There are three ways to get an email address from a LinkedIn profile: read it in the Contact info section when the member shares it with you, work out the company's email pattern and verify the guessed address, or use an email finder or Chrome extension that matches the profile against a contact database. Each method trades cost against time and accuracy, and none of them returns an address for every profile. Using that email to recruit is legal in the EU when you have a lawful basis, usually legitimate interest, and you tell the candidate where you got their data no later than your first message. That first message also has to state, clearly and separately, that the candidate can object.
What is a LinkedIn email finder
A LinkedIn email finder is a tool that takes a LinkedIn profile, reads the person's name and current employer, and returns a likely email address for that person. Most LinkedIn email finders work as a Chrome extension that adds a panel next to the profile you are viewing, as a web app that accepts profile URLs in bulk, or both.
A LinkedIn email finder does not read the email from LinkedIn itself. It matches the profile against an email database, against the email pattern of the person's company, or against both, and then checks whether the address is likely to accept mail.
For a recruiter, a LinkedIn email finder is a way to reach a candidate who rarely logs in to LinkedIn or ignored a connection request.
Where LinkedIn shows a member's email address
LinkedIn shows a member's primary email address in the Contact info section of their profile, but only to the people the member allows. According to the LinkedIn Help Center, the primary email is only visible to the member's direct connections by default, and each member can choose among four visibility options:
- Only visible to me: nobody else can see the email address.
- 1st-degree connections: only direct connections can see it.
- 1st and 2nd-degree connections: direct connections and their connections can see it.
- Anyone on LinkedIn: any member viewing the profile can see it.
So a candidate's email is usually visible to a recruiter only after they accept the connection request. Checking Contact info is free, so it comes first.
LinkedIn members can also allow their connections to download their primary email address in their connections' data exports, according to the same Help Center page. A recruiter who exports their LinkedIn connections therefore gets the emails of the connections who left that setting on, and only theirs.
How to find someone's email from their LinkedIn profile, step by step
To find someone's email from their LinkedIn profile, start with the free methods and move to a paid tool only when they fail, keeping a record of where each address came from:
- Open the Contact info section of the LinkedIn profile. If the candidate is a connection, or shares the email more widely, the address is there.
- Check the candidate's own links. A personal website, portfolio or GitHub profile linked from LinkedIn often lists a contact email the candidate chose to publish.
- Work out the company's email pattern from the candidate's current employer, as explained below.
- Verify the guessed address before you send anything.
- Use a LinkedIn email finder or Chrome extension when the first four steps return nothing usable.
- Write down the source of every address you keep: "Contact info", "candidate's website", "company pattern" or the name of the tool.
How to work out a company's email pattern
A company's email pattern is the format its addresses follow, such as firstname.lastname@company.com or f.lastname@company.com. To find it, look for any published address at that domain: the company's careers or press page, a team member's public profile, or a Google search for the domain in quotes. Google's Search Help explains that putting a word or phrase in quotes searches for that exact phrase, and that site: in front of a domain limits results to that site.
For a recruiter looking for a backend engineer at a fintech whose domain is example.com, this Google search returns pages from the company's own site that mention its addresses:
"@example.com" site:example.com
When several published addresses share one format, apply it to the candidate's name at their current employer.
How to verify a guessed work email
To verify a guessed work email, check that the company's domain accepts mail and then run the address through an email verification tool before sending. Bounces from unverified guesses hurt the reputation of your own sending domain.
Some company mail servers accept every address at the domain, which verification tools usually report as "catch-all" or "accept-all". For those domains a valid result does not confirm that the mailbox exists, so treat a catch-all address as a guess and prefer another channel, such as a LinkedIn invitation, for that candidate.
How LinkedIn email finder Chrome extensions work
A LinkedIn email finder Chrome extension reads the profile you are viewing (name, current company, sometimes the profile URL) and looks it up in the provider's contact database, often combined with the company's email pattern and a verification check.
LinkedIn email finders miss for predictable reasons. The candidate may have changed jobs recently, so the database holds an old work address; the company may use a catch-all domain that cannot be verified; or the candidate may have no address in any database.
Providers differ mainly in where their data comes from, whether they find phone numbers as well as emails, and whether you pay per credit or per subscription. Our comparisons of Kaspr alternatives for recruiters and ContactOut alternatives cover the tools one by one.
LinkedIn email finding methods compared
The table below compares the four ways to get an email address from a LinkedIn profile on the attributes that matter to a recruiter. Hit rates are left out on purpose: no provider-independent source publishes them.
| Method | Cost | Time per profile | What you get | Main limitation | Source to record |
|---|---|---|---|---|---|
| LinkedIn Contact info | Free | Seconds | The member's primary email, if visible to you | Visible to direct connections by default | "LinkedIn Contact info" |
| Connections data export | Free | Minutes for all your connections at once | Emails of connections who allow downloads | Only 1st-degree connections who enabled it | "LinkedIn data export" |
| Company pattern + verification | Free or low-cost verifier | Several minutes | A guessed work email, checked against the mail server | Fails on catch-all domains and recent job changes | "Company email pattern" |
| Email finder or Chrome extension | Credits or subscription | Seconds | A work or personal email from the provider's database | Database coverage and freshness vary | Name of the tool |
How HeyTalent finds a candidate's email inside the sourcing workflow
HeyTalent finds candidates' emails and phone numbers inside the same workflow it uses to source them on LinkedIn, so the recruiter does not export a list to a separate email finder. Once a shortlist is ready, the recruiter can ask Agent Mode, HeyTalent's agent, to look for the emails and phone numbers of the candidates they want to contact.
On a single profile, the HeyTalent Chrome extension adds a panel next to the LinkedIn profile you are viewing: one click and it looks for that person's work email and phone number without leaving LinkedIn. The extension only reads the profile you are viewing when you ask it to, and it does not send messages, invitations or any automatic action from your LinkedIn account.
The email pattern method depends on knowing where the candidate works today. HeyTalent extracts profiles from LinkedIn in real time, so candidates' experience is up to date at the moment of the search, and the current employer the search returns is the one an email lookup should use.
HeyTalent processes public data under legitimate interest and never resells data. Email and phone search is included in every plan, and HeyTalent's plans start at €93 a month billed annually. Finding phone numbers works the same way and is described on the phone enrichment from LinkedIn page.
HeyTalent does not send emails. Its campaigns run on LinkedIn only, with invitations, follow-ups and InMails described on the LinkedIn outreach automation page; the email HeyTalent finds is used from the recruiter's own email tool.