What is an email permutator?

A tool that takes a person's name and their company's domain and lists every address they are likely to have, such as jane.smith@, jsmith@ and jane@. It is a starting point, not an answer: a permutator only guesses, and one of its guesses becomes an email address you can use once a mail server confirms that mailbox exists.

What is the most common company email format?

first.last@company.com. Sendburg's analysis of its own B2B database (336,782 work emails, 16 July 2026) found it in 47.7% of addresses, followed by first initial plus last name (jsmith@) at 26.8% and first name only (jane@) at 8.1%. Larger companies use first.last more often; very small firms lean towards first name only.

How do I find someone's email address with their name and company?

Find one real address at the company, from its website, a press release or an email signature, and read the format from it. Apply that format to the person's name, then verify the address before sending. If you cannot find any address at the company, generate the common patterns and check them one at a time, most common first.

Why can't the tool tell me which address is right on some domains?

Because the domain is catch-all: its mail server accepts every address, real or invented, so a mailbox check gets the same yes for each guess. The tool tests a random address first and stops if it is accepted. On those domains the pattern can only be confirmed by other evidence, or by sending and watching for a bounce.

Does a valid result mean the email belongs to that person?

No. Valid means the mail server confirmed that mailbox exists right now. It does not confirm who reads it: an address can belong to someone else with the same name, a shared inbox, or a mailbox reassigned after the original person left. Treat a valid result as strong evidence and check it against a second source when it matters.

Is it legal to guess someone's work email address?

Finding an address is generally lawful, but it is not permission to email it. In the US, CAN-SPAM treats sending to addresses generated by combining names into many permutations as an aggravating factor. In the UK and EU, a named work address is personal data, so you need a lawful basis and the separate ePrivacy rules decide whether you may send at all.

Email permutator

An email permutator turns a name and a company domain into every address that person is likely to have. Enter both and this tool lists up to 30 formats, most common first: first.last@, jsmith@, jane@ and the rest. Then it can check the top 8 against the company’s mail server, after testing whether the domain accepts every address.

How company email formats work

Most companies give every employee an address built from the same rule, set once when the mail system was configured. Three rules cover most business email. In Sendburg’s analysis of 336,782 work addresses, first.last@ made up 47.7%, flast@ (first initial plus surname) 26.8% and first@ 8.1%. Every other named format was under 2.5% each. That is one vendor’s view of its own database, not a census, but its method is published, and it is the ranking the tool uses for the formats it covers. Formats it does not cover are listed after them, in an order we chose and label as our own.

Company size moves the odds. In the same data, first.last rises from about 38% at companies of 1–10 people to 74% above 10,000, because a big company has several Janes and needs a scheme that scales. At an owner-run business, try first@ before first.last@. The full breakdown is in our guide to company email formats.

How to find a company’s email format

One real address tells you the rule for everyone. Before guessing, look for any published address at the company: the team, contact or careers pages, a search for "@company.com" in quotes, press releases, conference speaker pages, or a signature in any email you have from someone there. Two checks before you use it: make sure the email domain is the one in the real address, not just the website domain, and remember a published address can outlive the person.

Names do not always map cleanly. The tool strips accents (José becomes jose) and apostrophes (O’Brien becomes obrien), and for a multi-part surname such as Smith-Jones or de la Cruz it adds variants with the parts joined, hyphenated, or only one part used. It cannot know a nickname, so if the person goes by Kate rather than Katherine, enter the name they actually use. A second person with the same name may have a number or a middle initial added; the middle-name field covers the latter.

More methods, from website pages to LinkedIn, are in how to find someone’s business email.

How the check works, and why it stops early

“Find the right one” looks up the domain’s MX records, then our verification server asks the mail host whether it would accept mail for an address and hangs up before anything is sent. It asks about a randomly generated address first. Then it tries the top 8 candidates in order, one at a time, and stops at the first mailbox that exists. Your browser sends only the name and domain; the server rebuilds the candidate list itself, so the tool cannot be pointed at a list of arbitrary addresses.

Guessing at a mail server is exactly what spammers do, and servers notice. That is why the free check is limited to three searches per ten minutes, a handful per domain per hour, and stops as soon as it has an answer or the server stops giving clear ones.

Why catch-all domains break guessing

A catch-all domain accepts mail for every address, real or not. Ask it about jane.smith@, jsmith@ and a string of random letters and it says yes to all three, so a mailbox check cannot tell you which guess is the person. That is why the random probe runs first: if it is accepted, the tool stops, shows you the list, and points to the most common format as the best unconfirmed guess.

On those domains, look for other evidence, such as any published address showing the format, and if you send, treat the address as risky: a separate small batch, removed the moment it bounces. See how to send to catch-all emails, or test a domain on its own with the catch-all checker.

Finding an address is not permission to email it

In the US, CAN-SPAM lets you send commercial email without consent, but the FTC lists addresses “generated by a dictionary attack”, combining names and letters into many permutations, as an aggravating factor. Confirming one likely address before a single message is different from mailing every permutation to see what sticks; do the first, never the second. In the UK and EU, a named work address is personal data, so you need a lawful basis, and the ePrivacy rules (PECR in the UK) decide separately whether an unsolicited email may be sent at all.

Read is it legal to collect business emails and GDPR and B2B cold email before you build a list this way. This page is general information, not legal advice.

Common questions

What is an email permutator?: A tool that takes a person's name and their company's domain and lists every address they are likely to have, such as jane.smith@, jsmith@ and jane@. It is a starting point, not an answer: a permutator only guesses, and one of its guesses becomes an email address you can use once a mail server confirms that mailbox exists.
What is the most common company email format?: first.last@company.com. Sendburg's analysis of its own B2B database (336,782 work emails, 16 July 2026) found it in 47.7% of addresses, followed by first initial plus last name (jsmith@) at 26.8% and first name only (jane@) at 8.1%. Larger companies use first.last more often; very small firms lean towards first name only.
How do I find someone's email address with their name and company?: Find one real address at the company, from its website, a press release or an email signature, and read the format from it. Apply that format to the person's name, then verify the address before sending. If you cannot find any address at the company, generate the common patterns and check them one at a time, most common first.
Why can't the tool tell me which address is right on some domains?: Because the domain is catch-all: its mail server accepts every address, real or invented, so a mailbox check gets the same yes for each guess. The tool tests a random address first and stops if it is accepted. On those domains the pattern can only be confirmed by other evidence, or by sending and watching for a bounce.
Does a valid result mean the email belongs to that person?: No. Valid means the mail server confirmed that mailbox exists right now. It does not confirm who reads it: an address can belong to someone else with the same name, a shared inbox, or a mailbox reassigned after the original person left. Treat a valid result as strong evidence and check it against a second source when it matters.
Is it legal to guess someone's work email address?: Finding an address is generally lawful, but it is not permission to email it. In the US, CAN-SPAM treats sending to addresses generated by combining names into many permutations as an aggravating factor. In the UK and EU, a named work address is personal data, so you need a lawful basis and the separate ePrivacy rules decide whether you may send at all.

One person here. A whole list in the finder.

The free permutator checks one name at a time, three times per ten minutes. The SimpleVerifier email finder takes several people at once, tries the likely patterns for each, verifies them with the same SMTP check, and tells you when a domain is catch-all instead of handing you a guess. Finder searches are unlimited on the paid plan.

See the email finder See pricing