You found the perfect person on LinkedIn. You want to email them — not message them on LinkedIn, but actually email them.
LinkedIn doesn't show their email.
This is one of the most-searched questions in B2B outreach, and the answers online are a mix of useful tools, gray-area scrapers, and outright bad advice. This guide is the honest version.
Six methods that actually work. What each one costs. Where the legal and ethical lines sit. And what to do once you have the address.
A Quick Note on Legality and Ethics
Before the methods, a clear-eyed framing.
Legal: In most jurisdictions, finding a publicly-listed work email is legal. The person's address being available in some form (a public-domain whois record, a published blog post, a press release, a verified business directory) is what tools rely on.
Compliant with LinkedIn ToS: Using LinkedIn's data — including scraping profile contact details — violates LinkedIn's terms. Tools that scrape LinkedIn directly put your account at risk. Tools that don't scrape LinkedIn (the safer category) work by cross-referencing the person's public footprint elsewhere.
Ethical: Sending an email to someone you found via these methods is fine if you have a real, relevant reason to reach out. Cold emailing 5,000 scraped addresses to spam them is not — and most jurisdictions have anti-spam laws (CAN-SPAM in the US, GDPR in Europe, PIPEDA in Canada) that make this expensive when it goes wrong.
The methods below are listed roughly from safest/most-recommended to least.
Method 1: Just Ask Them on LinkedIn
The boring, correct, highest-conversion answer.
If you have a real reason to email someone, the easiest way to get their address is to ask. Connect on LinkedIn (with a short, specific note), send a brief opening message, and ask if email would be a better channel for the conversation.
This sounds inefficient. It's actually the fastest path for relationships you'd want to maintain anyway — because they've consented to the email, the open rate is dramatically higher, and you haven't burned any goodwill.
Pros:
- Highest open and reply rates (consented email beats cold email by 5–10x)
- Zero legal or ToS risk
- Builds the relationship while you're at it
Cons:
- Requires a real reason to be reaching out
- Doesn't scale to 500 prospects
Best for: Anyone doing relationship-driven outreach (recruiters, VCs, founders, AEs). The exact use case Narrow is built for, frankly.
Method 2: Look at Their LinkedIn Contact Info Section
Many LinkedIn users do publish their email directly on their profile, in the "Contact Info" section. Most senders never click it.
To check:
- Open their LinkedIn profile.
- Click "Contact Info" near their headline.
- Look for an email or website link.
If they've published their email or a contact page, you're done — they're explicitly inviting you to reach out off-platform.
For 1st-degree connections, you can also see contact info LinkedIn would otherwise hide from non-connections.
Pros:
- Free, instant, no tools needed
- Explicit consent (they put it there)
- Works for ~15–25% of profiles
Cons:
- Most users don't fill in the contact section
- Often shows a website or company email, not personal
Best for: The first thing to check, always, before paying for any tool.
Method 3: Email Finder Tools (Apollo, Hunter, Clearbit, etc.)
The standard B2B method. These tools cross-reference a person's name, company, and other public signals to find their work email — usually by combining their LinkedIn profile data with public web sources, then verifying the email is deliverable.
Popular options:
- Apollo — large B2B database, Chrome extension that pulls emails from LinkedIn profiles you view
- Hunter — email-finder focused, strong domain search
- Clearbit — enrichment-focused, good for company-level data
- RocketReach — broad coverage, reasonable accuracy
- Cognism — enterprise-grade, GDPR-compliant European data
- ZoomInfo — large dataset, expensive, popular with mid-market sales teams
How they work: Most use public-web crawling combined with email-format inference (firstname.lastname@company.com patterns) and SMTP verification (pinging the mail server to check if the address exists, without sending).
Pros:
- High-volume, scalable
- Verified deliverability
- Native integration with sales workflows
Cons:
- Paid (most start ~$49/month, scale up)
- Accuracy varies — some addresses bounce
- Some tools scrape LinkedIn directly, which technically violates ToS even if they market themselves as compliant
Best for: B2B sales, lead-gen, recruiters at any meaningful scale.
Method 4: Guess the Email Format and Verify
If you know someone's name and company, you can often guess their email format. Most companies use one of a small number of patterns:
firstname.lastname@company.com(most common)firstname@company.comflastname@company.comfirstinitial.lastname@company.comfirstname_lastname@company.com
To verify: use a free tool like Hunter's email verifier or MailTester to check if the guessed address is deliverable. If it pings successfully, it's real. If it bounces, try the next format.
Tip: Use the company's domain (e.g., @stripe.com), not necessarily the public marketing site. Sometimes companies use a slightly different domain for email.
Pros:
- Free or very cheap
- Works even when paid tools don't have the contact
- Surprisingly effective for tech companies (most use predictable patterns)
Cons:
- Time-consuming (you have to try patterns one by one)
- Lower accuracy at small companies with no public conventions
- Verification tools have daily limits on free tiers
Best for: Lower-volume outreach where one specific person matters and you don't want to pay for a finder tool.
Method 5: Check Their Public Footprint
Many professionals publish their email in places that aren't LinkedIn — and a quick search turns up the address.
