How to Find Someone's Email From a LinkedIn Profile: 4 Methods Ranked

Why there's no find email button on LinkedIn

I run LinkedIn outreach next to cold email for B2B clients, and the handoff between the two channels starts with the same question almost every time: I have a profile, I don't have an address, now what. LinkedIn has never shipped a feature that turns a profile into an email address for a stranger, and it isn't an oversight. The platform's whole Contact Info system is built around a member choosing what to share and with whom, which is the opposite of a public lookup tool. So every method below works around that gap rather than through anything LinkedIn built for it, and the methods differ a lot in cost, accuracy, and how much risk they carry.

Method 1: check the profile's own Contact Info first

Before opening any tool, click "See contact info" on the profile you're trying to reach. Some members list a personal or work email there on purpose, usually because they want recruiters, collaborators, or exactly the kind of outreach you're doing to find them. LinkedIn's own help documentation is specific about who can actually see it: by default, an email address added to Contact Info is visible only to that member's first-degree connections, and the member controls whether to widen that to second-degree connections or to anyone on LinkedIn through their own visibility settings. That means most profiles you're not connected to won't show one at all, but it costs nothing to check, and it's the only method here where the address came directly from the person rather than from a guess.

Profiles that are active mostly for content and inbound, the kind I cover in what actually books clients through LinkedIn content, are more likely to have filled in a public email than a profile that logs in once a month and never posts. Worth a glance before anything else on this list.

Method 2: guess the pattern, then verify before you send

Most companies use one email pattern for every employee: firstname.lastname@company.com, f.lastname@company.com, firstnamelastname@company.com, and a handful of other common shapes. If you already have one confirmed address at the company, from a reply, a signature, or a press release, you can apply the same pattern to anyone else there with reasonable confidence. The part people skip is verification: running the guessed address through a syntax, domain, and mail server check before you send to it, rather than firing a cold email at a pure guess and finding out from the bounce. A guessed address that hasn't been verified is a hypothesis, not a contact.

Method 3: a dedicated email finder tool

Tools like Hunter, Apollo, Snov.io, and RocketReach automate the same pattern-and-verify logic at scale, plus a database lookup step most people skip when guessing by hand. Hunter's own description of how its finder works lays out both parts: it checks addresses already found publicly on the web first, and builds the likeliest address from the name and domain pattern when there's no direct match, then assigns a confidence score or a verified shield depending on how sure it is. That's a more thorough version of Method 2, not a different trick, which is why the two methods land on the same address most of the time when a confirmed pattern exists.

None of these tools publish a single, universal accuracy number worth repeating here, and I'd rather point you to how each one reasons about confidence than hand you a percentage that varies by domain size and industry anyway. Check a tool's own methodology page before trusting its score, and treat every result under its highest confidence tier as something to verify again before it goes into a live sequence.

Method 4: a browser extension on the profile itself

Extensions that sit on top of LinkedIn and surface a contact's email while you're already viewing their profile are convenient, but they're almost always a front end on the same finder databases in Method 3, not an independent source. The real question to ask before installing one isn't whether it finds an email, it's how it connects to LinkedIn to do it: reading the page you're already looking at and cross-referencing a database is a different risk profile from a tool that automates clicks and page loads across hundreds of profiles unattended. The first behaves like you, manually, just faster. The second starts to look like the scraping LinkedIn's own rules prohibit, covered next.

What used to work and doesn't anymore

Exporting your full LinkedIn connections list as a CSV used to include email addresses by default for anyone who'd shared one with you. LinkedIn tightened that over time, and the export now generally returns only addresses the connection explicitly chose to share in that export, not everything visible in Contact Info. Directly scraping profile pages at volume with a script, rather than looking up one profile at a time by hand, sits in a different category entirely: it isn't a workaround that got harder, it's conduct LinkedIn's own terms ban outright, which the next section covers in full.

Is this against LinkedIn's rules

Looking up one profile's Contact Info by hand, or running a name and company domain through an email finder tool, doesn't touch LinkedIn's systems at all, so it isn't governed by LinkedIn's rules in the first place. What LinkedIn's own User Agreement does prohibit, under its list of things members agree not to do, is using "software, devices, scripts, robots or any other means or processes... to scrape or copy the Services, including profiles and other data," and separately, using "bots or other unauthorized automated methods" to access the platform or add contacts. That clause is what makes bulk profile scraping and unauthorized automated connection requests a platform violation, with LinkedIn free to restrict or close the account behind it. It has nothing to do with whether you later look up that same person's email through a tool that never touches LinkedIn's own pages. I cover the fuller restriction picture, including what else gets an account flagged, in is LinkedIn automation safe.

Is it legal under GDPR once you have the address

Finding the address is a different question from whether you can lawfully use it, and inside the EU and UK that second question runs through GDPR. The usual legal basis for B2B outreach to a professional address is legitimate interest under Article 6(1)(f), and the EDPB's own current guidance sets out a three-part test a controller has to clear: a real, clearly stated legitimate interest; a genuine necessity to process the data for that purpose; and a balancing test showing the interest doesn't override the individual's own rights and expectations (EDPB, Guidelines 1/2024 on Article 6(1)(f) GDPR). A work email tied to someone's actual job function, used for a relevant business message with a working opt-out, tends to clear that test more easily than a personal address used for anything unrelated to their role. The country-by-country detail on where B2B cold email sits legally across the EU, including how consent and legitimate interest apply differently market to market, is in is B2B cold email legal in the EU. This isn't legal advice; have someone check your specific list and message if the answer matters to your business.

Why a high confidence email still bounces

Even a verified or high-confidence address can bounce, for reasons that have nothing to do with how it was found. People change jobs and the address stops existing before any database updates. A company migrates its mail provider and every address on the old pattern fails at once. A catch-all domain accepts mail for any address shape, so a verifier reports it as deliverable when the specific person behind it was never real. None of the four methods above are immune to this, which is why I verify again right before a send goes out, not just once when the address first entered the list, especially for anything sitting in a database for more than a few weeks.

The order I'd actually do this in

1. Check Contact Info on the profile. Free, direct from the source, takes seconds.
2. If nothing's there, confirm the company's email pattern from any address you already have for that domain.
3. Apply the pattern and verify it through a syntax, domain, and mail server check before it goes anywhere near a send.
4. For a whole list rather than one contact, move to a finder tool so the pattern-plus-verify work scales without doing it by hand for every row.
5. Re-verify anything older than a few weeks before it goes into a live sequence, since job changes and mail migrations don't show up until the next check.

What to do once you have a verified address

Once an address is verified, I run it into the same sequence as the LinkedIn thread rather than treating email and LinkedIn as two separate campaigns, since email and LinkedIn run as one sequence for the clients I work with. The first email stays short, 30 to 40 words, one concrete problem and one concrete offer, the same discipline regardless of whether the address came from a Contact Info field or a finder tool. For sending itself, I run Salesforge for clients, which I'll say plainly as my own preference rather than a verdict: no tool named in this article pays me anything, there's no affiliate link behind any of it, and the one thing worth disclosing is that I've written guest articles for Salesforge's blog. If you're building that sequence from scratch rather than adapting an existing one, the full step-by-step is in how to build a LinkedIn outbound sequence that books meetings.

FAQ