Sherlock: A Practical Look at Username Enumeration Across 400+ Networks
Hunt down social media accounts by username across social networks.
At a glance
- What is it?
- Sherlock is a Python command-line tool that checks a username across hundreds of social networks. This review covers how it works, how to run it, and where it falls short for serious OSINT work.
- Who is it for?
- Adopt Sherlock if you need a quick, scriptable way to check a username across many platforms, especially for OSINT triage or account monitoring. Skip it if you require deep accuracy, real-time verification, or support for networks that block automated requests.
- Can I use it commercially?
- Yes. MIT is a permissive licence: you can use, modify and sell software built on it, as long as you keep its copyright and licence notices.
- Is it still maintained?
- Yes. The repository last received commits 1 day ago.
- What is it written in?
- Mainly Python, according to GitHub's language statistics.
Answers come from the project's GitHub data, last synced on September 15, 2026, and from our analysis. They are not legal advice.
DEEP OPEN-SOURCE ANALYSIS
What Sherlock Solves and Who Needs It
Sherlock addresses a narrow but recurring problem: given a single username, does that handle exist on any of 400+ social networks? For OSINT investigators, journalists, or even individuals checking their own digital footprint, manually visiting each platform to test a username is tedious and error-prone. Sherlock automates that sweep, returning a list of sites where the profile page responds as existing. It is not a search engine for content, nor does it gather posts or metadata. It only answers one binary question per site: does a page for this username exist? The tool is written in Python and released under the MIT license, which means you can embed it in larger scripts or adapt it freely. The target user is someone comfortable with the command line, since there is no graphical interface. If you need a quick, repeatable way to map a username across the social web, Sherlock fits that slot directly.
The Mechanism: HTTP Status Codes and Site Definitions
Sherlock works by sending HTTP requests to each supported site's profile URL pattern, substituting the target username into a predefined template. The core of the project is a data file that lists, for each network, the URL format and the expected response when the account exists. According to the README, accounts found are stored in a text file named after the username, like user123.txt. The tool distinguishes between an existing account and a missing one by examining the HTTP response, typically a 200 versus a 404, though some sites require more nuanced checks. The --dump-response flag lets you capture raw responses, which is useful for debugging when a site changes its behavior. The --site SITE_NAME option lets you restrict the search to a single platform, and --proxy PROXY_URL routes requests through a proxy, which is helpful for rate limiting or geolocation. This design is simple and effective, but it also means Sherlock is only as accurate as its site definitions. If a network alters its URL structure or starts returning 200 for all usernames, Sherlock will report false positives until the data file is updated.
Getting It Running: Commands and Config
Installation is straightforward through several package managers. The README lists pipx install sherlock-project as a primary method, with pip or uv as alternatives. Docker is also supported: docker run -it --rm sherlock/sherlock. For Linux users, dnf install sherlock-project works on Fedora, and community packages exist for Debian, Ubuntu, Homebrew, Kali, and BlackArch, though the README warns that ParrotOS and Ubuntu 24.04 packages appear broken. Basic usage is as simple as sherlock user123 for one username, or sherlock user1 user2 user3 for multiple. The command-line help shows a range of options: --csv and --xlsx for structured output, --timeout to control request timeouts, --print-all to show every site checked, and --ignore-exclusions to bypass sites that are known to block automated access. There is also a --local flag, which likely runs the search without external network calls, but the README does not elaborate. For most users, the default output is a list of found accounts plus a text file per username. The --verbose flag provides more detail during the scan, which helps when a site hangs or returns unexpected results.
Limitations: False Positives and Blocked Sites
Sherlock's biggest weakness is that it verifies existence, not identity. A profile page that returns a 200 status could belong to a squatter, a bot, or a user who never posts. The tool also struggles with sites that employ anti-bot measures, such as CAPTCHAs or IP-based rate limiting. The README hints at this with the --ignore-exclusions flag, implying that some sites are excluded by default because they block automated requests. In practice, this means Sherlock may miss accounts on platforms with aggressive protections, or worse, report false positives on sites that return generic error pages with a 200 status. Another limitation is that the data file can go stale. Networks change their URL patterns, and Sherlock's maintainers need to keep up. The release cadence, with v0.16.0 in September 2025 and v0.15.0 in July 2024, suggests updates are not daily, so there is a window where results may be outdated. For critical investigations, you should treat Sherlock's output as a lead, not a verdict.
A Real Alternative: Maigret's Approach
A direct alternative is Maigret, another open-source username search tool. While both aim to solve the same problem, they differ in approach. Maigret uses a larger database of sites and incorporates more sophisticated detection logic, including parsing page content for markers like 'user not found' text, rather than relying solely on HTTP status codes. This can reduce false positives on sites that return 200 for every request. Maigret also supports correlation of results across sites and can output to formats like JSON and CSV. However, Maigret is generally slower due to its more detailed analysis, and its larger site list can lead to more false positives on obscure platforms. Sherlock, by contrast, is leaner and faster, making it better for quick sweeps. If your use case demands higher accuracy at the cost of speed, Maigret may be the better fit. If you want a minimal tool that gets you 80% of the answer quickly, Sherlock wins.
Maintenance and License Implications
Sherlock is actively maintained, with the latest release v0.16.0 pushed on September 16, 2025. The project is not archived, and the default branch is master. The MIT license is permissive, allowing commercial use, modification, and redistribution, provided the copyright notice is preserved. This makes it safe to integrate into proprietary tools without legal friction, but you should still review the license terms for your specific use. The maintenance cost is low for users: updates arrive periodically, and installation via pipx or Docker isolates dependencies. However, the project's reliance on community-contributed site definitions means that quality varies. The README notes that some OS packages are broken, so you should stick to the official methods to avoid runtime errors. Overall, Sherlock is a low-maintenance tool, but it demands that you stay aware of its update cycle to keep results reliable.
Editorial conclusion
Adopt Sherlock if you need a quick, scriptable way to check a username across many platforms, especially for OSINT triage or account monitoring. Skip it if you require deep accuracy, real-time verification, or support for networks that block automated requests. Before relying on results, verify each hit manually, since the tool only checks for the existence of a profile page, not the identity of the account holder. Also, be aware that community packages for some distributions are broken, so use pipx or Docker for a consistent experience.
Community notes