_____               ___  ____ ___ _   _ _____     _   _ ___
|  ___| __ ___  ___ / _ \/ ___|_ _| \ | |_   _|   | | | |_ _|
| |_ | '__/ _ \/ _ \ | | \___ \| ||  \| | | |_____| | | || |
|  _|| | |  __/  __/ |_| |___) | || |\  | | |_____| |_| || |
|_|  |_|  \___|\___|\___/|____/___|_| \_| |_|      \___/|___|

Why FreeOSINT-UI?

OSINT-UI is a great collection of open-source intelligence tools, but only a handful of them are free, and even those are capped at a few uses per month. Everything else sits behind a subscription.

Most of those lookups don't need a paid service at all: they only need the right free public sources and a clean interface. FreeOSINT-UI brings them together:

• 🆓 Free forever. Every tool, with no limits apart from the rate limits of the public APIs themselves.
• 🔒 Browser-first. 10 of the 12 tools run entirely in your browser. Files you analyze never leave your device, and passwords you check are never sent anywhere (only 5 characters of their hash are).
• 👁️ Passive only. Public sources and public data. No active scanning, no logins, no bypassing access controls.
• 🧩 Connected. Tools link to each other: go from an email to its breaches, or from a phone number to ready-made Google dorks, in one click.

🛠️ Tools

* Needs the Python backend (see below). Every other tool works with the static site alone.

🚀 Getting started

Prerequisites

• Node.js 20.19+ or 22.12+ and npm
• For the backend only: uv and Python 3.14+ (uv can install Python for you)

Frontend

git clone https://github.com/Kerlooo/FreeOSINTUI.git
cd FreeOSINTUI
npm install
npm run dev

Open http://localhost:5173. That's it: 10 tools are already fully working.

Backend (Username Analyzer and Telegram OSINT)

In a second terminal:

cd backend
uv sync
uv run uvicorn app.main:app --reload --port 8000

In development, Vite forwards /api requests to http://127.0.0.1:8000, so there is nothing else to configure. Interactive API docs are at http://localhost:8000/api/docs.

Frontend and backend together

npm run dev:all

Starts both servers in one terminal, with [web] / [api] prefixed logs. Ctrl+C stops both, and if one of them crashes the other is stopped too.

Useful commands

📦 Deployment

The frontend is a fully static site: upload the build/ folder to any static host (GitHub Pages, Netlify, Cloudflare Pages, Vercel, nginx…).

The backend is optional. If you host it on another origin:

The rate limiter is in memory and keyed on the client IP. Behind a reverse proxy, all users would share one limit.

🧱 Tech stack

Frontend

• SvelteKit + Svelte 5 (runes), plain JavaScript and CSS
• @sveltejs/adapter-static: every page is prerendered
• Vite, Vitest, ESLint, Prettier
• hash-wasm (hashing), exifr (image metadata), fflate (Office/PDF decompression), libphonenumber-js (phone numbers)

Backend

• FastAPI + uvicorn, httpx, Beautiful Soup
• uv for dependency management, pytest + respx for tests

Architecture in one line: tools run in the browser whenever a public API allows it. The backend exists only for what a browser can't do (sites blocked by CORS, pages that must be inspected server-side). It exposes one endpoint per tool with fixed targets and is never a generic proxy.

🗂️ Project structure

src/
├── routes/<tool>/+page.svelte   # one page per tool
├── lib/<tool>/                  # tool logic in plain JS, with *.spec.js tests
├── lib/components/              # UI components (one per file)
├── lib/tools.js                 # the list of tools shown in the home page and navbar
└── lib/net.js, dns/, rdap.js    # shared helpers for public APIs
backend/
├── app/                         # FastAPI app, one router per tool
├── data/wmn-data.json           # WhatsMyName site list
└── tests/

🙏 Data sources & credits

FreeOSINT-UI stands on the shoulders of these free public services and projects:

WhatsMyName (CC BY-SA 4.0) · XposedOrNot · Have I Been Pwned – Pwned Passwords · Shodan InternetDB · rdap.org · Google Public DNS · crt.sh · Cert Spotter · Internet Archive · ipwho.is · Gravatar · disposable-email-domains · mempool.space · litecoinspace.org · Blockscout · GitHub REST API

Inspired by OSINT-UI.

⚖️ Responsible use

FreeOSINT-UI only queries public sources, but the results can still concern real people. Use it for legitimate purposes: security research, investigations you are authorized to carry out, and checking your own exposure. Respect the terms of service of each data source and the privacy laws of your country (e.g. GDPR). Results can be wrong or out of date: treat them as leads to verify, not as proof.

📜 License

FreeOSINT-UI is released under the Apache License 2.0 with the Commons Clause.

• ✅ Use it freely, for personal or business purposes, inside your company included.
• ✅ Modify and share it, as long as you keep the LICENSE and NOTICE files, which credit the original author.
• ❌ Don't sell it. You may not offer FreeOSINT-UI, or a product or service whose value comes substantially from it, for a fee (paid hosting and paid support included).

Because of the no-selling condition this is a source-available license, not an OSI-approved open-source one. The bundled WhatsMyName data (backend/data/wmn-data.json) keeps its own CC BY-SA 4.0 license.

👨‍💻 Author

Made by kerlo: GitHub · LinkedIn

If you find it useful, leave a ⭐ on the repository!