The 60-second quick start
The old way: writing boolean strings by hand β quotes, ANDs, ORs, minus signs, site: commands β then debugging them when they came back empty. Now, three steps:
- 1Pick a template β LinkedIn profiles, or resumes anywhere on the web.
- 2Type plain words: skills, titles, a city. The tool writes all the boolean for you.
- 3Hit Search, then press the green οΌAdd next to anyone worth keeping. They land in your project on the Desk.
What an "x-ray search" is β and why it finds people LinkedIn won't show you
The plain-English version: Google and Bing read and index LinkedIn's public profile pages the same way they read every other website. An x-ray search simply tells the engine "search only inside linkedin.com/in" β you're looking into LinkedIn from the outside, through the search engine's own copy of it. That's the whole trick, and this tool writes it for you on every search.
"But I have a LinkedIn Recruiter license β why would I need this?" Keep the license. This works with it β and finds people it won't show you:
- LinkedIn's search shows you what its algorithm chooses. Results are ranked and filtered by network distance and LinkedIn's own priorities β so profiles outside your network, or buried on page 40, simply never surface no matter how well they fit. Google and Bing rank the same public profiles by completely different rules, so different people rise to the top. Recruiters with seats run x-rays for exactly this reason: it's a second, independent draw from the same deck.
- People describe themselves in their own words β and the engines read the whole public page as plain text. Wording that slips through LinkedIn's structured filters gets caught here.
- And LinkedIn is only one pond. The same x-ray technique aims anywhere: resumes and CVs on personal sites and blogs, GitHub profiles and github.io resume pages, portfolios, niche communities. Candidates who barely maintain their LinkedIn are often fully alive somewhere else β with their email right on the page β and nobody else is calling them.
One practical requirement: the searching happens outside LinkedIn, but the reading happens on it β when you click through to a profile, LinkedIn expects you to be logged in to show it to you (just like Facebook: no account, no peeking). Any LinkedIn account works, including a free personal one; a Recruiter seat is not required.
And on the safety question: this tool never logs into, automates, or reads LinkedIn on your behalf β you're searching the engines' public index, and then reading profiles yourself, as yourself, like any normal member. That's why it can't put your account or your Recruiter license at risk.
The whole workflow, step by step
Every step below used to be its own tool, its own tab, its own typing chore. Now it's one desk:
- 1Describe who you need in the Query builder β plain words, no syntax. Running it again next week? Save it as a Saved search.
- 2Search β the tool opens Bing or Google with a professional-grade query it wrote for you.
- 3Capture β every profile in the results gets a green οΌAdd button. One click files that person into your project. Already saw someone last month? Their link shows visited purple β your own trail, for free.
- 4Read & decide β click a name and the profile opens in one reusable side window (no tab explosions). Want them? The highlight trick (next section) fills their card: employer, title, company website, mail-checked.
- 5Get the email β π Find REAL format reads how that company actually writes its addresses and builds this candidate's, ranked by how common each pattern is.
- 6Work the list β mark fit / not a fit, add notes, and export an ATS-ready CSV when it's time to hand off.
The highlight trick β fill a card straight from the profile
Remember how this chore used to go? You're reading a candidate's profile and want to reach out. So you read who they work for nowβ¦ type the company into your trackerβ¦ go hunting for the company's websiteβ¦ double-check that's really where their email livesβ¦ head to an email-format site and look up how that company writes its addressesβ¦ and finally piece together the candidate's likely email. Five stops and a lot of typing β for every single candidate.
Now? Highlight their current job on the profile, right-click, and choose Send selection to Sourcer's Desk. That's it β the tool reads the employer and job title, files them on the candidate's card, finds the company's website, verifies it actually receives mail, and looks up the company's real email format. All of it, from one right-click. A small confirmation pops up in the corner of your screen telling you exactly what it found.
- Tiny company the databases have never heard of? Open the company's own page, highlight its website address line, right-click β Send β the web address lands on the same candidate's card.
