LinkedIn X-ray search combines Google Boolean operators with the site:linkedin.com/in/ filter to search LinkedIn's indexed public profiles directly, from Google, logged out. No LinkedIn account, no Premium, no Sales Navigator, no result cap, and access to 3rd-plus-degree connections.
LinkedIn X-ray search combines Google Boolean operators with the site:linkedin.com/in/ filter to search LinkedIn's indexed public profiles directly, from Google, logged out. No LinkedIn account, no Premium, no Sales Navigator, no result cap, and access to 3rd-plus-degree connections.
The trade-off: the strings are brittle, they return no contact details, and they break when LinkedIn changes its URL structure. It is a free discovery method, not a workflow. This post covers the syntax, why it works, where it stops, and how to fit it into a prospecting process that also needs contact data and account context, neither of which X-ray provides.
LinkedIn X-ray search is a technique for finding LinkedIn profiles by querying Google's index of LinkedIn's public pages, using the site:linkedin.com/in/ operator plus Boolean search terms, instead of searching within LinkedIn. It works without a LinkedIn account or paid subscription and is not subject to LinkedIn's connection-degree or result limits, but returns no contact information.
Searching LinkedIn from the outside. Instead of using LinkedIn's own search, you point Google at LinkedIn's profile pages and let Google's index do the work. The name "X-ray" comes from the idea of looking through a site's surface to search its indexed content directly.
You point Google at LinkedIn's profile pages with site:linkedin.com/in/, add the words you expect to find on the profile, and read the results while logged out. Google has already crawled and indexed millions of public LinkedIn profiles, so you are searching that index, not LinkedIn's gated one.
`` site:linkedin.com/in/ "VP of Marketing" "San Francisco" ("SaaS" OR "B2B software") ``
Break it down:
Google's Boolean is not identical to Sales Navigator's Boolean: Google adds site:, intitle:, and other operators, and handles some syntax differently. Keep a separate cheat sheet.
Different tools for different moments.
X-ray is a free way to discover names and companies when you do not have Sales Navigator, or to reach past its result limits on a specific search. Sales Navigator is a structured workflow: precise filters, saved Lead Lists, job-change alerts, account tracking. X-ray finds people once; Sales Navigator manages a pipeline over time. See database vs LinkedIn for prospecting and Sales Navigator vs Recruiter.
An X-ray result gives you a name and a company, sometimes a title. To actually reach the person you need an email address or a phone number, which X-ray does not provide. See how to find email address from a LinkedIn profile, what tool can I use to find emails from LinkedIn, and how to scrape leads from LinkedIn for the safe and unsafe ways to bridge that gap.
Searching Google's public index is not scraping LinkedIn, and it does not violate LinkedIn's terms on its own, because you are not accessing LinkedIn while logged in and automating actions. It is a manual search of a public search engine.
The risk appears when you automate X-ray at scale or feed the results into a scraping tool that then hits LinkedIn directly. That is where terms-of-service and account-safety issues start. See is LinkedIn automation safe.
Beyond site: and Boolean, a few Google operators sharpen an X-ray:
These are Google operators, not Sales Navigator's five, so do not mix the two syntaxes.
For a founder or a first sales hire without budget for Sales Navigator, X-ray plus free LinkedIn plus a data tool is a workable stack: X-ray builds the shortlist, free LinkedIn confirms the person and their current role, and a data tool provides the email. See how to find B2B leads on LinkedIn and how to use LinkedIn for lead generation for the surrounding workflow, and how to export LinkedIn connections with emails for a different free source.
X-ray is not only for individuals. site:linkedin.com/in/ "Acme Corp" ("sales" OR "revenue") returns people at one company in one function, which is a quick way to map who sits where in a target account before you have Sales Navigator's account tools. It is rough, the index is stale, and it misses opted-out profiles, but it is free and takes thirty seconds. See how to identify decision-makers at target accounts.
The Index-Not-Login Method: X-ray search queries Google's index of LinkedIn's public pages instead of LinkedIn's own search. That sidesteps connection-degree limits, result caps, and the paywall, at the cost of brittle strings and zero contact data.
The method works because there are two copies of LinkedIn's public data: the one behind LinkedIn's login, with its degree limits and paywalled search, and the one Google has crawled and indexed. X-ray queries the second copy, so LinkedIn's gates do not apply.
That is also its ceiling. The Google copy is a snapshot: it lags LinkedIn, it misses opted-out profiles, and it has no contact fields because those were never on the public page. X-ray is excellent for a quick, free "who fits this description at this kind of company" question, and useless as a system of record. The quotable version: "X-ray reads LinkedIn's public shadow, not LinkedIn itself."
