The 10 Best Username OSINT Tools in 2026 (Free & Paid)

The best username OSINT tools in 2026 split into two camps I actually use. Open-source CLI enumerators throw a handle at a site list. Hosted platforms try to turn that handle into a person. For free CLI work, Maigret and Sherlock still cover the widest site lists, and the WhatsMyName dataset sits underneath most of them. When I need breach and infostealer cross-referencing without babysitting Python, I run a hosted search. Revealer.US username search does the enumeration and the identity correlation in one pass.

How I ranked these

Four criteria. Same ones for every tool here, including ours.

Coverage that is real. Advertising thousands of sites means nothing if half the checks hit a homepage. Detection logic rots fast. Platforms change 404 behaviour, add bot protection, or return 200 for every profile path. I would rather have a smaller list someone still maintains.

False-positive discipline. The worst username OSINT report is one stuffed with accounts your subject does not own. Status-code-only checkers fall apart on any site that soft-404s. If a checker reads the response body, I trust it more.

Where the output goes. Forty profile URLs is a starting point, not a finding. I care whether the tool dumps structured data I can pivot on, or ties the handle to other identifiers.

Setup cost. Python version conflicts and dead dependencies are a real tax. Some of these run in thirty seconds. Some eat an afternoon.

Username enumeration is passive reconnaissance against publicly visible pages. I am describing these tools for lawful investigative use: fraud investigation, due diligence, threat intelligence, journalism, and locating people who want to be found.

Quick comparison

1. Revealer.US: hosted username intelligence with breach cross-reference

I will start with the platform we build. Same criteria as the rest of the list. Rank it however you like.

Revealer.US takes a handle and checks it against 800+ platforms, public records, and known breach datasets in a single search. The gap versus a CLI enumerator is what happens after the hits come back. Matched profiles get correlated against email addresses, phone numbers, and names surfaced from the same query, so you leave with an identity picture instead of a bookmark folder.

The AI Deep Search mode is the piece I wish more people tried. It is not one flat pass. An identifier found in round one (an email in a bio, a display name on a forum, a domain in a profile link) becomes a query in round two, and the agent keeps following identifiers across sources until the graph stops growing. That is the pivot loop I used to run by hand, minus the copy-paste.

Breach and infostealer log coverage matters here more than people expect. Handles reused across services show up in credential dumps, and a hit there often gives you the account holder's email, which is the single most useful pivot in this discipline. There is also an API if you are folding username checks into a pipeline, and breach monitoring if you need to know when a handle reappears in new data.

Pros: No setup or dependency management. 800+ sources in one query. Breach and stealer-log correlation. API access. Recursive AI-driven pivoting. Cons: Hosted, so it does not fit workflows that require everything to run on an air-gapped box. Free tier is limited; full depth needs a paid plan, which starts at $12.99/mo on pricing.

Revealer is not a consumer reporting agency, and its data may not be used for employment, tenant, or credit decisions.

2. Maigret: the deepest open-source sweep

Maigret is the most thorough free username enumerator I have used. It grew out of the Sherlock lineage and then kept going: a much larger site list, tag-based filtering so you can run only adult sites or only forums or only a country's platforms, recursive search on secondary identifiers it extracts from profiles, and HTML/PDF/XMind report export.

Extraction is the feature I will not give up. Maigret does not just report that example_handle exists on a site. It parses the profile page and pulls out whatever the site exposes: display names, bios, follower counts, linked accounts, sometimes email fragments. Those become the next search terms.

Run it with maigret username --html for a report you can hand to someone else, or --json ndjson when you are feeding a pipeline. A large sweep takes a while. Use --top-sites 500 when you need a fast answer.

Pros: Largest open-source site list. Profile data extraction. Recursive search. Good reporting. Cons: Full runs are slow. Site checks age, so some results need manual verification. Python dependency friction on newer interpreter versions.

3. Sherlock: the fast, dependable first pass

Sherlock is still the tool most people meet first, and I still reach for it when I want a quick pass. It is well maintained and widely packaged. The behaviour is boring in the useful way.

Precision is the tax you pay. Sherlock's checks lean on HTTP status codes and simple string matching. That is fine for sites that return a clean 404. It is unreliable for anything that redirects, soft-404s, or gates behind a login wall. Eyeball hits before they go in a report.

Flags I actually use: --timeout 5 so a dead host cannot stall the run, --csv for structured output, and passing multiple usernames in one invocation when I am testing handle variants.

Pros: Fast, stable, easy to install, easy to script around. Huge community. Cons: False positives on soft-404 sites. Smaller list than Maigret. No profile data extraction.

4. WhatsMyName: the dataset everyone else uses

WhatsMyName is not really a tool. It is a curated JSON file describing how to detect an account on each of hundreds of sites, including the exact response string that confirms a hit. That detection-string approach is why it produces fewer false positives than status-code checking.

I use it three ways: the hosted whatsmyname.app interface when I do not want to install anything, as the data source inside other tools (Blackbird and various wrappers consume it), or by parsing the JSON in a script of my own.

The project accepts community submissions and prunes broken entries.

Pros: Best accuracy-per-check of the free options. Reusable in your own tooling. Actively curated. Cons: On its own it is a dataset plus a simple UI. No correlation, no reporting, no pivoting.

5. SpiderFoot: automation and correlation, not just enumeration

SpiderFoot belongs in a different drawer. It is an OSINT automation framework with a large module set, and username enumeration is one module among many. You give it a seed (a username, email, domain, IP) and it runs modules that feed each other, building a graph of related entities.

I reach for SpiderFoot when the handle is one input among several and I care about relationships between findings. I do not reach for it when I want an answer in ninety seconds.

It runs as a local web app (python3 sf.py -l 127.0.0.1:5001). There is a hosted commercial tier as well; check their site for current pricing and tier differences.

