How to find a hiring manager’s email address (a repeatable 5-step method)

Most job seekers stop at the application portal because they think the hiring manager’s contact info is locked away somewhere private. It usually isn’t. Learning how to find a hiring manager’s email is less about secret databases and more about a short, repeatable process: figure out who the person is, work out how their company builds email addresses, confirm the guess, and have a backup plan for the cases where no address turns up.

This matters because the portal is a bad bet. Glassdoor has reported that the average corporate job posting pulls in roughly 250 applications, and only a handful of those people get a call. A résumé dropped into that pile competes with hundreds of others screened by software before a human sees it. An email that reaches the actual decision maker skips the queue entirely.

The method below is built for that. It uses public and professional sources, standard email-pattern inference, and free verification tools. No scraping behind logins, no buying sketchy lists, no guessing at personal Gmail accounts. Just the address the company already hands out to vendors and colleagues every day.

Step 1: Identify the right person before you find the email

An email address is useless if it belongs to the wrong person. Before you go looking for how to find a hiring manager’s email, spend a few minutes confirming who actually owns the hiring decision for the role.

Start with the job posting. Some list a contact or a recruiter name. Most don’t, so move to LinkedIn. Search the company name plus the team or function in the title (for example, “Stripe” and “engineering manager” or “marketing director”). The person you want is usually one or two levels above the open role. A mid-level marketing job is typically owned by a marketing director or senior manager, not the VP and not the recruiter.

This is the step people rush, and it costs them. Sending a sharp, personalized note to the wrong contact reads as worse than not sending one at all. If you’re unsure whether to target the manager, the recruiter, or someone higher up, this breakdown of who you should actually email walks through how to tell them apart.

Once you have a name and a confirmed company, you have everything you need to find the address.

Step 2: Infer the company’s email format

Companies don’t invent a new email scheme for every hire. They pick one pattern and apply it across the org. Find the pattern once and you can construct almost anyone’s address.

The common formats are short and predictable:

• first.last@company.com (jane.doe@company.com)
• firstlast@company.com (janedoe@company.com)
• first@company.com (jane@company.com)
• flast@company.com (jdoe@company.com)
• first_last@company.com (jane_doe@company.com)

Which one a company uses correlates strongly with its size. Interseller analyzed more than 5 million companies in 2019 and found the pattern shifts as headcount grows. Small companies lean on first-name-only addresses, with about 71% of companies under 10 people using just {first}. Large companies move to first.last: at organizations with 10,001 or more employees, first.last was the top format at 56.31%, and at the 5,001 to 10,000 range it hit 55.23%. So if you’re targeting a big employer, first.last is the smart opening guess. At a 30-person startup, first@ is more likely.

You rarely have to guess blind. To find someone’s work email pattern, search Google for a known address at that domain, like "@company.com" email, or check the company’s press releases and team pages, which often list a media or careers contact. One confirmed address reveals the format for everyone else. An email format finder for job search use is just a tool that automates this lookup, which brings us to the next step.

Step 3: Use a legitimate email finder or format tool

You don’t have to reconstruct addresses by hand. Several tools take a name and a company domain and return the most likely email, along with the pattern that company uses. Hunter, Clearout, RocketReach, and similar services keep databases of verified addresses and known formats, and most offer a small number of free lookups per month.

These tools work in two ways. Some return an address they’ve already verified from public sources. Others predict the address from the company’s known pattern and assign a confidence score. Both are legitimate when they draw on public and professional data, which the mainstream finders do. What you’re avoiding is anything that promises personal cell numbers or private inboxes scraped from places people didn’t agree to share.

A dedicated email format finder for job search work is the fastest route here: type the domain, get the dominant pattern, apply it to your hiring manager’s name. If the tool returns a verified address directly, even better, because you can skip ahead to sending. If it only predicts one, treat that prediction as a hypothesis and confirm it before you hit send.

Step 4: Verify the address before you send

This is the step that separates outreach that lands from outreach that bounces. A bounced email can hurt your sending reputation, and if the address is wrong, your message never had a chance.

Email verification tools check whether an address actually exists without sending anything to it. They ping the mail server and report whether the mailbox is valid, risky, or undeliverable. NeverBounce, ZeroBounce, and the verification features built into finders like Hunter all do this. Run your candidate address through one before you send.

If you generated several possible formats in step two, verification tells you which one is real. Say you have jane.doe@, janedoe@, and jdoe@ as candidates. A verifier will usually flag the valid one and mark the rest as undeliverable. That single check turns a guess into a confirmed address.

One caveat: some corporate mail servers are configured to accept all addresses, so a verifier can’t always give a clean yes. When a result comes back as “accept-all” or “risky,” lean on the format evidence from step two and keep your first message short, so a wrong guess costs you little.

Step 5: Fall back to LinkedIn or another channel when no email turns up

Sometimes the address just won’t surface. The company is too small to be in any database, uses an unusual format, or locks things down. That’s not a dead end. It’s a cue to switch channels.

LinkedIn is the obvious fallback. A connection request with a short, specific note, or a direct message if you can send one, reaches the same person without an email address at all. Reply rates on a well-targeted LinkedIn message can rival a cold email when the note is genuinely personalized. Other routes work too: a thoughtful comment on something the manager posted, a mutual connection who can introduce you, or a polite message to the recruiter asking who owns the role.

The channel matters less than the contact. Reaching the hiring manager through any direct path beats another anonymous application. And once you’ve found the person, the quality of what you say decides everything. A generic “I’d love to connect” wastes the access you worked to get. Spend ten minutes on researching the hiring manager before you reach out so your first message references something real about them or the team.

Why the direct address is worth the effort

The whole point of finding the email is the response it can earn. Cold outreach is not magic, and most of it gets ignored. Saleshandy, analyzing more than 53 million cold emails for its 2026 report, put the average reply rate around 3%, with well-targeted, personalized campaigns reaching into the double digits. That sounds low until you compare it to the alternative. A résumé in a stack of 250 has a far smaller chance of producing a real conversation, and you don’t even get to control the message.

The difference is leverage. When you email the hiring manager directly, you decide what they read first. You can name the specific problem the role is meant to solve and show you understand it. You skip the keyword-matching software that screens out qualified people for using the wrong synonym. None of that is available to you inside the application portal.

That’s the case for learning this skill once and reusing it. The five steps don’t change from company to company. Identify the person, infer the format, use a finder, verify, and fall back to LinkedIn when needed. Run it enough times and finding a work email becomes a two-minute task instead of a roadblock.

Skip the manual work

The steps above are straightforward, but doing them for every role adds up: confirming the right person, checking the email format, running a finder, verifying the address, then researching enough to write something worth reading. That’s why tools like angld.AI exist. Paste a job posting, and it identifies the decision maker, finds and verifies their contact info, researches them, and drafts a personalized outreach message in about a minute.

The job market rewards people who go around the pile instead of joining it. Two hundred and fifty applicants are all using the same portal. The address of the person who actually makes the call is sitting in plain sight, in a predictable format, one verification check away. Direct outreach beats passive applications, and it starts with the email you just learned how to find.