IntelHub

Version 6 · Chrome, Edge, and Firefox

Look it up
without leaving
the tab.

IntelHub is an OSINT workstation for investigators. Usernames, sites, files, wallets, and chat exports sit next to the page you are already reading.

Install onChrome Web Store Install onMicrosoft Edge Install onFirefox Add-ons

Source and issues on GitHub.

On your machineHashes, metadata, encryption, and exports never leave the browser.
Permission when neededA site is opened for reading only after you start that tool.
Side panelPin the workstation beside the page in Chrome or Firefox.

Built for a case, not a dashboard.

The popup works on the open page. The Workspace is where you paste, upload, or type.

Identity

People and accounts

Username search, Google ID, breach and infostealer checks, Gravatar, Social ID, and public Telegram profiles.

Web

Sites

Domains, IPs, subdomains, archives, certificates, security headers, short links, and DoH.

Files

Documents and images

EXIF, PDF and Office properties, tracker removal, hashes, face comparison, and AES-256-GCM.

Chats

Exports

A zipped Telegram JSON or HTML export, or a Funstat report, with search and identifiers.

Crypto

Wallets

Bitcoin on blockchain.info. Ethereum on Ethplorer, with Blockscout as the fallback.

OPSEC

Guards

WebRTC, camera, microphone, location, clipboard, cookies, HTTPS upgrade, and your proxy.

Privacy policy

What leaves the browser

Effective June 25, 2026

IntelHub does not collect, record, or track personal data, browsing history, or analytics. It runs on your machine. A tool sends only the value you submit, and only when you run it.

Stays on this device

Metadata, hashing, encryption, text profiling, and Telegram or Funstat analysis are local.

Sent only when you run the tool

  • Reverse image search. A public image URL is opened in the engines you pick. A local image is posted to catbox.moe so those engines can fetch it. Consent is required before a local image leaves the device.
  • Short link tracer. Hops are followed on your machine. No unshortener service is used.
  • IP lookup. The address goes to ip-api.com and RDAP. AbuseIPDB is only a link.
  • DNS and domains. Resolution uses Google DNS-over-HTTPS. Registration data comes from rdap.org. Subdomain search queries public certificate, archive, and passive-DNS sources.
  • Wallets. Bitcoin goes to blockchain.info. Ethereum goes to api.ethplorer.io, then eth.blockscout.com if needed.
  • Email lookups. Breaches go to api.xposedornot.com. Infostealers go to cavalier.hudsonrock.com. Gravatar hashes the email locally and requests the public profile.
  • OSINT catalog. The public awesome-osint list is sometimes downloaded from GitHub. That request has no personal data.

Permissions

  • activeTab reads the tab you are on when you start a page tool.
  • storage keeps preferences and investigations in this browser.
  • scripting reads a page only after you start a tool that needs it.
  • downloads saves files you export.

Questions: github.com/tomsec8/IntelHub.