Pros: Correlation across entity types. Scheduled scans. Extensive module ecosystem. Good for repeatable pipelines. Cons: Setup and tuning take real time. Noisy by default; you will want to disable modules. Overkill for a one-off handle check.

6. Blackbird: username and email in one sweep

Blackbird searches accounts by username and by email. That matches how cases actually start, because you rarely hold only one identifier. It consumes community-maintained detection data and outputs PDF and CSV reports.

I treat it as the second tool after a Sherlock pass: Sherlock for speed, then Blackbird with the email I pulled out of a profile bio.

Pros: Handles both usernames and emails. Clean report output. Actively developed. Cons: Smaller user base than Sherlock or Maigret, so fewer people are catching broken site checks. Coverage varies by category.

7. Social Analyzer: confidence scoring on matches

Social Analyzer checks a handle across a large set of sites and, unusually, assigns a detection rating to each result rather than a binary yes/no. It also does some content analysis on found profiles.

Scoring is why I keep it installed. If a run returns fifty hits and thirty carry low confidence, I have a triage list, not a weekend of clicking. It ships as a CLI, a Node/Python API, and a web interface, so it slots into most workflows.

Pros: Confidence ratings reduce manual verification. Multiple interfaces including a usable API. Cons: More configuration than the alternatives. Output format takes getting used to. Detection quality varies by site.

8. Epieos: narrow but high-signal

Epieos is a hosted lookup I use for email, not for sweeping handles. What it returns on an address is the point: public Google account artifacts, linked services, and related handles. Username support is narrower than a full enumerator. Signal quality on what it does cover is high.

Once a CLI run gives me a candidate email, Epieos often tells me whether that email anchors an active identity. Free tier exists; paid tiers change, so check their site.

Pros: High-signal results on email-anchored identities. No install. Good complement to CLI enumeration. Cons: Not a broad username sweep. Depends on third-party surfaces that change without notice.

9. UserSearch.org: fast hosted triage

UserSearch.org aggregates username lookups across categories (social, dating, forums, crypto) through a web interface, with a free tier and paid access for deeper results.

I use it when I want a footprint check in under a minute and I do not want to install anything. The free tier is shallow. Treat it as triage, not as coverage.

Pros: No install, category-organised, quick. Cons: Limited depth without paying. Opaque about which sites are actually checked.

10. Instant Username Search: availability as a weak signal

Instant Username Search checks whether a handle is available across services. It is a naming tool. It is not an investigation tool. The one legitimate OSINT use: an unavailable handle on an obscure platform is a weak indicator that someone registered it, which tells you where to look manually.

Do not confuse availability with ownership. A taken handle may belong to a squatter, a bot, or an unrelated person. Use this to generate leads. Never hang a conclusion on it.

Pros: Instant results, no install, useful for handle-variant brainstorming. Cons: Says nothing about who owns an account. Not evidence.

A workflow that uses several of these

I almost never finish a case with one tool. This sequence is the one that has stuck:

1. Triage. Run Sherlock or a hosted lookup to see whether the handle has a footprint worth investigating. Two minutes.
2. Sweep. Run Maigret with report output for the full picture, and note every secondary identifier it extracts: emails, display names, linked domains.
3. Verify. Re-check questionable hits by hand. Status-code false positives are common. A profile that does not visually exist does not go in the report.
4. Pivot on identifiers. Take the emails and names from step two into an email lookup and a breach data search. This is usually where the identity resolves.
5. Correlate. Match handle reuse across platforms: same avatar hash, same bio phrasing, same registration era. Reuse is the strongest link most subjects give you.
6. Document. Screenshot with timestamps and archive URLs. A live URL is not evidence six months later.

Steps 1, 4, and 5 collapse into one hosted query. Steps 2 and 3 are where free CLI tools still earn their place.

Free or paid: how to decide

I pick free CLI tools when I am working a small number of cases, I can absorb the setup and verification time, the workflow has to run locally, or I need to modify detection logic myself.

I pick a hosted platform when volume matters, when I need breach and infostealer data I cannot assemble myself, when API access into an existing pipeline is a requirement, or when an analyst's afternoon costs more than a subscription. Revealer's free tier is enough to see whether the correlation output changes your workflow before you commit. Paid self-serve starts at $12.99/mo, with custom Enterprise for higher volume, and both card and crypto are accepted.

Most people I know who do this for a living end up running both. CLI enumerators answer "where does this handle exist." Platforms answer "who is behind it." More on the broader kit in our OSINT tools overview.

Frequently asked questions

Is Sherlock still worth using in 2026? Yes, as a fast first pass. It is well maintained and easy to script. Verify hits before you report them. Its status-code detection produces false positives on sites that soft-404.

Which free username OSINT tool has the best coverage? Maigret, by a clear margin among open-source options. It also extracts profile data and supports recursive search, which most alternatives do not. Expect slower runs in exchange.

Why do these tools disagree with each other? Different detection methods and different site lists. A status-code checker and a response-string checker will call the same site differently. Running two tools and comparing is a reasonable verification technique.

Can username searches find someone's real identity? Sometimes directly, more often through pivoting. The handle rarely names the person; the email in a profile bio, or the same handle in a breach record, frequently does. That is why breach cross-referencing matters more than raw site count.

Do I need permission to search a username? Checking publicly visible profile pages is passive reconnaissance and generally lawful. Your obligations come from what you do next: how you store data, whether relevant privacy law applies to your jurisdiction and purpose, and what decisions you base results on. People-search results must not be used for employment, tenant, or credit decisions.

What is the fastest way to check a handle across many sites without installing anything? A hosted lookup. Revealer's username search checks 800+ sources in one query, and AI Deep Search follows the identifiers it finds into further rounds automatically.