# Linkook follows a username to the accounts it is linked to

> Linkook is a Python OSINT tool that searches a username across many platforms, then recursively follows the accounts it finds to discover further usernames and associated email addresses. Results can be exported as Neo4j-friendly JSON so the relationships between accounts can be visualised, and breach status can be checked against HudsonRock's database or the Have I Been Pwned API.

**JackJuly/linkook** — 🔍 An OSINT tool for discovering linked social accounts and associated emails across multiple platforms using a single username.

- Repository: https://github.com/JackJuly/linkook
- Stars: 1,027 · Forks: 128
- Language: Python
- License: MIT
- Published: 2026-10-19 · Updated: 2026-10-19 · Language: en
- Canonical page: https://hysenlabs.com/projects/jackjuly-linkook

## The recursive step is the whole difference

The comparison with Sherlock in the documentation explains what Linkook adds, and the limitations it lists for that tool are the key to understanding the design. Sherlock only searches for the same username on each platform, may miss accounts if a user uses different usernames across platforms, and can mistakenly include accounts belonging to unrelated users who share the searched name. Linkook goes one step further by recursively searching for linked accounts from each discovered social account, even when different usernames are used, and by providing a more comprehensive view of the user's online presence including email information. The export to a Neo4j-friendly JSON format is what makes that view usable, because it lets you analyse the associations between usernames, accounts and emails to filter out the accounts that are not actually connected.

## Installing it is a pipx command

The install is one line, and the tool is packaged as a console script:

```shell
pipx install linkook
```

or you can use pip instead of pipx. A manual install is also documented: clone the repository, and either run the module directly with `python -m linkook {username}` or install it with `python setup.py install`. The project metadata is small. It is called linkook, the description is a tool for scanning and enumerating linked social accounts, it requires Python 3.7 or newer, the licence is MIT, and the only two runtime dependencies are requests at version 2 or newer and colorama at 0.4.6 or newer. The console entry point is `linkook.linkook:main`, and the setup file also declares that the provider.json file is package data, which is the site list the tool scans.

## The site list is data you can point elsewhere

The options section explains how the scan decides where to look. The `--scan-all` flag scans all the available sites in provider.json, and if it is not set only the sites with `isConnected` set to True are scanned, which is how the tool avoids spending requests on platforms with no connection to the target. The `--local` option forces the use of a local provider.json file and accepts a custom path, with the default being provider.json. The rest of the flags are about output and ergonomics: `--show-summary` for a scan summary, `--concise` for a compact format, `--print-all` to also show sites where the username was not found, `--no-color` for plain output, `--silent` to show only the summary, `--browse` to open all the found profiles in the default browser, `--debug` for verbose logging, and `--output` to choose a results directory with a default of `results`. The `--version` and `--update` options print version information and update the tool directly through pipx.

## Breach checking has two backends and one needs a key

The `--check-breach` option uses HudsonRock's Cybercrime Intelligence Database to check whether the discovered email addresses have been affected by cybercrime or info-stealing infections. When a breach is found the address is highlighted in red in the output with a breach detected marker, and all detected emails are listed in the scan summary, along with the leaked passwords, which is a detail worth noting because it means the tool's output can contain plaintext credentials from third party breaches. The `--hibp` option uses the Have I Been Pwned API instead, and on first use that requires an API key, which needs a HIBP subscription, and the key is saved locally in `~/.hibp.key`. Two backends means you can use the one that fits your access situation.

## The Neo4j export needs APOC and a specific query

The `--neo4j` option writes the query results as a JSON file compatible with Neo4j imports, named neo4j_export.json. Importing it is not a point-and-click operation, because the documentation says to use the APOC plugin and gives the Cypher for it. The query loads the JSON with apoc.load.json, then unwinds the nodes and creates them with apoc.create.node and apoc.map.merge, matching on the id property, and then does the same for the relationships with apoc.create.relationship, matching the start and end nodes by id. The final line returns the counts of imported nodes and relationships, so you get a count back to check the import actually worked, and afterwards `MATCH (n) RETURN n` shows all the results and their connections. The structure of the export, with separate nodes and relationships arrays, is why the two-part query is needed rather than a simple load.

## The project is a small, actively maintained Python tool

The repository is a single Python package with the source under `linkook/`, a `tests/` directory, a `pyproject.toml`, a `setup.py` that duplicates the metadata for older install paths, and a `requirements.txt` listing the same two dependencies. There is a Chinese translation of the README alongside the English one, and the contributing guide explains how the tool works internally, which is unusual for a tool this small and the most useful document in the repository for anyone extending the provider list. The release history shows v1.1.3 from 2026-10-01, v1.1.2 from March 2025 and v1.1.0 from February 2025, and the last push to the main branch was on 2026-10-01. The project also accepts sponsorship through a Buy Me a Coffee link.

## Conclusion

Adopt Linkook if you are doing authorised open source intelligence work and need to map how a set of accounts and email addresses relate to each other, since the recursive follow and the graph export are what distinguish it from a plain username check. Do not adopt it for investigating a private individual, because the tool's output is a map of a person's online presence including their email addresses. Verify first which sites you need covered, since the site list lives in a provider.json file you can point elsewhere with the local option, and read the Neo4j import steps before you plan the visualisation, because the import uses the APOC plugin and specific Cypher.

## FAQ

### What is Linkook?

It is a Python OSINT tool for discovering linked social accounts and associated emails across multiple platforms from a single username, and it can export the gathered relationships in a Neo4j-friendly format for visual analysis. The licence is MIT.

### How do I install Linkook?

With `pipx install linkook`, or with pip instead of pipx. A manual install is also possible by cloning the repository and running `python -m linkook {username}` or `python setup.py install`.

### How does Linkook differ from Sherlock?

The README says Sherlock only searches for the same username on each platform and may miss accounts where a user uses different usernames. Linkook recursively searches for linked accounts from each discovered one, gathers more of the user's online presence including email information, and can export the associations for visualisation.

### How do I import Linkook results into Neo4j?

Run the scan with the `--neo4j` option to write neo4j_export.json, then use the APOC plugin in Neo4j with the documented Cypher, which loads the JSON, creates the nodes with apoc.create.node and the relationships with apoc.create.relationship, and returns the counts of both.

### Does Linkook need an API key for breach checking?

Only for the Have I Been Pwned backend, which requires a key and a HIBP subscription, saved locally in `~/.hibp.key`. The default backend is HudsonRock's Cybercrime Intelligence Database, which needs no key.

## Sources

- [Issues](https://github.com/JackJuly/linkook/issues)
- [JackJuly/linkook on GitHub](https://github.com/JackJuly/linkook)
- [License: MIT](https://github.com/JackJuly/linkook/blob/main/LICENSE)
- [README](https://github.com/JackJuly/linkook/blob/main/README.md)
- [Releases](https://github.com/JackJuly/linkook/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/jackjuly-linkook