Sherlock: Hunt Usernames Across 400+ Sites in Seconds

Username enumeration is a crucial first step in any subject investigation. People often reuse the same handle across multiple platforms, making it a valuable piece of intelligence. Sherlock is a free, fast, and account-free tool that maps a subject's online footprint by searching for a username across 400+ platforms.

What Sherlock Does

Give Sherlock a username, and it will concurrently query 400+ platforms — including social networks, forums, developer communities, dating sites, and creative platforms. The results are direct URLs, which can be written to a text file for easy reference. Sherlock's detection layer is more sophisticated than a simple HTTP status code check, using expected response patterns and content checks to minimize false positives.

Installation and Setup

To get started with Sherlock, you need Python 3.6 or higher. If you already have a Python environment set up, you're likely good to go. Installation is straightforward:

pip install sherlock-project

Alternatively, you can clone the repository from GitHub for the latest site list updates:

git clone https://github.com/sherlock-project/sherlock
cd sherlock
pip install -r requirements.txt

That's it. No API keys, no account registration, no configuration files. A Docker image is also available for isolated tooling or avoiding dependency conflicts.

Running Effective Searches

Running Sherlock is simple:

sherlock username

Useful flags include:

• --timeout 10 to set the per-site request timeout in seconds
• --output results.txt to override the default output filename
• --folderoutput ./results to write each username's results to a named file inside a directory
• --site Twitter to limit the search to a single platform
• --print-found to only print confirmed hits to the terminal

You can run multiple usernames at once by passing them as space-separated arguments:

sherlock handle1 handle2 handle3

Combine this with --folderoutput to keep your results organized.

Accuracy and False Positives

Sherlock is reliable, but not perfect. Smaller regional platforms and certain forum software may produce false positives. Treat unexpected hits as unverified until you manually check the URL. Use the --print-found flag to get confirmed hits, then spot-check any unexpected results.

A confirmed hit only indicates the username exists on a platform, not that it belongs to your subject. Username collision is real, so every hit requires a content-level check before you can treat it as belonging to the person you're investigating.

Practical Workflow: Subject Research

To get the most out of Sherlock, start by building a list of known aliases, email prefixes, gamertags, and variants your subject has used elsewhere. Run Sherlock against each variant, and use the output files as input for downstream tools like Maltego or social media scrapers. Saving timestamped outputs is crucial for formal investigations, as it provides a point-in-time record of what was found and when.

Limitations

The site list is community-maintained and can trail reality. When a platform changes its profile URL handling or authentication, Sherlock's detection breaks until someone submits a fix. Running an outdated version can result in zero hits from a platform you know your subject uses. Pull updates before important runs.

Sherlock only finds profiles; it doesn't extract anything from them. It's a pointer tool that tells you where to look, not what's there. Extraction is a separate step with separate tools.

Aggressive runs can trigger rate limiting or temporary IP blocks from sites with bot detection. The --timeout flag helps, but it doesn't throttle request rate. If you're running Sherlock repeatedly against the same platforms, expect some sites to return inconsistent results. Use a VPN or rotate your exit node if this becomes a problem.

Verdict

Sherlock earns its place in the toolkit by doing one thing well and costing nothing. It produces clean output and requires minimal effort. Investigators who get the most out of it are those who need fast, broad coverage — journalists on deadline, OSINT analysts building an initial digital footprint, and security researchers tracking threat actors.

The key is to use Sherlock as the opening move, not the closing one. It produces a lead list, not a finished picture. What you do with those URLs — verifying attribution, extracting content, mapping relationships — is where the real investigation work happens.

Best for: Initial subject profiling, username variant enumeration, journalists and investigators needing fast platform coverage
GitHub: sherlock-project/sherlock