Most answers to how to find email address of someone on LinkedIn end at a browser extension that drops an address onto the profile page. The question nobody asks is which employer that address belongs to. The short answer: open the profile's Contact info first, and if the address is not there, take the person's name and current employer from the profile, look the work email up on those two, and verify it before you send.
That takes a couple of minutes for one person, and the same steps run across a list of hundreds. Finding an address is one job inside B2B data enrichment, and this guide stays on the LinkedIn version of it: what a profile gives you, what it holds back, and where a lookup quietly goes wrong.
To follow along on a real profile, open a free workspace and paste in one profile link.
How to find email address of someone on LinkedIn: six ways compared
The pages that rank for this question mix three different things: places where LinkedIn itself shows an address, guesses, and lookups. They fail in different ways, so it helps to see them side by side.
Way | Works when | What it costs |
|---|---|---|
Contact info on the profile | They share their email with you, usually as a first-degree connection | Free |
Your connections data export | They are already a connection and allowed their address to be downloaded | Free |
Ask them in a message | You are connected, or they accept your request | Free, and one reply away |
Guess the pattern, then verify | The company uses a predictable format such as first.last, and the domain is not catch-all | Up to 0.8 credits a check in Oneprofile |
Look it up from the profile URL alone | They have not changed jobs since the source last read their profile | Depends on the tool |
Read the profile, look up on name and company, verify | You have the profile link | Up to 30.4 credits a person in Oneprofile |
The first three are free and worth a minute for one person you care about. The last one is what scales to a list, and it is what most of this guide walks through. The fifth row is the one to be careful with, and we will come back to why.
Check the contact info first
Open the profile and click Contact info under the person's name. If they have added an email and chosen to show it to you, it sits there next to their website and any other links.
The member decides who can see it, and first-degree connections only is a common choice. So if you are not connected, expect a website or nothing.
Two more free places to look:
Your connections export. LinkedIn's copy of your data includes your connections with an email column. It is filled only for people who allowed connections to download their address.
The person. If they matter and you have time, ask. A connection request that says why you want to email them is honest and free, and the address you get back is the one they actually read.
One thing that confuses this search: the LinkedIn setting called Discover by email works in the other direction. It decides who can find your profile from an address they already hold. It will not show you anyone else's.
How to find email address of someone on LinkedIn from name and company
A profile holds the two facts every work email lookup matches on: the person's full name and the company they work for now. What it rarely holds is the address itself, so the job is to read those two facts off the profile and look the email up on them.
Bring the profile links into Oneprofile
For one person, add the profile URL to a table. For a list, import the file you have (more on that below). Either way, the LinkedIn URL is the starting input.
Read the profile for name and current employer
Open Tools, find Read a LinkedIn profile on the Person shelf of the Enrichment tab, and bind it to the LinkedIn URL. It reads the profile live and returns:
Full name, plus first and last name
Job title on the most recent role
Company, the employer the profile shows now
Every employer behind them, and a work history of titles and dates when the profile's experience section can be read
It costs up to 19.6 credits a person, and a profile it cannot read costs nothing.
Find the work email on name and company
Add Find work email and bind its inputs to the full name and the Company the profile read returned. If you know the company's website domain, bind that too: every source in the chain takes one, and some match on nothing but the name and the domain.
Sources are checked one at a time, in an order set by accuracy rather than price, and the first one that confirms an address ends the lookup. It costs up to 10.0 credits, and a lookup that finds nothing costs nothing.
Two details save you from bad addresses. Someone whose profile shows only the first letter of their last name is skipped and not charged, since any address would be a guess. And an address that comes back at a different domain from the person's company is kept but marked Low confidence.
Why the profile URL alone is the wrong input for a work email
Back to that fifth row. Find work email does not take the LinkedIn URL as an input, and that is deliberate. A lookup keyed on the URL alone answers from whichever employer the source's copy of the profile holds. For anyone who has moved jobs since that copy was made, the answer is the old company's address, and it looks exactly like a good one.
