7 Sherlock Alternatives for Username Search (2026)

The best Sherlock alternatives in 2026 are Maigret and Blackbird for open-source CLI enumeration, WhatsMyName and Namechk for a fast browser check, Maltego if you think in graphs, and a hosted platform like Revealer when username hits have to be checked against breach and infostealer-log data in the same workflow. No enumerator covers every platform. They all mishandle false positives in slightly different ways, so most investigators run at least two. Below is the version we give colleagues: seven practical options, what each is actually good at, and where each burns time.

Cross-referencing is the part people skip and then regret. A username on three obscure forums is a curiosity. The same username in a credential dump means password reuse, and that changes every call you make after it. That split is why this list is not just "more CLIs."

Why investigators look past Sherlock

Sherlock is still the most famous username enumeration tool in OSINT, and it earned that reputation. You point it at a handle, it hits a long list of sites with straightforward HTTP logic, and it prints the accounts that exist. For a first-pass sweep of a handle across social media, it remains a solid default.

People replace or supplement it for the same handful of reasons, over and over:

• False positives. Sites change their responses, rate limits kick in, and some platforms return soft-404s that get misread as "account found." Every CLI enumerator needs manual verification of results, and the cleanup time grows with the site list.
• No identity resolution. Sherlock answers "does this username exist here?" It will not tell you whether the j.smith_84 on one site is the same person as the jsmith1984 on another, which is usually the actual question.
• No breach context. A username hit says nothing about credentials, exposure, or history. If the case involves account takeover, doxing, or fraud, you want that username checked against breach datasets in the same pass.
• Operational footprint. Running an enumerator fires hundreds of requests from your IP in seconds. A lot of investigators prefer hosted services that absorb that traffic, especially from a corporate network.
• Maintenance. Site lists rot. Tools whose communities prune dead sites stay useful. Abandoned ones quietly produce garbage.

None of these are Sherlock-specific defects. They are the category's trade-offs. The useful question is which ones you can live with.

What to evaluate before picking a tool

Before the list, the checklist we actually use when we compare username-search options:

Keep that table nearby as you read. Every tool below trades somewhere along those lines.

Quick comparison

The short version, before the write-ups:

1. Maigret, the closest drop-in replacement

Maigret, by SOXOJ, is the alternative most people reach for first. That is usually the right call. It is also a Python CLI, also free and open source, and it checks a target username across a very large set of sites (roughly 3,000 by its own documentation as of writing; check their repo for the current number, because the list moves constantly).

Where Maigret pulls ahead of Sherlock for actual casework:

• Report output. It generates HTML, PDF, and other report formats with screenshots of found profiles. That is exactly what you want when the deliverable is a client-facing summary rather than a terminal scroll.
• Priority-based scanning. You can ask it to check the most likely sites first and expand outward, which suits time-boxed engagements.
• Active maintenance. The site database is community-curated and updated frequently, which keeps the false-positive rate lower than stale alternatives.

The trade-offs are Sherlock's trade-offs: no breach correlation, no identity resolution, and you are still sending identifiable scan traffic from your own machine. Verify hits manually before anything goes in a report. Both tools will occasionally flag a page that merely resembles a profile.

pip install maigret
maigret target_username --html report.html

2. Blackbird: speed and leak awareness

Blackbird comes at this from a different angle. Written in Go, it is fast, it supports bulk username and email searches, and (this is the reason it is on the list) it includes checks against some leak datasets alongside its site enumeration, as of writing. That partial breach awareness puts it closer to a hosted intelligence workflow than to a pure enumerator.

What we actually use it for:

• Bulk mode accepts a list of usernames, so it fits batch processing better than most CLIs.
• Results export to JSON cleanly, which matters if you pipe output elsewhere.
• Because it queries leak sources, treat its findings like any breach data. Verify provenance before acting on them, and be careful about what you do with credential material you encounter. Lawful investigations only. Possession of stolen credentials carries its own legal exposure in most jurisdictions.

It does not have Maigret's reporting polish, and its site list is smaller. For an investigator who wants "username exists on X" plus "this identifier shows up in dump Y" in one run, it is still the strongest free option here.

3. WhatsMyName (the curated dataset behind many frontends)

WhatsMyName is one of the longest-running username-search projects in OSINT, and its curated site dataset has become a standard that a number of other tools and extensions consume. The web app is simple: enter a username, get back the sites where a matching profile was detected. Under the hood it runs on a JSON dataset maintained publicly on GitHub. That dataset is the actual asset.

Why it stays on our shortlist:

• Human curation. Entries are added and validated by contributors, which historically yields fewer junk hits than fully automated discovery.
• Transparency. The detection logic per site is visible in the dataset, so when a result looks wrong you can check why the tool flagged it.
• Zero setup. Nothing to install. Nothing that touches your network with scan traffic. The server does the work.

Limits, and they are real: username-only (no email or phone pivots), no export-friendly API for heavy automation on the free frontend, and it will not correlate anything with breach data. Use it for verification and quick manual sweeps, not pipeline work.

4. Namechk, the thirty-second check

Namechk (and similar free checkers such as NameCheckr) predates most of this list. Type a username, see availability across a grid of social networks and domain registrars. Brand-name researchers and anyone doing a fast "is this handle taken" check have used it for over a decade.

For investigative use it is shallow, and we will say that plainly. Coverage is limited compared to every other entry here, results skew toward availability-checking rather than investigation-grade detection, and there are no exports or pivots. It is on the list because sometimes the job genuinely is "check ten obvious platforms right now," and opening a webpage beats installing Python for that. Do not mistake a Namechk pass for coverage. Treat it as a spot check at best.

