Facebook OSINT in 2026: what still works, what died, and where the trail continues.

Less than the search volume suggests, but not nothing. Last verified: 9 September 2026. A public profile URL such as facebook.com/username still returns the page title and the person's name to a logged-out browser, then wraps everything below it in a login prompt. Public Pages and public Groups render their recent posts to a logged-out visitor more generously than personal profiles do, and Marketplace listings are visible logged-out in most regions. The public people directory at facebook.com/public/ still responds, but it is a name index, not a search engine: it returns a short list of matching names and nothing behind them.

The practical rule: without an account you can confirm that a profile exists, read its public name, and read Page and Group content that the owner made public. Everything else, including friend lists, "About" details, photos and most timeline posts, requires a logged-in session. The 1,900 people a month who search "facebook search without account" are mostly looking for the profile-viewer sites that promise more than this. Those sites show the same public data Facebook already shows, wrapped in adverts, and none of them reaches private content. Treat any site that promises to "unlock" a locked profile as a scam.

Graph Search, launched in March 2013, let anyone query the social graph in plain English ("photos of people from Paris who like fishing"). Facebook shut the public version down in June 2019, saying most people searched by keyword anyway. The URL tricks investigators used for a while afterwards stopped working in stages, and by 2020 the semantic search era was over.

Three things replaced it. First, Facebook's own keyword search, which is filtered by type (posts, people, photos, videos, groups, events) and by date, and which is now the only search that sees everything your session is allowed to see. Second, URL-builder interfaces that assemble keyword-search URLs with filters already applied, of which two were still online on 9 September 2026: graph.tips (a "Facebook Search" front end by sowdust, inspired by Henk van Ess, covering posts, people by city, school and employer, photos, videos, events and Pages) and sowsearch.info. Both run inside your logged-in Facebook session; they build the query, Facebook answers it. Third, Who Posted What (whopostedwhat.com), a keyword search by day, month, year or date range, with a location filter and a "posts by a specific user ID" option that still needs the numeric ID described below. Its Instagram date filter was disabled by Facebook on 12 May 2021 and the site says so.

Google dorks still work for anything Facebook lets Google index: public Pages, Groups and some public posts. site:facebook.com "exact phrase", or site:facebook.com/groups "keyword", returns indexed content without touching Facebook at all, and it is the one method that does not depend on a logged-in session. For a wider comparison of the vendors that package these methods, see the OSINT tools landscape.

Every profile, Page and Group has a permanent numeric ID behind its vanity URL, and that ID is what most remaining tools consume. Usernames can change; the ID cannot. The reliable method is to open the profile while logged in, view the page source, and search for "userID" or "entity_id": the 15 to 17 digit number next to it is the ID. The r/osinttools thread that ranks first for "facebook osint" today confirms this still works with an intercepting proxy in 2026: "I can still find [the ID] using Burp."

Web converters such as lookup-id.com (online on 9 September 2026, accepts facebook.com/username, m.facebook.com and profile.php?id= formats, also resolves Group and Page IDs) do the same lookup for you. They work only on profiles Facebook exposes publicly and they log every URL you paste, so use them for Pages and Groups rather than for the subject of a sensitive case. Once you have the ID, facebook.com/profile.php?id=NUMBER always resolves to the account even after a username change, and the Who Posted What "posts by user" search takes that number.

On 10 February 2026 a post titled "Facebook OSINT tools broken" reached the top of r/osinttools (45 upvotes, 21 comments). Its first sentence describes the state of the field: "Back in November of '25, FB apparently made a bunch of changes that broke nearly every tool I was using to collect OSINT from Facebook." The tools that died were the ones that walked the graph from a user ID to likes, comments and interactions. The tools that survived are the ones that only build a URL for Facebook's own search. Our status check, 9 September 2026:

The pattern is the one Reddit investigators already know from the Unddit and Removeddit shutdown: any tool whose data path runs through the platform's permission can be switched off without notice. The methods that keep working are the ones the platform cannot see.

Post search: log in, type the keyword, choose the Posts tab, then filter by date and by "posts from" (anyone, you, your friends, groups). Add the year filter first; Facebook ranks by engagement, and a date filter is the only way to reach an old post that never went viral. Quote the exact phrase when you have it, because keyword search matches loosely.

Group search: public Groups expose their posts to search and to Google; private Groups expose only their name, description and member count. The description often names an admin, a website, and a Telegram or WhatsApp link, which is frequently the better pivot. For the Telegram side of that pivot, see the Telegram OSINT guide.

Marketplace: listings carry a seller profile, a rough location, a listing date and, for most sellers, a "joined Facebook in" year on the seller card. Roughly 4,400 people a month search "facebook marketplace scam" and "facebook marketplace scammer", and the places those searches end up are not on Facebook: they are Reddit threads where victims post the seller's name, the listing screenshots and the payment handle. That is the trail covered in the next section, and the same pattern drives the fraud and compliance work THINKPOL is used for.

A post you delete goes to Trash, where Facebook keeps it for 30 days before permanent deletion; a post you archive stays in Archive indefinitely and only you can see it. Both live under Activity Log, which is also where you restore. A deactivated account disappears from search and from friends' lists but keeps everything, and reactivates on login. A deleted account enters a 30-day grace period, after which Facebook says deletion takes up to 90 days to complete; the profile is unreachable for that whole time. A memorialised account stays visible with "Remembering" on it and cannot be logged into.

For someone else's deleted post there is no recovery path through Facebook. What can survive is a copy made while the post was public: a Wayback Machine snapshot (the Internet Archive still captures some public Facebook URLs; its latest snapshot of the facebook.com/zuck profile was taken on 10 August 2026, and it shows what a logged-out visitor sees), a notification email that quoted the text, a share on another profile, a screenshot, or a Reddit thread that quoted it. We walk through every one of those paths, with what each one actually returns, in a dedicated guide to deleted Facebook posts.

Reddit posts and comments mentioning "facebook" in THINKPOL's archive: 6.7 million in 2023, 6.5 million in 2024, 6.2 million in 2025 and 4.0 million in 2026 to date. A large share of that is people talking about Facebook, but inside it sits the part investigators want: Marketplace scam reports naming a seller, screenshots of a post the author later deleted, group invite links, and profile URLs pasted into r/Scams, r/legaladvice and local city subreddits. When the Facebook original is deleted, the Reddit copy stays, and if the Reddit post is deleted too, the archive still holds it.

Try it without an account: search Reddit posts and comments containing facebook.com/ across 30 billion records, then narrow to the profile name, the listing title or the payment handle. To see whether a Reddit account that posted a Facebook link has since deleted its history, run the handle through the Reddit user lookup. The method behind it, account reconstruction and identity resolution across platforms, is in the Reddit OSINT guide.

THINKPOL does not archive Facebook. It archives Reddit: 30 billion posts and comments since 2005, captured at publication and retained after deletion, searchable in under 300 milliseconds, hosted in the EU. For a Facebook investigation that means one thing done well: the Reddit side of the trail, including the posts, warnings and links that were deleted after the fact, and the Reddit accounts that share a Facebook handle. Meta platforms sit behind Telegram, Discord and the Fediverse on the roadmap. The free tools need no account; the API serves teams that run this at case volume, and the law enforcement page explains the legal basis.