- The corner pop-up always tells you the outcome β including βalready up to dateβ when there was nothing new to learn, so you're never left wondering whether the click did anything.
Boolean, without the homework
You used to have to learn all of this before you could source well. Now the tool writes it for you β but knowing what the symbols mean makes you sharper at reading what it wrote:
- Quotes = exactly these words together.
"staff accountant"won't match a staff writer who once counted. - OR = any of these is fine (job titles). AND = must have all (skills).
- Minus = never show me this. The Exclude field adds it for you.
- site:linkedin.com/in = search only inside LinkedIn's public profiles β the "x-ray". You see profiles without LinkedIn ever knowing you searched.
Nothing here needs memorizing. Read the query the builder generates on each search and you'll absorb it at your own pace β like picking up a language by living where it's spoken.
Worked examples (built live β always current)
Location logic β the part that finds people others miss
The old way: type Baltimore and hope β then wade through people who went to school there years ago, or pages that merely mention the city. The pros' fix was hand-building lists of phone area codes for every metro β a trick that took years to learn and typing to apply, every single search. Now the tool runs the whole trick for you:
LinkedIn template: type Chicago or San Francisco and the autocomplete hands you LinkedIn's own way of writing that location β "Chicago, Illinois, United States" β the exact phrase LinkedIn prints on member profiles. That precision buys you two things. First, no false positives: a plain Chicago matches University of Chicago alumni and deep-dish blog posts; the full phrase appears only where LinkedIn itself wrote it. Second β the real sourcing payoff β when a profile carries that phrase, the person is genuinely tied to that market: they live there now, or they've worked at a firm based there. You're not hoping your results are Chicago people β the phrase makes it overwhelmingly likely. Pick from the autocomplete and it can't be wrong.
Resumes & GitHub templates: resumes on the open web don't use LinkedIn's long phrase β they typically just list a city and state ("Towson, MD"), and plenty only reveal location through a phone number. So here your typed city becomes three signals, OR-ed β any one of them finds the person:
- City name β for people who write it out.
- Phone area codes β a Towson resume says 443 just like a downtown Baltimore one. Suburbs found. (This one's a big deal β it gets its own section, right below.)
- State tail β "MD" catches any town line like White Marsh, MD.
And how it knows a page IS a resume: a real resume says so in its page title or its URL (/resume.pdf, "Jane Doe β Resume"). Pages that merely mention a resume in the text usually aren't one. So the Resumes template anchors resume/cv with intitle: / URL operators instead of searching the body β and the operators adjust automatically to Bing or Google.
Trade-offs, honestly: "MD" also matches physicians' credentials (delete it for healthcare searches). And a dozen states (OR, IN, OH, OKβ¦) never get tails β their abbreviations are ordinary words that would match everything. Those metros rely on city + area codes.
The area-code trick β pre-wired phone-number intelligence
The old way: elite sourcers kept a private spreadsheet. For every metro they worked, they'd research the local phone area codes, type them into resume searches as an OR-list, and keep the list current as phone companies added new codes. It's one of the highest-payoff tricks in sourcing β and most recruiters never learned it existed.
Why it works: resumes almost always include a phone number β even when they never name a city. And area codes are geography. A Baltimore-area cell starts with 410, 443, or 667 whether its owner lives downtown or out in Towson, White Marsh, or Glen Burnie. Here's the payoff: the candidate who writes "Towson, MD" at the top of their resume and never once types the word Baltimore is completely invisible to a city-name search. Their phone number finds them anyway. The suburbs β where most of your candidates actually live β open up.
What's pre-wired for you: the tool ships with a hand-curated, verified
table of area codes for 46 U.S. metros β the original core codes and the newer overlay codes
that hand-built lists always miss. Type Baltimore into a resume search and the query automatically
carries ("Baltimore" OR "410" OR "443" OR "667" OR "MD") β
city name, every area code, and the state tail, each one a separate net. Multi-state metros are wired the
way a local would wire them: Washington DC pulls codes from DC, Maryland, and Virginia,
because that's where DC's workforce actually lives.