5. Maltego: usernames as graph nodes, not lists

Maltego approaches the problem from link analysis rather than enumeration. Community and commercial transforms can take a username entity and resolve it to associated profiles and accounts. More useful than the lookup itself: you can pivot from those findings to emails, domains, aliases, and infrastructure on one canvas. Several public transform packs include username-to-account lookups. Availability varies by pack and pricing tier, so check their marketplace for current capabilities.

When Maltego beats a CLI:

• Multi-identifier subjects where you are correlating usernames, emails, phone numbers, and domains at the same time.
• Cases where the relationship map itself is the finding: who connects to whom, which accounts share infrastructure.
• Client deliverables, since graphs communicate better than CSV dumps.

Costs are real. Paid tiers are not cheap for independent investigators, transforms require configuration, and raw username enumeration breadth is weaker than dedicated tools. Most serious practitioners run Maltego alongside an enumerator, feeding CLI results into the graph manually or via custom transforms.

6. Google and DuckDuckGo operators (the underrated fallback)

Not a tool. No honest list skips it. Search engines still index a surprising amount of profile surface, and targeted operators often surface accounts that enumerators miss entirely: small forums, regional platforms, archived pages.

"exact_username" -site:pinterest.com
intext:"exact_username" inurl:user
site:reddit.com "exact_username"

Advantages: free, no scan traffic from your IP, and results include contextual evidence (what the person posted) that pure existence-checks never provide. Disadvantages: unbounded false positives, no systematic coverage, and modern search engines aggressively de-index personal-content results, so recall keeps shrinking year over year. As of writing, treat search operators as a supplement. Never as a primary method.

7. Revealer: hosted username search with breach cross-reference

Everything above shares two structural gaps. They check existence, not identity. And none of them connect a username to exposure data. Revealer exists to close that gap, which is why we built it.

One search by username (or email, phone number, name, or address) checks 800+ platforms, public records, and known breach datasets. Concretely, versus a CLI sweep:

• Identity resolution, not just existence. Results tie identifiers together across sources, so adjacent spellings and re-used handles surface as the same subject instead of scattered hits. When a case needs deeper recursion (following an identifier from a forum alias to an email to a phone number across sources), AI Deep Search runs agent-driven, multi-hop lookups automatically.
• Breach and infostealer-log correlation. Username hits come back alongside breach data and, where present, entries from stealer logs. Knowing a handle appeared in infostealer logs changes your risk assessment completely compared to knowing it merely exists on a forum.
• No scan footprint from your network. Queries run hosted. Your egress IPs are not firing thousands of enumeration requests at platforms that log them.
• API access (docs) for teams piping username enrichment into their own pipelines, plus ongoing breach monitoring so you learn about new exposures without re-running searches.

Pricing starts with a free tier, self-serve plans begin at $12.99/mo, card and crypto are accepted, and Enterprise arrangements are custom. For a full inventory of what else the platform covers (reverse phone, email lookup, background-style people search, and more), see the OSINT tools overview.

Standard disclaimer, stated plainly: Revealer is not a consumer reporting agency and its results must not be used for employment, tenant, or credit decisions under the FCRA. It's built for lawful investigative and research use.

Choosing between them

A stack that actually gets used looks like this:

1. Quick manual check: WhatsMyName or Namechk in the browser.
2. Broad automated sweep: Maigret or Blackbird from a throwaway VPS, exported to JSON.
3. Correlation and pivoting: Feed the confirmed hits into Maltego if relationships matter, or straight into a hosted platform if exposure matters.
4. Case-critical subjects: Run the username through Revealer for breach and stealer-log cross-reference, then decide whether AI Deep Search recursion is warranted.

Budget note: the four free options cover most first-pass needs, so paying only makes sense once you have confirmed that breach correlation, identity resolution, or API access are things you need repeatedly. If you are evaluating that decision seriously, the pricing page lays out tiers without a sales call.

Two closing practice reminders. First, whatever tool you use, verify hits before they enter a report. Every enumeration method in this list produces false positives, and a wrong attribution is worse than a miss. Second, keep authorization in mind. Username enumeration against platforms you do not control sits in a gray zone in several jurisdictions' terms of service, and using found credentials is illegal essentially everywhere. Scope your work to lawful investigation and document what you ran and why.

Frequently asked questions

Is there a free alternative to Sherlock? Yes. Maigret and Blackbird are both free, open-source CLIs comparable to Sherlock, and WhatsMyName offers a free web interface backed by a curated dataset. All three are actively maintained as of writing.

Which Sherlock alternative checks the most websites? Maigret claims the largest site list among the free tools (roughly 3,000 per its documentation as of writing; verify against their repo). Raw count matters less than accuracy, though. Curated lists like WhatsMyName's often produce cleaner results than bigger automated ones.

Can I find out if a username appears in a data breach? Yes. Blackbird includes some leak checks among free options, and hosted platforms go further. Revealer's username search cross-references breach datasets and infostealer logs across 800+ sources, and its data breach lookup works independently by email.

Do these tools work for finding someone's real identity from a username? Partially. Enumerators find accounts under the same handle; linking them to a real person requires correlating profile details, photos, and connected identifiers. Revealer's AI Deep Search automates that identifier-following across sources, while manual methods rely on the investigator doing the linkage themselves.

Is using a username search tool legal? Checking whether a public username exists on public platforms is generally lawful for legitimate research and investigation purposes. Problems arise with unauthorized access, using discovered credentials, harassment, or FCRA-prohibited uses like employment screening. Know your local laws and stay within them.

What's the difference between username search and people search? Username search finds accounts tied to a specific handle across platforms. People search resolves a person by name, email, phone, or address across public records and databases. They complement each other: a confirmed username often becomes a pivot point inside a broader people-search workflow.