# Username Enumeration with Sherlock

> Discover how to use Sherlock to hunt usernames across 300+ platforms, mapping digital footprints and exposing linked accounts during OSINT reconnaissance.

- **URL:** https://hackindex.io/platforms/osint/identity-and-people-intelligence/username-enumeration/sherlock
- **Path:** OSINT > Identity & People Intelligence > Username Enumeration & Cross-Platform Correlation
- **Up:** [Username Enumeration & Cross-Platform Correlation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/username-enumeration.md)
- **Published:** 2026-04-11
- **Updated:** 2026-07-10

## Overview

Sherlock searches for a username across several hundred platforms simultaneously and returns confirmed account URLs. It works by requesting each platform's expected profile URL and checking the HTTP response for presence or absence indicators. It is the fastest starting point for username-based OSINT and produces a list that feeds directly into [cross-platform correlation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/username-enumeration/cross-platform-correlation).

## Installation

```bash
pipx install sherlock-project
```

Or clone directly:

```bash
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
```

## Basic Enumeration

Run a single username against all supported sites:

```bash
sherlock $USERNAME
# [*] Checking username target_handle on:
# [+] GitHub: https://github.com/target_handle
# [+] Reddit: https://www.reddit.com/user/target_handle
# [+] Twitter: https://twitter.com/target_handle
# [+] Instagram: https://www.instagram.com/target_handle
# [-] Facebook: Not Found!
# [+] HackerNews: https://news.ycombinator.com/user?id=target_handle
```

Each line prefixed with `[+]` is a confirmed hit. Lines with `[-]` are absent or returned an error. Review every confirmed URL manually before treating it as the same person. Common usernames will produce false positives on platforms with large userbases.

## Saving Output

Write results to a file for later processing:

```bash
sherlock $USERNAME --output results.txt
```

For CSV output, useful when feeding results into a link analysis tool:

```bash
sherlock $USERNAME --csv
```

## Multiple Usernames

When you have several candidates from [variation generation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/username-enumeration/variation-generation), pass them all in a single run:

```bash
sherlock username1 username2 username3
```

Or pass a file of candidates:

```bash
cat usernames.txt | xargs sherlock
```

## Targeting Specific Sites

If you already know the subject uses certain platforms, limit the search to reduce noise and request volume:

```bash
sherlock $USERNAME --site GitHub --site Reddit --site Twitter
```

## Tor Routing

Route requests through Tor to reduce attribution back to your investigation infrastructure:

```bash
sherlock $USERNAME --tor --unique-tor
```

`--unique-tor` requests a new Tor circuit for each platform, which distributes requests across different exit nodes. This adds time but improves anonymity and reduces the chance of rate limiting hitting the same exit IP repeatedly.

## Interpreting Results and False Positives

Sherlock detects accounts by checking whether the platform returns a specific success response for a given username URL. This approach produces false positives when platforms return generic content rather than a 404 for missing accounts. Common offenders include smaller or regional platforms.

For every confirmed hit, open the URL manually and verify:

- The account content is consistent with your subject's known activity, language, or interests
- Profile photos, bios, or linked accounts match other confirmed profiles
- Join date or account age is plausible relative to other confirmed accounts

A hit that does not survive manual review should be discarded. Do not include unverified hits in any intelligence product.

## What to Do With Results

Confirmed hits feed directly into [cross-platform correlation](https://hackindex.io/platforms/osint/identity-and-people-intelligence/username-enumeration/cross-platform-correlation). Visit each confirmed account and extract any additional identifiers: email addresses, phone numbers, real names, locations, linked accounts, profile photos, and posting history. Each platform will reveal different data depending on what the subject has disclosed there.

## References

- [Sherlock Project: GitHub](https://github.com/sherlock-project/sherlock) - Official repository, installation instructions, and supported site list