Honest fine print: cell numbers travel when people move, so an area code is strong β not certain β evidence of where someone lives. That's fine, because this is an additive net, not a filter: it can only surface extra candidates your other signals missed, and every one of them still has to match your title and skills. Query length is managed for you too β big metros send their three most-issued codes, so Google (which stops reading long queries) never drops the end of your search.
Search engines get lazy β and quietly drop the parts you care about
The old way to learn this lesson: an afternoon lost to a search that looked healthy β 57 results! β where not one person was from your city. Here's what actually happened, and how the tool now catches it before it costs you the afternoon:
The engines' dirty secret: when your query demands too much at once, the engine doesn't tell you "nothing matches all of that." A page of zero results looks like failure β so instead it gets lazy: it quietly throws away the parts of your query it considers expendable and shows you something. You get a healthy-looking page of resultsβ¦ for a search that is no longer the one you wrote. And the first thing it throws away is usually the long quoted location phrase β often the part you care about most. It will never tell you it did this. The only symptom: results that ignore your city.
The defense: decide what can never be dropped, and demand only that. The parts that matter are the title, your one most differentiating skill, and the location β keep those tight. Every other skill goes in as any instead of all: there they still pull better matches to the top, but they can't overload the query and trigger the laziness. (Real example: a staff-accountant search with four must-have skills returned 57 results, none from Baltimore. Same search with one must-have: Baltimore was back.)
The tool stands guard twice: the builder warns you the moment you stack 3+ must-have skills β before you even search β and the panel on the results page counts how many results actually mention your city. If the engine dropped your location, it tells you right there, on the spot.
Beyond LinkedIn β sites worth x-raying
Everyone fishes the same pond. The candidates nobody else is calling live
on the sites nobody else searches β and the Custom site x-ray template turns any site with public
profiles into your private talent pool. Comma-separate several to search them at once. (Spelling matters:
a typo'd site: silently returns nothing.) A starter map:
- behance.net Β· dribbble.com (three b's!) β designers, creative developers, portfolios
- stackoverflow.com/users Β· gitlab.com Β· github.io β developers
- kaggle.com β data scientists & ML
- wellfound.com (ex-AngelList) β startup talent
- medium.com Β· substack.com β writers, and practitioners who write
- researchgate.net Β· scholar.google.com β scientists & academics
- slideshare.net β speakers & presenters by topic
Your sites are saved with the template, so your own niche list builds up over time. Freeform pages β resume-style location logic (city + area codes + ", ST") applies automatically.
One search, three pools of candidates β cycle the match buttons
The old way: you ran your search, worked through the page, and called it done β never knowing that the very same search was hiding a second and third pool of candidates.
The secret: next to Skills and Job titles sit three little buttons β anywhere Β· title Β· url. They tell the engine where your words must appear: anywhere on the page, in the page's title, or in its web address. Each setting surfaces a genuinely different set of people β someone whose profile headline says Payroll Manager is a different crowd from everyone who merely mentions payroll somewhere. Same words from you, three different result sets. Cycling through them can triple what one query finds:
- Your browser works with you here: people you already looked at show as purple (visited) links, so on each new pass only the fresh faces stand out.
- Three passes take about three minutes β on a query you already wrote. That's the cheapest source of brand-new candidates in this whole guide.
Docs only β when you want the actual resume file
What it does: resumes on the open web come in two forms β web pages
about a person, and the real thing: an actual resume file the person uploaded somewhere. Flip
Docs only on and you're now asking the engine for actual Word or PDF files only β and since
most real resumes are written in Word or saved as PDFs, that's exactly the net that catches them. (Under
the hood it adds filetype:pdf OR doc OR docx.)
Why you'd want that: a real resume file is the jackpot. Full work history, and usually the phone number and personal email sitting right at the top β no format lookup, no guessing, ready to contact. When you want candidates you can reach today, documents are the shortest path.
