What is the free way to find a CEO's email address?
Find the person's name, guess the address from the company's email pattern, then verify the guess before you send. All three steps are free at small volume. The limit is the verifier: Hunter's free plan gives 50 credits a month, checked 24 October 2026, which covers roughly 50 people.
| Step | Free tool | What it costs |
|---|---|---|
| 1. Name and role | Company team page, LinkedIn, Companies House (UK) | Nothing |
| 2. Address guess | The company's own published addresses, or a pattern table | Nothing |
| 3. Verification | Hunter Free, Snov.io Trial | Free credits, 50 a month each |
An email finder answers "how do I reach this person". It does not answer "why would they want to hear from me this week". Our guide to finding leads worth cold emailing covers that half.
How do you find the right decision-maker first?
Start from the company, not the inbox. A verified address for the wrong person is still a wasted email. Four free places give you a name and a role:
- The company's team or about page. At a company of five people, the founder usually decides. At fifty, look for whoever owns the budget for what you sell.
- LinkedIn. Search the company page's People tab for the title you want, and check the person still works there.
- Companies House, for UK companies. The Companies House register lets you search by company name, company number or officer name. Each company's People tab lists current officers with their role and appointment date, as on Tesco PLC's officers page. The register says Companies House does not check the accuracy of what is filed, so treat it as a lead, not proof.
- Google, for a real address at the domain. Google's search help explains the site: operator (no space after the colon) and exact-match quotes. A search such as site:example.com "@example.com" can turn up a press contact or a staff address in a PDF. One real address usually shows you the pattern for the whole domain.
Write down where each name came from. You will need it if someone asks how you found them, and it stops you emailing a person who left last year.
Which email pattern should you guess first?
Guess by company size. Interseller, a recruiting outreach tool, looked at the email patterns of more than 5 million companies in a study published on 4 February 2019. Small companies mostly use first name only, mid-size companies use first initial plus surname, and large ones use first.last. The last column is our own sum of Interseller's top three shares for each size band.
| Employees | Most common | Second | Third | Top three together |
|---|---|---|---|---|
| 1 to 10 | first@ (71.48%) | flast@ (12.57%) | first.last@ (9.82%) | 93.9% |
| 11 to 50 | first@ (41.91%) | flast@ (26.63%) | first.last@ (22.66%) | 91.2% |
| 51 to 200 | flast@ (41.76%) | first.last@ (30.45%) | first@ (16.99%) | 89.2% |
| 201 to 500 | flast@ (44.75%) | first.last@ (35.16%) | first@ (7.43%) | 87.3% |
| 1,001 to 5,000 | first.last@ (48.1%) | flast@ (34.74%) | first@ (3.63%) | 86.5% |
| 10,001+ | first.last@ (56.31%) | flast@ (21.75%) | first@ (6.57%) | 84.6% |
Two cautions. The data is from 2019, and the page now carries a notice that Interseller will be sunset on 15 December 2026, so treat it as a starting order for guesses, not a current census. And a real address you found at the domain beats the table every time.
For Priya Shah at a 30-person company on acme.com, the order is priya@acme.com, pshah@acme.com, then priya.shah@acme.com. Stop at the first one that verifies.
Which free email finder tiers give you the most lookups?
Hunter and Snov.io each give 50 free credits a month, so the two together cover about 100 lookups a month, or about 23 a week, at no cost. Here is what each free tier allows, checked 24 October 2026:
| Tool | Free allowance | What a credit buys | Catch |
|---|---|---|---|
| Hunter Free | 50 credits a month; they reset monthly and don't roll over | 1 credit per email found by Email Finder (none if nothing is found); 0.5 credit per verification | The API returns at most 10 results per Domain Search on the Free plan |
| Snov.io Trial | 50 credits, renewed every 30 days | 1 credit per email verification or per prospect | No bulk search, bulk verification or export on Trial |
| Apollo Free | A free plan with no time limit | Credits vary by plan; check your allowance in the app | Free plans can connect Gmail accounts only for sending |
Sources: Hunter pricing, Snov.io pricing and the FAQ on Apollo's pricing page. Two smaller free items from Hunter's API documentation: the Email Insight call is free and reports whether Hunter recognises an email pattern for the domain and whether the domain has MX records, and Email Finder runs a verification on every address it returns.
Should you guess and verify, or use the finder? We worked it out with Interseller's 11-to-50-employee shares. Try the three most likely patterns in order and stop at the first valid one. That takes 1.9 verifications per person on average (0.4191 x 1 + 0.2663 x 2 + 0.3146 x 3), or about 0.95 Hunter credits, and about 9% of people still end without a match. The sum assumes each check comes back valid or invalid; on an accept_all domain all three guesses come back accept_all, so you spend 1.5 credits and still don't know. Email Finder costs 1 credit and charges nothing when it finds nothing. The cost is about the same, so run the finder first and hand-guess only the names it misses.
Our comparison of Lusha, Apollo and Hunter credits and prices covers what happens when you outgrow the free tiers.
How do you verify an email before you send it?