Where to look:
- Personal website / blog. Many people have a "Contact" page with their email.
- Conference speaker pages. Speakers usually publish contact info for follow-ups.
- Open-source contributions. Git commit history often includes a public email.
- Published papers / talks. Author email is usually included.
- Company team page. Some companies list team member emails.
- Press releases. Quoted spokespeople often have contact info.
- Crunchbase / AngelList. Sometimes includes contact links.
Search shortcuts:
[Name] [Company] emailon Google[Name] @[company-domain].comon Google (finds pages where their email appears)site:github.com [Name](finds GitHub profile with possible email)
Pros:
- Free
- Often finds the person's preferred email (not just work)
- Builds context for your outreach (you learn what they care about while searching)
Cons:
- Time-consuming per contact
- Doesn't scale
- Works better for senior / publicly-active people than for ICs
Best for: Targeted outreach to specific individuals. Often turns up the address Apollo or Hunter doesn't have.
A calmer LinkedIn inbox is one click away.
Labels, follow-up reminders, Kanban pipelines, and AI screening — built for targeted outreach.
Method 6: LinkedIn Sales Navigator (With Some Tools)
Sales Navigator itself doesn't show email addresses, but several integration tools sit between Sales Navigator and email-finder databases. Apollo, Clay, and similar tools can pull a Sales Nav lead list and enrich each lead with email addresses in bulk.
Pros:
- Bulk-friendly
- Works inside an established Sales Nav workflow
- Higher quality than free methods at scale
Cons:
- Requires both Sales Navigator subscription and email-finder subscription
- Some integrations operate in gray-area LinkedIn scraping territory
Best for: Sales teams running Sales Nav as the prospecting layer.
Methods to Avoid
A short list of approaches that are popular and bad:
- Scraping tools that pull LinkedIn data directly. Violates LinkedIn's ToS and risks your LinkedIn account. The marketing language ("we don't scrape, we extract") doesn't change the technical reality.
- Browser extensions that "show emails" on LinkedIn profiles. Many of these scrape LinkedIn server-side or modify the LinkedIn page client-side. Both violate ToS.
- Buying email lists from random vendors. Most are scraped, illegal under GDPR, full of bounces, and damage your sender reputation when you send to them.
- Guessing emails and sending without verification. Bounces hurt your sender reputation. Always verify before sending.
The pattern: anything that promises bulk LinkedIn-email extraction without paying a real B2B database vendor is operating in territory that ends with banned accounts and bounced emails.
What to Do Once You Have the Email
Finding the address is half the work. The other half is using it well.
1. Verify deliverability. Use a verification tool to confirm the address is real before sending. Bounces damage your sender reputation for all future emails.
2. Warm up new sending domains. If you're sending from a new domain, ramp slowly — 5 emails/day for week one, 10/day for week two, etc. Email service providers throttle new domains that send too aggressively.
3. Personalize specifically. The same rules that apply to LinkedIn cold messaging apply to cold email. Generic templates underperform; specific, researched messages work.
4. Comply with anti-spam law. CAN-SPAM, GDPR, PIPEDA, etc. all require:
- A real sender name and physical address
- An unsubscribe link
- Truthful subject lines
- No deceptive routing
5. Follow up — but stop after two. Same cadence as LinkedIn outreach: original message, follow-up at 5–7 days, optional final touch at 10–14 days. Stop.
6. Track replies in a CRM. Don't lose track of what you sent and what came back. This is where a LinkedIn CRM that also lets you note off-channel conversations (or a sales CRM if you're doing email at scale) earns its keep.
The Honest Volume Question
For most operators reading this, the right outreach volume is smaller than the methods above can support.
If you're a founder, recruiter, or VC reaching out to a curated list of 20–50 people, the right methods are: Method 1 (just ask), Method 2 (check the contact section), Method 5 (their public footprint). You don't need Apollo. You don't need Hunter. You don't need a scraper. You need 30 minutes of research per contact and a personally-written email.
If you're an AE or BDR running outbound at scale (hundreds of prospects per week), the paid email-finder tools (Apollo, Hunter, Cognism) are the right answer — combined with disciplined sender warm-up and message personalization.
The mistake most non-sales operators make is buying a $99/month email tool to find 10 addresses. The math doesn't work, and the friction of learning the tool isn't worth it. Just ask, or check the contact section, or spend 5 minutes on Google.
Final Thought
Finding someone's email from their LinkedIn profile isn't a single problem. It's a problem with at least six legitimate solutions, ranked by volume, budget, and willingness to set up tooling.
For relationship-driven outreach at small scale, the simplest methods work best — just ask them, or check the profile, or search the web. For sales at scale, paid finder tools earn their keep.
What every method shares is that the email address is the easy part. The hard part is sending an email worth replying to. Most senders solve the wrong problem — they invest in finding more addresses when they should invest in writing better messages to fewer people.
The address gets you in the door. The message decides whether you stay.
Narrow is the LinkedIn CRM for operators who'd rather have 20 great conversations than 200 cold emails. Labels, follow-up reminders, AI inbox screening, and a clean workflow for the relationships that matter. Try it free.