How to Find an Email From a LinkedIn Profile, Legitimately

You can find someone's email from LinkedIn legitimately in two ways: read it from their Contact info if they chose to show it, or take their name and employer from the profile and find the work address on the company's website or by pattern, then verify it. Automated scraping breaks LinkedIn's User Agreement.

LinkedIn is the best directory of who works where, and almost every prospecting tool is built around it in some way. That makes it easy to forget that LinkedIn has its own rules about how its data can be collected, and that it enforces them.

This guide uses only methods that do not depend on breaking those rules.

What LinkedIn's rules actually say

LinkedIn's User Agreement prohibits automated collection of profile data. The clause is section 8.2, in the version effective 3 November 2025. Members agree not to:

Develop, support or use software, devices, scripts, robots or any other means or processes (such as crawlers, browser plugins and add-ons or any other technology) to scrape or copy the Services, including profiles and other data from the Services

and not to use "bots or other unauthorized automated methods to access the Services, add or download contacts".

That covers more than people assume. A browser extension that reads the profile you are looking at and sends it to a third party is, on the plain wording, a "browser plugin" used "to scrape or copy" profile data. Whether a given tool crosses the line is a question for that vendor and for LinkedIn, but you are the member who agreed to the terms, so the account at risk is yours.

LinkedIn does enforce this. The best-known case is hiQ Labs, which scraped public profiles. After years of litigation, the US District Court for the Northern District of California held in November 2022 that hiQ had breached the User Agreement, and hiQ then agreed to a consent judgment of $500,000 and a permanent injunction to stop scraping and destroy the data and code built from it.

This is not legal advice. It is the text of the agreement and the public record of one case.

The methods, ordered by reliability

#	Method	Uses LinkedIn for	Reliability	Within LinkedIn's rules
1	Contact info on the profile	The address itself	Highest: the member published it	Yes
2	Your own connections export	Addresses members allow you to download	High, but incomplete	Yes
3	Company website or public documents	Name and employer only	High when found	Yes
4	Pattern plus verification	Name and employer only	Medium; depends on catch-all	Yes
5	Ask on LinkedIn	The conversation	High, if they reply	Yes
6	Extensions that read profiles for you	Profile data, automatically	Varies	Check the vendor and section 8.2

1. Read the Contact info section

If the member has chosen to show their email, it is under Contact info on their profile. This is the only place LinkedIn itself gives you an address.

LinkedIn's help centre says a member's primary email is, by default, "only visible to your direct connections". Members can change that to:

• Only visible to me
• 1st-degree connections
• 1st and 2nd-degree connections
• Anyone on LinkedIn

So the practical rule is: connect first, then look. Note that the address shown is whatever the member registered with, which is often a personal Gmail or Outlook address rather than a work one. For a business conversation, the work address you find by methods 3 and 4 is usually more appropriate.

2. Export your connections

LinkedIn lets you download your own connections, and the export includes email addresses where members allow it. The path, from LinkedIn's help page:

1. Click Me, then Settings & Privacy.
2. Click Data privacy.
3. Under "How LinkedIn uses your data", click Get a copy of your data.
4. Choose the larger archive that includes connections, and Request archive.
5. LinkedIn emails a download link to your primary address.

Expect gaps. LinkedIn says: "You will only see email addresses for connections who have allowed their connections to see or download their email address." Members control that with a separate toggle, so many rows will have a name and company but no address.

This is the right method for re-contacting your own network, not for prospecting strangers.

3. Find the address on the company's own site

Use the profile for two facts, name and current employer, and get the address from the company. This is often the most reliable route for small and mid-sized businesses.

1. Note the person's full name and current company from their profile.
2. Find the company's website domain. Watch for companies whose website domain differs from their email domain.
3. Look on the team, about, contact and press pages. Small businesses often list staff addresses.
4. Search the web for the address in quotes, for example "@company.com" "Jane Smith", which finds conference speaker pages, press releases and published papers.

An address the person or company published is the strongest evidence you will get short of a reply.

4. Work out the pattern, then verify

If no address is published, find the company's email format from any published address, apply it to the name, and verify the result. This is what email finder tools automate.

Most companies use one format for everyone. If you can find one published address at the company, sam.lee@company.com for instance, you know the format is first.last, and Jane Smith is probably jane.smith@company.com. We cover the common formats and how often each appears in company email patterns.

Then verify before you send. A verifier asks the company's mail server whether that mailbox exists, without sending anything, as described here. Three outcomes:

• Valid: the server confirmed the mailbox. Send.
• Invalid: the server rejected it. Try the next pattern.
• Risky or catch-all: the server accepts every address, so the guess cannot be confirmed. Send with care, in a small separate batch, or not at all. Here is why.

You can run single checks with our free email verifier, or use an email finder that tries the patterns for you.

5. Ask on LinkedIn

If the person is worth emailing, they are worth a short message asking. A connection request with a one-line note, or a message once connected, often gets you the right address faster than any tool, and the person has agreed to hear from you, which is the best deliverability signal there is.

6. A note on extensions

Many prospecting tools work as a browser extension that reads the LinkedIn page you are viewing. Before you install one, read section 8.2 above and ask the vendor how its extension collects data.

The honest position is that this is a grey area in practice and a clear one on paper. The agreement names browser plugins and add-ons that scrape or copy profiles, and the account that agreed to it is the one you built your network on. If you use such a tool, keep volumes modest and do not rely on one account for your whole pipeline.

What not to do

• Do not run scrapers or automation on your LinkedIn account. That is the conduct section 8.2 describes.
• Do not assume a personal address from Contact info is fine for cold outreach. It was shared with connections, not with marketers. For the legal side in the US, UK and EU, see whether it is legal to collect business emails.
• Do not send to unverified guesses in bulk. Pattern guesses on catch-all domains are the commonest cause of cold email bounces.

The takeaway

Treat LinkedIn as a directory of names and employers, not a source of addresses to extract. Read Contact info where it is shared, export your own connections for your own network, and for everyone else go to the company's website, work out the pattern, and verify the address before you send.