Finding B2B Leads on LinkedIn Without Sales Navigator

Every LinkedIn prospecting guide assumes you have Sales Navigator. Most people building their first list do not, and paying for a subscription before you know whether the channel works for you is the wrong order to do things in.

This is what the free account is actually good for, where it stops, and the three routes around the wall — with an honest note on which ones LinkedIn tolerates and which one it does not.

What you are actually buying with Sales Navigator#

Worth being precise, because the marketing makes it sound like access to a different database. It is not. It is the same profiles with better filters.

What you get	Does the free account have it?
Filter by seniority, function, headcount, growth	No — free search filters are coarse
Unlimited profile search	No — free accounts hit a monthly commercial use limit
Saved lead lists and change alerts	No
See people well outside your network in results	Partially — free results thin out past the second degree
Email addresses	No. Neither tier gives you these

That last row is the one people get wrong. Sales Navigator does not hand you email addresses. Whatever tier you are on, the address has to come from somewhere else — the company website, a directory, an imprint page, or a pattern you infer and verify. The paid product is a targeting upgrade, not a contact data upgrade.

So the real question is not "can I search without it" but "can I build a targeted list of companies and roles, and then get from a name to an inbox". Both halves are doable for free.

The commercial use limit, and how it actually behaves#

Free accounts have a cap on how many profile searches you can run in a calendar month. LinkedIn does not publish the number, it varies by account, and it resets at the start of the month. You get a warning screen before you hit it.

Two things about it matter practically:

• It counts searches, not every profile you look at. Reaching profiles from a company page, a post's comment section or an external link does not burn the allowance the same way search after search does.
• It is per account, not per person. Running a second personal account to double your allowance is a bannable pattern, and a banned account takes your network with it. Don't.

The tactic is not to beat the limit. It is to spend fewer searches by finding the same people through pages that are not search results.

Route one: search operators on Google, not on LinkedIn#

Public LinkedIn profiles are indexed by search engines. You can query them without touching your monthly allowance:

site:linkedin.com/in "head of marketing" "Manchester"
site:linkedin.com/in ("founder" OR "co-founder") "dental clinic" "London"
site:linkedin.com/company "recruitment agency" "Birmingham"

Rules that make the difference between a usable result set and noise:

• Quote the exact job title. "head of growth" and head of growth return very different pages — the unquoted version matches any profile containing those three words anywhere.
• Use OR groups for title variants. The same job is called Head of Marketing, Marketing Director and CMO depending on company size.
• Add the city, not the country. "United Kingdom" matches nearly every UK profile. "Sheffield" matches the ones you can name a local reference for in the first line of your email.
• Search /company as well as /in. A company page confirms the business exists and gives you the website domain, which is where the email actually lives.

This route costs nothing and scales. Its weakness is freshness: the index reflects profiles as they were last crawled, so titles can be months out of date. Check the profile before you use a title in a subject line.

Route two: work from the company, not the person#

For most local and mid-market B2B you do not need a named individual. You need the business, its domain, and whoever reads the address published on it.

That flips the exercise. Instead of searching for people and hoping for a company, build the company list from a source with better coverage — Google Maps for anything with a location, a trade association directory, a plain web search — and use LinkedIn only to answer one question: who is the right person here?

Used that way LinkedIn is a research tool at the end of the pipeline rather than the source at the front of it. You spend a handful of profile views on the accounts worth a personal message and none on the ninety percent where the published address is the correct destination anyway.

This is also the honest answer for small businesses. A twelve-person agency does not have a Head of Partnerships. It has a founder who reads the contact form.

Route three: the people you did not have to search for#

Three places on LinkedIn produce qualified names without a single search.

Comment sections on posts in your niche. Someone commenting on a post about restaurant payment processing is self-identifying as caring about restaurant payment processing. Open the post, read the commenters, note the companies.

Event, webinar and speaker lists. These name people who spent time or money to be in a room about your topic.

Public engagement with your competitors. A company page's follower list is not fully exposed, but people who publicly comment on a competitor's posts are visible, and they are the warmest cold list that exists.

None of this scales to five thousand contacts. All of it produces the fifty contacts most likely to reply, which for a first campaign is the better number.

Getting from a name to an address#

You have a person, a company and a domain. You do not have an email. There are three honest ways forward.

