a free, native, offline-first Windows OSINT tool has been real for a long time. Commercial platforms are excellent but expensive. CLI tools are powerful but inaccessible to non-technical investigators. Browser-based tools introduce cloud dependency and account requirements that many investigators want to avoid.
Tom's OSINT Workbench is built to fill that gap — capable enough for real investigations, simple enough to use without training, and free without strings attached.
Download OSINT Workbench Free →
If you need to audit your own site's technical health alongside your OSINT investigations, Tom's Site Auditor provides a full offline website crawl and SEO audit — also for Windows, also portable, free trial available.