The core stays free. Teams get control.

Always free, always local

• All ten tools, all formats, all exports — no signup, no credits, no paywall.
• Deterministic engine with unit-tested behavior you can verify in DevTools.
• Reference lists maintained weekly from public sources.

Fetch pages without a proxy tax

The free URL extractor fetches pages directly in your browser — no proxy, no account. When a target site blocks cross-origin reads, the bookmarklet reads the already-open page instead. A server-side fetch proxy exists only as a consented teams-tier reference implementation (workers/fetch-proxy/ in the repository): token-authenticated, origin-allowlisted, SSRF-guarded, nothing stored — and only ever called after an explicit click.

Planned team tier (consent boundary)

The following would ship as a separate, explicitly consented service — never silently added to the free tools:

• Self-hosted edition — run the whole toolkit inside your own network with signed, reproducible builds.
• Local CLI package — the same engine over stdin/stdout for pipelines and CI, with JSON contracts per operation. Already available: build it with npm run build:cli from the repository.
• Consented fetch proxy — token-authenticated page fetching for CORS-blocked targets, with SSRF guards and zero retention. Reference implementation ships under workers/fetch-proxy/.

What we will not build

Some gaps are deliberate — they are our competitors' moats, and chasing them would destroy what makes this toolkit trustworthy:

• No contact-discovery database. We will never sell name-to-email lookup built on harvested personal data. Hunter, Skrapp and GetProspect do this; we process lists you already own.
• No mailbox-verification service. SMTP probing and catch-all detection require contacting mail servers about your contacts. Our validator stays syntax, domain-shape and list-based — verification vendors exist for the rest.
• No sending, ever. No sequences, no campaigns, no deliverability network. Extraction and hygiene in, nothing out.

Consent contract

• Default processing never touches a remote API — remote calls happen only after an explicit click.
• Only the minimum data leaves the device (today: domain names for MX checks; never addresses or file contents).
• Unreachable or refused remotes fail open and never downgrade local results.
• No ads, no behavioral analytics, no sale of data — in any tier.

Talk to us

Need self-hosting, custom parsers, compliance paperwork or high-volume verification? Write to hello@emailextractorai.com or use the contact page. Please do not attach real customer lists.