Type a username and Sherlock checks 300+ sites for accounts with that name. Investigators use it on targets; you should run it on yourself first.
Follow the steps — click any step card to replay the terminal demo from that point. Everything runs in a lab you control.
Green rows = account exists on that platform.
Handle variations matter more than people think.
Evidence for reports/investigations.
Some platforms rate-limit; be patient.
What you find, a stranger (or boss) also finds.
| username(s) | one or many |
| --csv / -o | export results |
| --tor | anonymized lookups |
| --site X | target one platform |
| --timeout | site wait |
Results ≠ proof — same handle ≠ same human. Corroborate.
Pair with WhatsMyName dataset when Sherlock misses a niche site.
Email variants (first.last, flast@) expand identity graphs fast.
Document everything with timestamps; online presence is ephemeral.
Use Sherlock only on systems you own or have written permission to test. Your lab: Kali + Metasploitable2, DVWA, TryHackMe & HackTheBox — plenty of legal targets, zero risk.