A single username links accounts across the internet. Sherlock checks 400+ platforms for username existence; Maigret checks 3,000+ sites and adds profile parsing (extracting personal data, linked accounts) and recursive search (auto-expanding to new usernames found on profiles). Cross-platform correlation connects discovered accounts via profile photos, bio text, activity timestamps, and social graph overlap. Ghost accounts (deleted profiles preserved in web archives) provide evidence of accounts destroyed to hide digital footprints. Always verify attributions — username reuse across unrelated people produces false positives.
Why Usernames Matter for OSINT
A username is often the single most consistent identifier across a person’s digital life. While email addresses, phone numbers, and real names may vary across platforms, many people reuse the same username — or predictable variations — across dozens of services. This creates a digital fingerprint that links accounts, builds identity graphs, and reveals behavioral patterns that no single platform exposes in isolation.
Username investigation is a core OSINT technique used in journalism (identifying sources and verifying claims), law enforcement (building suspect profiles), corporate security (insider threat detection), fraud investigation (connecting sockpuppet accounts), and competitive intelligence (tracking competitor activity). The technique is entirely passive when limited to querying public profiles and search indexes.
Username Enumeration Tools
Two tools dominate open-source username enumeration: Sherlock and Maigret. Sherlock (by the Sherlock Project, 200+ contributors) checks a given username across 400+ websites and platforms, outputting found profile URLs (Bellingcat Toolkit — Sherlock (v0.16.0, 2024)). It’s lightweight, CLI-based, and supports CSV/XLSX export, proxy/Tor routing, and site-specific filtering.
Maigret, a more powerful fork of Sherlock, checks over 3,000+ sites by default (top 500) with an expandable database. Its key advantage is profile page parsing: Maigret doesn’t just check if a username exists, it scrapes account pages to extract personal information, links to other profiles, and unique identifiers. It performs recursive search — when new usernames or IDs are found on a profile, Maigret automatically searches for those as well, building an expanding identity graph (Bellingcat Toolkit — Maigret). Reports can be generated in HTML, PDF, TXT, XMind mindmap, and JSON formats.
Tool Comparison
| Feature | Sherlock | Maigret | WhatsMyName | Namechk |
|---|---|---|---|---|
| Sites checked | 400+ | 3,000+ | 732 | 90+ |
| Profile parsing | No (URL only) | Yes (extracts info) | No | No |
| Recursive search | No | Yes (auto-expands) | No | No |
| Report formats | TXT, CSV, XLSX | HTML, PDF, JSON, XMind | JSON | Web UI |
| API keys required | No | No | No | No |
| Web interface | Community only | Built-in (--web flag) | Web-based | Web-based |
| Tor/proxy | Yes | Yes | No | No |
Maigret vs Sherlock vs WhatsMyName: Which Should You Use?
Quick verdict: use WhatsMyName when you want instant, no-install results from any browser; use Sherlock for a fast, scriptable command-line sweep; and use Maigret when you need depth — it checks the most sites (3,000+) and extracts profile data, but it is the slowest and most technical of the three. Serious investigators run more than one, because each catches accounts the others miss.
| Sherlock | Maigret | WhatsMyName | |
|---|---|---|---|
| Sites checked | ~400 | 3,000+ (top 500 default) | 732 |
| Setup | Python install | Python install | None — runs in browser |
| Speed | Fast | Slowest | Fast (~90s) |
| False positives | Moderate (URL check only) | Lower (parses profiles) | Low (curated list) |
| Data extraction | No | Yes (full dossier) | No |
| Best for | Quick CLI sweep | Deep investigation + reports | Instant, no-install checks |
Choose Sherlock if…
…you live in a terminal and want a fast, scriptable first pass. Sherlock checks roughly 400 of the highest-value platforms and returns clean profile URLs you can pipe into other tools. It is the lightest of the three, but it only tells you whether an account exists — not what is on it — and short or common usernames will throw false positives you must verify by hand.