Run it through a verifier and send only to addresses that come back valid. Hunter's Email Verifier returns one of six statuses. This is what we would do with each:
| Status | What it means | What to do |
|---|---|---|
| valid | The email address is valid | Send |
| invalid | The email address is not valid | Try the next pattern |
| accept_all | Valid, but the server accepts any address | Send only if you found the address published somewhere |
| webmail | From a provider such as Gmail or Outlook | Check it really belongs to the person |
| disposable | From a disposable email service | Drop it |
| unknown | Hunter failed to verify the address | Don't send; Hunter charges no credit for it |
Verification has a ceiling. The SMTP standard, RFC 5321, lets mail servers switch off the VRFY command that would confirm an address, and says they must then reply with code 252 rather than a code that looks like a yes or a no. So verifiers test whether the server would accept mail. A catch-all server accepts everything, which is why Hunter's documentation warns that accept-all domains "can have false positives on SMTP checks".
Why it matters: bounces count against your sender reputation. Amazon SES, which publishes its thresholds in its enforcement FAQ, recommends keeping hard bounces below 2%, reviews accounts at 5% and may pause sending at 10%. On a batch of 50 emails, 2% is one bounce.
What do r/coldemail threads say about free email finding?
We read three r/coldemail threads posted between September 2025 and May 2026. Three patterns repeat.
- Many answers are tool plugs. In a May 2026 thread on free tools by industry and location, one reply promotes a Chrome extension the commenter says they built, and another a tool its commenter says was just launched. The other two threads have the same kind of reply. Read tool recommendations there as adverts until you test them.
- Database exports leave gaps. The poster in a January 2026 thread exported lists from Apollo and found that a few thousand of them had no email. Most replies name another finder; a few suggest crawling the company sites for published addresses.
- Guess and verify is the free answer. One commenter in a September 2025 thread on finding email almost for free put it as: "Pattern guessing plus verification is the closest thing to “free.”" That is one person's view, but it matches what the free tiers allow.
Before trusting any finder, test it on 20 addresses you already know are right. Count how many it returns, and how many of those match.
A free workflow for 25 decision-makers this week
This fits inside the two free tiers and takes an afternoon. Make a sheet with these columns: company, domain, employee count, name, role, where you found the name, pattern guessed, verifier status, reason to write now, date sent.
List 25 companies with a reason
Pick companies with a visible reason to talk now: a hiring post, a launch, a complaint about a tool you replace. Note the reason in the sheet.
Find one decision-maker each
Use the team page, LinkedIn or Companies House. Record the source.
Run Hunter Email Finder
One credit per hit, nothing for misses. Keep anything marked valid.
Hand-guess the misses
Use the size table above and verify each guess in Snov.io or Hunter. Stop at the first valid result.
Write to the valid ones only
Open with the reason from step 1. Our cold email templates give you a starting draft. Before you send, our guide to whether cold email is legal covers the rules in the US, UK and EU.
If this becomes a weekly chore, Siela's AI SDR does the address part: it finds and verifies each person's work email and emails only deliverable addresses. It also saves each lead to its CRM with the reason it was picked. If your list already bounces, read why database lists go stale before you buy more credits.
Frequently asked questions
How many free email lookups can I get a month?
About 100. As of 24 October 2026, Hunter's free plan gives 50 credits a month and Snov.io's Trial gives 50 credits renewed every 30 days. Hunter charges 1 credit per email Email Finder finds and nothing for a miss, so 50 credits can cover up to 50 people. Hunter credits don't roll over to the next month.
What email format do small companies usually use?
First name only. In Interseller's 2019 study of more than 5 million companies, 71.48% of companies with 1 to 10 employees used the first-name-only pattern, such as priya@acme.com. From 51 to 500 employees the most common pattern was first initial plus surname, and above 1,000 employees it was first.last.
What does accept_all mean in an email verifier?
It means the company's mail server accepts mail for any address at the domain, so the verifier cannot tell whether your guess is a real mailbox. Hunter's documentation says this can cause false positives on SMTP checks. Send to an accept_all address only if you also found it published somewhere, such as a press page.
Does Hunter charge a credit when it can't find an email?
No. Hunter's pricing page says Email Finder counts 1 credit for each email found and is free when the address can't be found. Verification costs 0.5 credit, and if Hunter fails to verify an address it charges nothing and returns the status unknown. Checked 24 October 2026.
What bounce rate is too high when sending cold email?
Amazon SES, Amazon's email-sending service, publishes a threshold: it recommends keeping hard bounces below 2%, places accounts under review at 5% and may pause sending at 10%. Those rules apply to SES accounts, but they give a useful ceiling for any sender. On a batch of 50 emails, 2% is a single bounce.
Sources
- Hunter pricing (checked 24 Oct 2026)
- Hunter API documentation (v2) (checked 24 Oct 2026)
- Hunter Help Center: Hunter API (checked 24 Oct 2026)
- Snov.io pricing (checked 24 Oct 2026)
- Apollo.io pricing (checked 24 Oct 2026)
- Interseller: Top Email Address Patterns By Company Size (Steven Lu) (4 Feb 2019; checked 24 Oct 2026)
- Companies House: Find and update company information (checked 24 Oct 2026)
- Companies House: Tesco PLC people (checked 24 Oct 2026)
- Google Search Help: Refine Google searches (checked 24 Oct 2026)
- Amazon SES: Enforcement FAQs (checked 24 Oct 2026)
- RFC 5321: Simple Mail Transfer Protocol (October 2008)
- r/coldemail: Best free tools to find B2B email addresses by industry and location? (22 May 2026; checked 24 Oct 2026)
- r/coldemail: How to find email addresses from list of websites? (2 Jan 2026; checked 24 Oct 2026)
- r/coldemail: How do you find email (almost for free)? (20 Sep 2025; checked 24 Oct 2026)