What is OSINT Workbench?

Tom's OSINT Workbench is a free, open-source intelligence investigation tool for Windows. It enables structured, offline case management for tracking people, companies, domains, social profiles, emails, phones, addresses, usernames, and IP addresses as connected entities. All data lives in a portable SQLite file on your machine — no accounts, no cloud, no subscriptions.

Who it's for

• Analysts who need to build structured investigation profiles with typed relationships and confidence levels, entirely offline.
• Journalists who require private, portable case management with snapshot diffing and self-contained HTML reports.
• Security researchers who want to extract structured data from URLs using public APIs like RDAP, DNS, Shodan, and crt.sh without leaving a desktop app.

Key features

Entity-centric case management

Track nine entity types — people, companies, domains, social profiles, emails, phones, addresses, usernames, and IPs — with typed relationships and three confidence levels: confirmed, probable, and unverified.

Visual link analysis

Force-directed or hierarchical graph layouts rendered with GDI+ let you drag, zoom, pan, and click to inspect. Nodes are coloured by entity type, edges styled by confidence, and you can pop the graph out to a floating window for side-by-side analysis.

Paste & extract

Drop a URL — or up to ten — and the app pulls structured data automatically. Domains return RDAP, DNS, IP geolocation, Shodan open ports, crt.sh subdomains, tech stack, and meta tags. Social URLs are recognised across X, LinkedIn, GitHub, Reddit, and more.

Snapshots & diffing

Take a point-in-time snapshot of any entity or the whole case. Compare any two snapshots to see additions, removals, and changes — colour-coded green, amber, and red — making it easy to track changes over time.

What stands out

No accounts, no cloud, no subscriptions. All data lives in a portable SQLite file on your machine.

This is the core philosophy behind OSINT Workbench. It's a single portable EXE with zero dependencies, no telemetry, and no analytics. The only network traffic is the public API calls you explicitly trigger. For analysts who need absolute data sovereignty, this offline-first design is a fundamental differentiator from SaaS-based investigation tools.

Worth checking out if…

You need a free, private OSINT investigation tool for Windows that keeps all case data on your machine. It's especially valuable if you regularly track multiple entity types, need visual link analysis with confidence-based styling, or want to snapshot and diff investigations over time without relying on cloud services.