When to leave it off: GitHub. The resumes that live at github.io addresses are web pages, not files β turn the toggle on there and you're demanding PDFs from a site that hosts almost none. The filter starves your results down to nothing. The tool watches your back on this: flip Docs only on with the GitHub template and it warns you right in the builder. (And on LinkedIn x-rays the toggle disappears entirely β profiles aren't files.)
Killing the noise β an exclude list that works every search, forever
The old way: you run a resume search and half the page isn't people at
all β it's job postings, resume templates, "sample resume" pages, apply-now portals. So you learned
to type -jobs -sample -template at the end of every
search⦠when you remembered. And the noise words you personally kept hitting? Retyped, search after search,
for years.
What we're eliminating: when you search for resumes, the web sends back everything about resumes β pages for job seekers, not pages of candidates. The built-in excludes ship pre-loaded, and each word kills a specific kind of junk:
- -jobs, -job β job postings and job-board listing pages.
- -apply β the postings that slip past -jobs. A recruiter's field trick: a job ad almost always says βApply.β A real person's resume almost never does. One word, and the stragglers are gone.
- -template β resume-template galleries ("download this beautiful resume design!").
- -sample β "sample resume" teaching pages that show what a resume should look like.
These are the most common ways to quickly and easily separate the wheat from the chaff: every search starts pre-cleaned, and what's left is far more likely to be an actual person's actual resume.
And it learns your noise, step by step:
- 1Run your searches. Notice a junk word that keeps showing up in results you never want β hiring, recruiter, staffing, whatever plagues your niche.
- 2Open the Built-in excludes field in the builder and add it.
- 3That's it β the list is saved with the template, so your word is excluded on every future search automatically. Your standing list grows once; it works forever.
The per-search Exclude field is still there for one-off noise ("this search keeps hitting a university β exclude it today only"). Built-in excludes = your permanent taste; the Exclude field = today's annoyance.
USE BING FIRST β Google second, and why
The old way to learn this: you'd craft the perfect x-ray in Google, run it, tweak it, run it again β and suddenly you're clicking traffic lights in CAPTCHA puzzles for the rest of the afternoon. Google treats rapid-fire advanced searches β quotes, site:, minus after minus β as bot-like behavior, and heavy boolean users are exactly who trips that alarm. The two engines have personalities: Bing is easygoing and lets you search like a power user without complaint; Google can put you in a straitjacket β micromanaging your searching and constantly stopping you to prove you're a real human.
The order that works: start on Bing. It tolerates x-ray searching far better β run your variations, cycle the match buttons, iterate freely, no puzzles. Then take your best one or two queries to Google as a second pass: its index and rankings differ from Bing's, so it surfaces some people Bing didn't. Two engines, two draws from different decks.
The builder makes switching costless: flip the Bing/Google toggle and your query is rebuilt for that engine automatically β the search commands aren't identical across the two, and the tool speaks both dialects. Even the query-length guardrails adjust, because Google stops reading long queries sooner than Bing does.
Techniques that separate sourcers from searchers
These habits took working recruiters years to build. Each one is now a click β but knowing why they work is what makes you dangerous:
- Cycle the match buttons (anywhere β title β url) β the full walkthrough is the section right above this one. One query, three pools.
- Run both templates on the same search. LinkedIn first, then the resume version β the "also search asβ¦" link under the query does it in one click.
- Exclude the noise you keep seeing β recruiter, hiring, staffingβ¦ the full walkthrough is the section right above this one. Your standing list, saved once, applied on every search.
- Docs only for real resume FILES β the full story (including when to leave it off) is two sections above. The short version: files mean contact info at the top.
- Bing first, Google second β the why is one section up. Short version: Bing lets you iterate freely; Google catches what Bing missed.
- Titles are written ten ways. OR them: accountant, staff accountant, accounting specialistβ¦