How to find (almost) anyone's business email — without paying for it

You know the name. You know the company. The email address connecting them is one of maybe fourteen patterns — and companies are remarkably predictable about which one they picked.

That predictability is the entire basis of the permute-and-verify workflow: generate the plausible addresses, test which one exists, send to that one. Database tools charge per credit for this. For one-off prospecting, you can do it free, in about two minutes per contact.

Step 1: know the odds before you guess

The distribution is lopsided in your favor:

• first.last@ dominates — roughly 6 in 10 companies, and the bigger the company, the more likely. Collisions (two John Smiths) force structure.
• first@ rules companies under ~10 people. When the whole team fits in one room, jane@ is unambiguous.
• flast@ and firstlast@ split most of the remainder, with f.last@, last.first@ and friends in the tail.

Practical heuristic: if you can find any employee’s address — on the website, in a PDF, in a conference speaker list — you almost certainly have the company’s pattern. Apply it to your target and skip to verification.

Why the patterns are this predictable

This isn’t guesswork about human creativity — it’s a side effect of how company email actually gets provisioned. Nobody manually types out each new hire’s address; IT sets a naming convention once in the directory system that issues accounts, and every hire afterward gets stamped from the same template until someone deliberately changes it, which almost never happens because it would break every existing address on the domain. That’s why the pattern is stable for years and why company size correlates with which pattern gets picked: a two-person startup can get away with jane@, but the moment two Janes exist, someone is forced to add a surname — which is exactly why bigger, older companies cluster around first.last@ or flast@ far more than small ones do.

For reference, here’s the most common subset of the fourteen patterns, ranked by how often each one turns up in practice — the remaining patterns are rarer variants (initials-only, hyphenated, numbered duplicates) worth trying only after these eight come up empty:

Rank	Pattern	Example	Most common at
1	first.last@	jane.doe@co.com	Mid-size to large companies
2	flast@	jdoe@co.com	Enterprises, older domains
3	first@	jane@co.com	Under ~10 people
4	firstlast@	janedoe@co.com	Mixed, no strong size signal
5	first.l@	jane.d@co.com	Uncommon, but seen
6	f.last@	j.doe@co.com	Common in parts of Europe
7	last.first@	doe.jane@co.com	Uncommon
8	lastf@	doejane@co.com	Rare

The top four patterns cover the overwhelming majority of companies you’ll encounter. Start there before working down the tail.

Step 2: permute

No known address? Generate the candidates. Our free Email Permutator takes first name, last name and domain, and produces the 14 patterns companies actually use — ordered by real-world frequency, with the domain’s MX records checked along the way (no mail server means no point guessing).

Step 3: verify before you send — this is the actual skill

A permutation list is worthless unguessed addresses until something confirms one exists. Sending to all fourteen “to see what bounces” is the amateur move: hard bounces are reputation damage, and above ~2% they compound into exactly the spam-folder problem you were trying to outrun.

Verify silently instead. The free Email Checker runs syntax, live MX, disposable-domain and role-account checks honestly scoped — it tells you what’s knowable without sending, and is upfront about what isn’t. Which brings us to:

The catch-all trap. Some domains accept mail to any address — real, fake, misspelled — and sort it out (or trash it) internally. Against a catch-all domain, every permutation “verifies.” A tool that claims certainty there is lying to you; the honest output is “catch-all, unverifiable.” Your options: find the pattern via a known colleague, find the address in public sources, or accept the risk knowingly on your most probable pattern. What you shouldn’t do is mail all fourteen.

Step 4: keep the file clean

Prospecting compounds into lists, and lists rot — people change jobs at a rate that kills ~2% of B2B addresses per month. Before any send, run the file through the Email List Cleaner: dedupe, drop broken and disposable and role addresses, entirely in your browser (your list never touches our servers — it’s your asset, not ours). Calling them too? The Phone Number Validator does the same honest pass on numbers.

A worked example, start to finish

Say you’re trying to reach a VP of Sales named Marcus Chen at a company whose domain you know. The full workflow in practice:

1. Look for a known address first. A press mention, a GitHub commit, a conference bio — anything with @company.com attached. Found one belonging to a different employee: sarah.kim@company.com. That’s first.last@ — the company’s pattern, confirmed, no guessing needed.
2. Apply the pattern. marcus.chen@company.com is now your leading candidate, not a guess among fourteen.
3. Verify before sending. Run it through a verifier that checks syntax, live MX and mailbox-level signals without actually sending anything. If it comes back “catch-all,” the pattern match still holds — catch-all just means the verifier can’t confirm existence, not that the address is wrong.
4. Send once, to the one address. Not five variations “to see what sticks.” One well-targeted email to a high-confidence address beats five guesses that each chip away at your sender reputation.

Total time: under two minutes once you’ve found a single reference address for the company. The reference address is the unlock — everything after it is mechanical.

The line, stated plainly

Finding a business email from public information and writing one relevant, human email to a person your offer genuinely fits — that’s how B2B works, and it’s defensible everywhere. Scraping thousands of guessed addresses into a blast list is neither defensible nor, frankly, effective: reply rates collapse exactly as targeting loosens, and complaint math does the rest.

Find the right person. Verify the address exists. Then go spend your time where it pays — the email itself. The address was never the hard part.

Quick answers

What if the company uses a pattern I’ve never seen before? Rare, but it happens with older or highly custom-built domains. Widen the search for a reference address — a support signature, a webinar registration, an old forum post — before falling back to guessing across the full fourteen.

Is this workflow legal? Yes — inferring a business email address from publicly observable patterns and verifying it exists is standard B2B prospecting practice, distinct from scraping personal data or bypassing any access control.