Funny enough, the same URL is the strongest single input for a phone number. Phones follow the person, while a work email belongs to the employer, which is why the employer has to be current.
A worked example: one profile, three steps
Say the profile belongs to Dana Whitfield. Her headline reads Head of Operations at Cleardue, and two years at Pebble Studio sit underneath.
Step | What comes back | Up to |
|---|---|---|
Read a LinkedIn profile | Dana Whitfield, Head of Operations, Cleardue, with Pebble Studio as a past employer | 19.6 credits |
Find work email | dana@cleardue.example | 10.0 credits |
Verify email | valid | 0.8 credits |
If a source had answered dana.whitfield@pebblestudio.example instead, Oneprofile would keep it and mark it Low confidence, because that domain is not the company the lookup asked about. A lookup from the URL alone would have no current company to compare against.
How to find email address of someone on LinkedIn for a whole list
The steps do not change for a list. What changes is how the links arrive and how much you want to see before spending.
Import the file on Tables with Import from file. Oneprofile reads .csv and .xlsx files under 50MB, takes the first line as the column names, and lets you check each column's type before anything is added. Keep the LinkedIn URL column. Free holds 100 rows per table, Team holds 10,000 and Pro 250,000.
Then chain the three enrichments:
Add Read a LinkedIn profile, bound to the LinkedIn URL.
Add Find work email, bound to the name and company the read returned.
Add Verify email, bound to the address Find work email fills.
Before you run, the run menu shows the estimated total for the people it would cover, and hovering an enrichment's credit chip shows the most a person can cost. A list of 100 profiles can cost up to 3,040 credits from the link alone. Each lookup is charged the price of the source that answered it, so most runs cost less.
If your list already carries names and companies, you can skip the profile read and pay up to 10.8 credits a person instead. The catch is the age of the list. A company field from an old export is exactly the stale employer problem from the URL lookup, so for anything older than a few months the read is probably worth it.
The Free plan's 200 credits a month cover at least 6 people started from a profile link, or at least 18 when you already have name and company. Team starts at $20 a month for 1,000 credits, and extra credits are $20 per 1,000 on every paid plan.
Building the list from a LinkedIn search instead of a file? Finding leads on LinkedIn covers profile and post searches that save people with their profile links attached.
Verify before sending
A found address is not a deliverable one. Add Verify email and every address gets a Deliverability verdict:
valid: send to it
catch-all: the domain accepts mail to almost any address, so this mailbox is not confirmed
risky: not a confirmed address, so hold it back
unknown: no verifier could decide, often because a mail server refused the check for now, so verify it again later
invalid and disposable: leave them out
For catch-alls, switch on Check catch-alls with a second verifier in the column editor. It is off by default, and an address it settles costs a second check. This is also where the guessing method from the table runs out: a catch-all domain says yes to almost every pattern you try.
Anyway, the reason to bother is your sending domain. Every bounce counts against it, and a new domain has no history to absorb them. The bulk email finder guide goes deeper on catch-alls and what to do with each verdict.
Is it legal to email someone you found on LinkedIn?
We are an enrichment company, not a law firm, so treat this as a map rather than advice.
In the US, the FTC's CAN-SPAM compliance guide makes no exception for business email. It asks for honest headers and subject lines, a valid postal address, and an opt-out you honor within 10 business days.
In the EU, GDPR needs a lawful basis for using someone's personal data, and cold B2B outreach usually leans on legitimate interests under Article 6, weighed against the person's own interests. Some countries add their own rules for unsolicited email on top.
The practical version: write to people whose job makes your message relevant, say who you are, and make leaving easy. Relevance also protects the address you send from.
"Low reply rates drag your deliverability down, and poor targeting is what causes low reply rates."
Utku Zihnioglu, CEO of Oneprofile
Start with one profile you were going to email anyway, since you already know who they are and can judge the answer. Run that profile through the three steps free and check what comes back.