Choose Maigret if…
…you need depth and a report to hand off. Maigret, a Sherlock fork, searches 3,000+ sites (the top 500 by popularity by default) and goes well beyond hit-or-miss: it parses profile pages for names, bios, and linked accounts, runs recursive search on identifiers it discovers, and exports HTML, PDF, JSON, and XMind reports. The trade-off is speed and setup — it is the slowest and most technically demanding, and it produces large output files.
Choose WhatsMyName if…
…you want results in under two minutes with nothing to install. WhatsMyName runs in any browser, checks 732 community-vetted platforms, and has one of the lowest false-positive rates because its detection rules are hand-maintained. It does not extract profile data or search recursively, but it is the easiest starting point and the dataset many other tools build on. For a no-install option you can run right now, our Username Search checks 500+ sites directly in the browser.
The honest recommendation: start with a no-install check (WhatsMyName or our tool) to scope the handle, then run Maigret when a case warrants a full dossier. Sherlock sits in the middle as a fast CLI option for analysts who script their workflow. Whichever you choose, verify every hit manually — no enumerator eliminates false positives on common usernames.
Cross-Platform Identity Correlation
Username enumeration is just the first step. The real intelligence value comes from cross-platform correlation: connecting discovered accounts to build a comprehensive identity profile. Key correlation techniques include analyzing profile photos across platforms (reverse image search), comparing bio text and self-descriptions, mapping activity timestamps to establish timezone and behavior patterns, examining friend/follower networks for overlap, and checking writing style and language patterns.
Modern OSINT frameworks like osint-d2 combine username enumeration with AI-powered cognitive profiling, generating structured summaries with confidence levels. The tool integrates Sherlock for username scanning, performs email pivoting (extracting the local part of an email as a username candidate), and produces professional dossier exports suitable for incident response or executive briefings (GitHub — OSINT-D2).
Username Pattern Analysis
People create usernames following predictable patterns. Common structures include: firstname.lastname, firstnamelastname, first_last_YYYY, nickname_numbers, and gaming handles reused across professional platforms. Analyzing variations helps predict additional accounts. If an investigator finds jsmith92 on one platform, testing j.smith92, jsmith_92, johnsmith92, and jsmith1992 across other platforms often yields additional hits.
Cultural and generational patterns also emerge: younger users favor gaming-style handles with numbers and underscores, professionals tend toward name-based formats, and some users maintain entirely separate identities for personal, professional, and anonymous activity. The Sherlock {?} wildcard feature allows testing multiple variations in a single run.
Ghost Accounts and Deleted Profiles
A username that currently returns no results may still yield intelligence. The Wayback Machine archives social media profile pages, preserving content from accounts that have since been deleted, suspended, or renamed. Our Ghost Finder tool specifically targets this use case: searching archived snapshots of social media platforms for historical evidence of usernames that no longer exist on live platforms. This is critical for investigations involving accounts deleted to destroy evidence.
False Positives and Verification
Username enumeration tools check whether a URL responds with a profile page rather than a 404 error. This produces false positives when: a platform reserves usernames (returning a “this username is taken” page rather than an active profile), when unrelated people share the same username on different platforms, or when a platform’s error handling is inconsistent. Verification is essential: examine profile content, creation dates, activity patterns, and cross-references before attributing multiple accounts to the same individual.
Key Definitions
- Username Enumeration
- The systematic process of checking whether a specific username exists across multiple online platforms. Tools like Sherlock (400+ sites) and Maigret (3,000+ sites) automate this process, querying public profile URLs and analyzing HTTP responses.
- Cross-Platform Correlation
- Connecting accounts discovered across different platforms to a single identity by analyzing profile photos, bio text, activity patterns, writing style, and social graph overlap.
- Profile Parsing
- Extracting structured data from discovered profile pages, including names, locations, links to other profiles, unique platform identifiers, and biographical information. Maigret’s key differentiator over Sherlock.