Use it to generate a shortlist for free, then move to a proper data source to reach anyone on it.
There is a role for X-ray even on a well-funded team: it is a fast way to sanity-check a segment before committing budget. If a 30-second X-ray string for "your ICP title at your ICP company type" returns almost nobody, that is a signal your ICP definition is too narrow or the people you want are not on LinkedIn under the titles you assumed. Better to learn that from a free search than after buying a list.
One more practical note on brittleness: keep your working X-ray strings in a document with the date you last confirmed each one returns results. When LinkedIn changes its URL structure or Google adjusts how it indexes profile pages, a batch of your strings will quietly stop working, and you want to notice that before you conclude a segment has no prospects. A monthly re-test of your five or six core strings takes a few minutes and saves you from acting on an empty result that is really a broken query.
X-ray search produces names and companies with no way to contact them. Bridging from a name to a verified email and phone number is a separate step, and doing it by scraping LinkedIn risks your account.
InboundLabs is a sales intelligence platform built on a database of 280M verified B2B contacts with verified direct dials, not switchboard numbers, and 98% email deliverability on verified contacts. It layers buyer intent signals on firmographic data and lets you filter by industry, headcount, region, and title, so you can build the same kind of targeted list an X-ray string would find, with the contact data already attached. Monthly plans, no annual lock-in. Free to start, no credit card required.
See how InboundLabs finds verified contacts instantly → inboundlabs.app
LinkedIn X-ray search uses Google's site:linkedin.com/in/ operator plus Boolean terms to search LinkedIn's indexed public profiles from Google, with no account, no Premium, no connection-degree limit, and no result cap. It is a fast, free way to build a shortlist. The catches are real: the strings break when LinkedIn changes URLs, opted-out profiles never appear, coverage is incomplete, and it returns no email addresses or phone numbers. Use X-ray to discover who fits, then move to a verified data source to actually reach them.
A technique for finding LinkedIn profiles by querying Google's index of LinkedIn's public pages, using site:linkedin.com/in/ plus Boolean search terms, instead of searching inside LinkedIn. It works logged out, with no LinkedIn account or paid subscription, and is not subject to LinkedIn's connection-degree or result limits.
In Google, type site:linkedin.com/in/ followed by the words you expect on the target profile: a job title in quotes, a location, and industry keywords joined with OR in parentheses. For example: site:linkedin.com/in/ "VP of Marketing" "Boston" ("SaaS" OR "fintech"). Read the results while logged out of LinkedIn.
Yes, but the strings are brittle. They break when LinkedIn changes its profile URL structure, and profiles that opt out of search-engine indexing never appear. Coverage is incomplete and index entries can be stale. It still works well enough as a quick, free discovery method, just not as a reliable data source.
No. X-ray search returns LinkedIn profile URLs and whatever text was on the public page, which does not include contact information. After finding a name and company, you need a separate tool or database to get a verified email address or phone number.
Searching Google's public index is not scraping LinkedIn and does not by itself violate LinkedIn's terms, because you are not logged in or automating actions on the platform. The risk starts when you automate X-ray at scale or feed the results into a tool that then scrapes LinkedIn directly.
X-ray for a free, one-off discovery when you do not have Sales Navigator or want to reach past its result limits on a specific search. Sales Navigator for an ongoing workflow: precise filters, saved Lead Lists, job-change alerts, and account tracking. X-ray finds people once; Sales Navigator manages a pipeline.
LSI keywords: LinkedIn X-ray search, site:linkedin.com/in/, Google Boolean operators, public profile index, connection-degree limit, result cap, brittle strings, opt-out indexing, sourcing, no contact data, Sales Navigator, logged-out search
For sales prospecting, use Sales Navigator. It is purpose-built for B2B sales, it costs less, Sales Navigator Core at about $99.99 a month against Recruiter Lite at about $170 a month as of August 2026, and it finds both buyers and, if you also recruit, candidates. Recruiter's filters and workflow a
Sales Navigator Boolean search uses five operators: AND, OR, NOT, quotation marks, and parentheses, typed into the keyword field to build precise queries the dropdown filters cannot express. There is a maximum of 15 Boolean operators per query.
The single highest-return move in LinkedIn Sales Navigator is to start every search by excluding the accounts you should never contact: maintain a blacklist of customers and competitors, then use it as an exclude filter so every result is a real prospect. After that, the wins come from tighter filte
ZoomInfo vs LinkedIn Sales Navigator compared on 2026 pricing, data export, and coverage. Find out which one actually fills your pipeline.
No commitment. No credit card. Just 50 free verified contact lookups.