Guide · Updated · By William Lodge
Username Search: How to Find Accounts Across Sites (and Avoid False Matches)
How username enumeration tools like Sherlock, Maigret, and WhatsMyName work, how to run them, and how to avoid wrongly linking accounts to a person.
People reuse usernames. Searching one handle across hundreds of sites can map someone's public footprint in minutes — which is why it's one of the most used and most privacy-sensitive OSINT techniques. Use it for legitimate purposes: checking your own exposure, investigating fraud or abuse targeting your organization, or authorized research.
How username search tools work
Most tools keep a list of sites and the URL pattern for a profile (for example https://example.com/user/{username}). They request each URL and decide whether the account exists based on the HTTP status code, a redirect, or text on the page. That approach is fast, but every site behaves differently, so results include errors.
The main tools
- Sherlock — the best-known option. Install with
pipx install sherlock-projectand runsherlock username. It prints found profiles and can save results to a file. - Maigret — checks thousands of sites, extracts profile details where possible, and can generate reports. Run
maigret username. - WhatsMyName — a community-maintained dataset of site detection rules used by many other tools, with a web interface for quick checks.
- Blackbird — searches by username or email across social networks.
Running two tools and comparing results catches more true hits and exposes inconsistent detections.
False positives are the real danger
A username match proves only that an account with that name exists — not that the person you're researching owns it. Common handles like alex92 exist on hundreds of sites, held by different people. Before treating two accounts as the same person, look for multiple independent links:
- The same profile photo (verify with reverse image search).
- Cross-links between profiles, such as a bio linking to another account.
- Consistent, distinctive details: location, employer, writing style, creation dates.
Also expect false negatives: sites change layouts, block automated requests, or rate-limit, so "not found" doesn't mean "doesn't exist."
Responsible use
- Have a clear, lawful purpose before researching a private individual.
- Don't log in, message, or follow accounts as part of passive research, and never create fake accounts to view content.
- Keep results secure and delete what you don't need.
Check yourself
Run these tools on your own usernames. Old forum accounts and abandoned profiles are common sources of personal data exposure — and a good reason to use different handles for different parts of your life.
See every tool in this space: Social & identity tools.
You are responsible for authorization and the laws that apply to your research. OSINTCompass lists tools for lawful, ethical public-source research.