Difference between active and passive reconnaissance. Which to use first?

Passive recon — gathering info without sending packets to target (Google dorking, Shodan/Censys queries, GitHub source code search, social media OSINT). Stealthy, can't be blocked. Active recon — direct interaction (port scans, banner grabbing, web crawling). Faster but detectable. Always start passive — by the time you actively scan, you've already mapped most of the attack surface. Tools: passive — recon-ng, Maltego, theHarvester, Wayback Machine. Active — nmap, masscan, gobuster, ffuf.