Find it published. Plenty of businesses publish a named address somewhere — a team page, a press release, a job advert, or the imprint page that is legally required in Germany and Austria and is a gift to anyone prospecting there. A site crawl finds these; that is exactly what a website email extractor does.

Infer the pattern, then verify. If you know sarah.jones@acme.com for any one employee, you know the shape for the rest.

Pattern	Example
first.last@	sarah.jones@acme.com
first@	sarah@acme.com
flast@	sjones@acme.com
firstl@	sarahj@acme.com
first_last@	sarah_jones@acme.com

Guessing is only acceptable if every guess is verified before it is sent to. An unverified guess is a bounce, and bounces are the fastest way to wreck a young sending domain — the mechanics are in the deliverability guide.

Use the generic address deliberately. info@, hello@ and contact@ have a reputation in outreach circles that is only half deserved. At a business with fewer than twenty people the generic inbox is usually read by someone with authority, often the owner. At a five-hundred-person company it goes to a queue. Size the account before you decide.

What none of these are is a bulk database export claiming thousands of pre-verified addresses. Those lists are assembled from the same public sources, aged, and resold. Whatever you buy, verify it yourself — what verification actually checks explains why "risky" is a real answer rather than a hedge.

Where the rules actually sit#

LinkedIn's user agreement prohibits automated scraping of the platform, and it enforces that with account restrictions rather than with lawsuits against individuals. The distinctions that matter:

• Reading public profiles by hand, or through a search engine's index, is not scraping LinkedIn. You are reading a public page, or a page the search engine already crawled.
• Pointing a browser automation tool at your logged-in account is, and it is the quickest route to a restricted account. The vendors selling this describe the risk in small print.
• Contacting someone at their business address is governed by email law, not by LinkedIn's terms. In the UK and most of the EU, B2B email to a corporate address is permitted with conditions: identify yourself, say why you are writing, honour opt-outs immediately. The general shape of that is covered in what is and is not legal about collecting public business data.

The practical version: use LinkedIn as a research surface, keep automation off your account, and let the address come from sources that publish it for exactly this purpose.

A worked example#

Selling a booking system to independent recruitment agencies in the north of England.

1. Search site:linkedin.com/company "recruitment" "Leeds" OR "Sheffield" OR "Manchester". Forty company pages, none of them costing a profile search.
2. Take the website domain from each page. Drop the national chains — you want the independents, and the recruitment agencies page explains how that half of the market actually buys.
3. Crawl those domains for published addresses. Roughly half will have a named one on a team page.
4. For the half that do not, open the company page's People tab, find the director, infer the pattern from the addresses you already found at that domain, and verify.
5. Verify everything. Drop hard failures; decide on catch-all domains case by case.
6. Send in batches of twenty-five, not four hundred.

That is thirty to forty genuinely relevant businesses, built in an afternoon, with no subscription. If the campaign works, then ask whether better filters would help you find the next four hundred — the agency pipeline guide covers turning a first campaign into a weekly routine. If it does not work, you learned that for free, which is the entire reason to do it in this order.

FAQ#

Can I export LinkedIn contacts to a CSV?#

You can export your own connections through LinkedIn's data export tool, which includes the addresses those connections chose to share with their network. You cannot export people you are not connected to, and no tier includes email addresses for the wider database.

Does Sales Navigator include email addresses?#

No. It improves search filters, saved lists and alerts. Contact details still have to come from a published source or an inferred-and-verified pattern.

Is it legal to email someone whose details I found via LinkedIn?#

The lawful basis comes from email law in the recipient's country, not from where you found the name. In the UK and most of the EU, B2B email to a corporate address is permitted under legitimate interest provided you identify yourself, state why you are writing and honour an opt-out immediately. Emailing a sole trader's personal address is a stricter category in several jurisdictions.

How many profile searches does a free LinkedIn account get?#

LinkedIn does not publish the figure and it varies by account and activity. You will see a warning screen as you approach it, and it resets at the start of each calendar month. Building the company list elsewhere and using LinkedIn only for research keeps you well under it.

What is the fastest free way to build a B2B list?#

Pick one sharply defined business type and one city, collect every business matching it from a source with good coverage, take the addresses from their own websites, and verify before sending. Depth in one niche beats breadth across five — the reasoning is in the B2B lead generation guide.