An email permutator turns a name and a company domain into every address format the company might use. Type them below and you get 22 or more candidates per domain, which you can copy or download as a CSV for your verification tool. Nothing you type leaves your browser. The permutator only guesses, so the sections after the tool cover how to find the right one and how to email it without hurting your domain.
Which email formats does the permutator generate?
For a person named Jordan Ellis at example.com, the main formats are below. Middle names, nicknames and two-part last names add more. The order is the order we try them in when prospecting, not a measured ranking: we have not found an independent, public study of business email formats with a stated method, so we do not quote format percentages.
| Format | Example | Format | Example |
|---|---|---|---|
| first.last | jordan.ellis@ | last.first | ellis.jordan@ |
| flast | jellis@ | lastfirst | ellisjordan@ |
| first | jordan@ | lastf | ellisj@ |
| firstlast | jordanellis@ | last | ellis@ |
| firstl | jordane@ | first.l | jordan.e@ |
| f.last | j.ellis@ | fl | je@ |
| first_last | jordan_ellis@ | last_first | ellis_jordan@ |
| first-last | jordan-ellis@ | last.f | ellis.j@ |
| f_last | j_ellis@ | f-last | j-ellis@ |
| lfirst | ejordan@ | f.l | j.e@ |
| first_l | jordan_e@ | last-first | ellis-jordan@ |
Domains are tidied before use: https://www.example.com/team becomes example.com. Spaces, apostrophes and accents are removed from names because most mail systems do not use them in addresses.
How do you find the right format before you guess?
The fastest check is one real address from the same company. Once you know one colleague is p.nguyen@, everyone at that domain probably follows the same format, and you need to verify one candidate instead of twenty. Places to look:
- The company's own site. Press pages, investor relations, job posts and support pages often list a named contact.
- Your CRM and inbox. Anyone at the company who has emailed your team, booked a demo or signed a contract shows the format.
- A data provider. Most will show the domain's format even when they have no record of the person. Our guide to B2B data providers compares the main ones, with prices read on each vendor's own site.
- Public filings and papers. Patents, conference papers and regulatory filings sometimes print staff emails.
Use the permutator when none of that turns up an address, and for small companies where data providers are thin.
How do you verify a guessed email address?
Paste the list into an email verification tool. Most of them open a connection to the company's mail server, ask whether it would accept mail for each address, and hang up before anything is sent. The older direct way to ask, the SMTP VRFY command, is rarely useful: the email standard lets servers disable it "for security reasons" (RFC 5321).
| Result | What it means | What to do |
|---|---|---|
| Valid | The server said it accepts mail for this address | Send to this one address only |
| Invalid | The server rejected the address | Drop it. Never send |
| Accept-all (catch-all) | The server accepts any address at this domain, so the check proves nothing | Find one known address to learn the format, then send to the single most likely candidate |
| Unknown | The server did not answer clearly (timeouts, greylisting, blocks) | Re-check later. Do not send on an unknown result |
A valid result means the mailbox exists today. It does not mean the person reads it, still works there or wants to hear from you. Our glossary on email deliverability covers what else decides whether a message reaches the inbox. For a deeper look at accept-all domains, see the catch-all email entry in our glossary.
Why not email every candidate and see what bounces?
Because the bounces land on your domain's reputation, and the rules treat it badly.
- Google's email sender guidelines tell senders to reduce volume when messages start bouncing and to automatically unsubscribe recipients with multiple bounced messages. All senders to Gmail must keep the spam rate in Postmaster Tools below 0.3%, and Google advises staying under 0.10% (checked November 3, 2026).
- The FTC's CAN-SPAM compliance guide lists generating addresses through a "dictionary attack", sending to made-up addresses in the hope that some are valid, among the aggravated violations that can bring extra penalties (checked November 3, 2026).
Twenty or more guesses for one person sent from the domain you use for sales is the pattern both rules describe. Verify first, then send one email to one address.
What rules apply when you email a guessed address?
The same rules as any cold email. Two that matter most for B2B outbound, checked November 3, 2026:
- United States, CAN-SPAM. The FTC says "the law makes no exception for business-to-business email." Each email needs accurate header information, an honest subject line, your valid postal address and a clear opt-out, and opt-outs must be honored within 10 business days. Each violating email can draw a penalty of up to $53,088.
- EU and UK, GDPR. A named work address such as jordan.ellis@ is information about an identifiable person, which makes it personal data under Article 4(1). Direct marketing "may be regarded as carried out for a legitimate interest" (Recital 47), and when the person objects you must stop processing their data for marketing (Article 21). In the UK, the consent rule for marketing email in PECR, regulation 22, applies to "individual subscribers". Many EU countries have their own e-marketing laws on top of GDPR, so check the rules where your recipients are.
This is general information, not legal advice. For the full pre-send checklist (authentication, unsubscribe, spam rate), use the one on our cold email templates page.
Where does a permutator fit in a B2B outbound process?
Late, and for a small share of contacts. A working order for one target account:
- Pick the two or three people at the account who own the problem you solve.
- Pull their emails from your data provider and verify them.
- For the people the provider misses, find one known address at the company, apply its format, and verify.
- Only if that fails, run the permutator, verify the list, and keep the one valid address.
- Write to them with a real reason to write now. Our cold email templates are organized by that reason.
Our ABM and outbound service runs that process for you: target account lists, verified contacts for each buying role, a researched message for every person, and sending set up so one bad list cannot damage the domain your sales team relies on.
Frequently asked
What is an email permutator?
An email permutator takes a person's name and their company's domain and lists every address format the company might use, such as first.last@, flast@ and first@. It does not know which one is real. You then check the candidates with an email verification tool and send to the one that verifies.
Is an email permutator accurate?
It is as accurate as the format list it uses, and it cannot confirm anything on its own. If the company builds addresses from real names in a standard format, the right address is in the list, but a permutator cannot tell you which line is right, whether the person still works there, or whether the company uses an unusual format. Verification does that part.
How do I verify an email address without sending an email?
Use an email verification tool. Most connect to the company's mail server and ask whether it would accept mail for the address, then hang up before any message is sent. The result is usually valid, invalid, accept-all (catch-all) or unknown. Only valid results are safe to send to.
What does accept-all or catch-all mean?
The company's mail server accepts mail for any address at the domain, real or not, so a verification check cannot tell the real address from a wrong guess. Treat catch-all results as unconfirmed. Look for a known address of a colleague to learn the format, and send to the single most likely address, not to every candidate.
Is it legal to guess someone's work email?
Generating the guesses is not the legal question. Sending is. In the US, CAN-SPAM applies to business email: include your postal address, a working opt-out honored within 10 business days, and an honest subject line. In the EU, a named work address is personal data under GDPR, so you need a lawful basis such as legitimate interest and must stop when someone objects. This is general information, not legal advice.
Why not send to every permutation and see what bounces?
Because every bounce counts against your sending domain. Google tells senders to cut volume when messages start bouncing, and the FTC lists sending to made-up addresses in hope that some are valid (a dictionary attack) as an aggravated CAN-SPAM violation. Verify first, then send one email to one address.