- Recursive Search
- Automatically expanding a username investigation by searching for additional usernames and identifiers discovered during profile parsing. When Maigret finds a linked account with a different username, it searches for that username too.
- Sock Puppet
- A fake online identity created to deceive. Sock puppet detection is a key OSINT application of username enumeration: correlating creation patterns, activity times, and content overlap to link multiple accounts to a single operator.
- Ghost Account
- A social media account that has been deleted, suspended, or renamed but whose content persists in web archives, cached search results, or other historical data sources.
Sources
Bellingcat Toolkit — Sherlock (v0.16.0) (400+ sites, CLI options). Bellingcat Toolkit — Maigret (3,000+ sites, profile parsing, recursive search). PyPI — Maigret v0.5.0 (installation, features). GitHub — OSINT-D2 (AI-powered identity triangulation). GitHub — Awesome OSINT (comprehensive tool directory). Oshy Tech — What is Sherlock OSINT (2025) (installation guide, brand checking use case).
Frequently Asked Questions
What is username OSINT?
Searching for a username across hundreds of platforms to map a person’s digital footprint. Tools like Sherlock (400+ sites) and Maigret (3,000+ sites) automate this. Try our Username search for quick lookups.
What is the difference between Sherlock and Maigret?
Sherlock checks 400+ sites for username existence (URL output). Maigret checks 3,000+ sites plus parses profile pages for personal data, performs recursive search on discovered identifiers, and generates rich HTML/PDF/XMind reports with graph visualization.
How reliable are username enumeration results?
False positives occur from reserved usernames, name collisions, and inconsistent error handling. Always verify by examining profile content, creation dates, and cross-references. CAPTCHAs may cause incomplete results.
Can deleted social media accounts be found?
Often yes, via web archives. Our Ghost Finder searches archived social media snapshots for historical evidence of deleted profiles. The Wayback Machine preserves profile pages even after account deletion.
Is Maigret better than Sherlock?
For depth, yes — Maigret checks far more sites (3,000+ vs ~400) and extracts profile data Sherlock cannot. But "better" depends on the job: Sherlock is faster and simpler for a quick sweep, while Maigret is slower and more technical to run. Many investigators use both.
Maigret vs Sherlock: which is faster?
Sherlock is faster for a basic check because it tests fewer sites and only confirms whether a profile exists. Maigret is slower because it scans thousands of sites and parses each profile it finds. For speed with no setup at all, a browser tool like WhatsMyName returns results in about 90 seconds.
Do I still need Maigret if I use WhatsMyName?
They serve different needs. WhatsMyName is the fastest no-install way to see where a username exists across 732 platforms. Maigret goes further — extracting profile details and building a report — at the cost of speed and a Python setup. Use WhatsMyName to scope, Maigret to investigate in depth.
What Is a Sock Puppet? Research-Persona Tradecraft, Safely
A sock puppet — or research persona — is a separate, non-attributable account an investigator uses to view public information without exposing their real identity. Used legitimately, it protects the researcher and avoids tipping off the subject; used to deceive, harass, or manipulate, it is abuse. Here is how professionals build one responsibly.
Why investigators use them
Viewing a profile, joining a public group, or running searches from your personal account can reveal who you are and alert the subject. A dedicated research persona keeps your real name, photo, and network out of the investigation.
OPSEC basics
- Separate everything. Use a distinct browser profile or virtual machine, a dedicated email, and a separate number for verification — never anything linked to your real identity.
- Keep it minimal and consistent. A believable but low-detail persona ages quietly; over-engineered backstories create contradictions that get flagged.
- Stay passive. Use the account to observe public information. Actively engaging, friending, or messaging subjects raises both ethical and legal risks.
- Respect the rules. Many platforms restrict fake accounts in their terms; weigh that, and keep a record of your legitimate investigative purpose.
Hard limits: never use a research persona to deceive or manipulate vulnerable people, to contact or build trust with minors, to entrap, or to harass. Those uses are what turn a sock puppet into a tool of abuse rather than research — and they are where legitimate tradecraft ends.