Open source OSINT automation tool that gathers data on IPs, domains, emails and more from 200+ sources for threat intelligence and attack surface mapping.
sherlock-project/sherlock
A command-line OSINT tool that searches for a username across 400+ social networks and reports where accounts exist.
- Stars
- 100,124
- Forks
- 11,843
- Open issues
- 355
- Last commit
- 14 hours ago
What is it?
Sherlock takes one or more usernames and checks whether each one has an account on hundreds of social networks and websites. Results for each username are saved to a text file, and CSV and XLSX export options are available. It is aimed at investigators, security researchers and penetration testers doing open-source intelligence and reconnaissance.
The tool is run from the terminal and supports limiting the search to specific sites, routing requests through a proxy, setting timeouts, and including NSFW sites. It can also open all found profiles in a browser. Installation is available through pipx, pip, uv, Docker and several system package managers.
Because results come from automated checks against public sites, a match should be verified manually before drawing conclusions.
Key features
- 01Checks a username across 400+ social networks and websites.
- 02Accepts multiple usernames in a single run.
- 03Saves results to text, CSV or XLSX files.
- 04Supports proxies, timeouts and site filtering.
- 05Can open found profiles in the default browser.
Use cases
- Investigating which platforms a handle is registered on during OSINT work.
- Performing reconnaissance during a penetration test or red team engagement.
- Checking whether a username is already taken across many sites.
Quick start
- 1
Install with pipx
pipx install sherlock-project - 2
Search for a username
sherlock user123
Things to know
- Results are username matches only and may include false positives or miss accounts.
- Some third-party packages (ParrotOS, Ubuntu 24.04) are reported broken; use pipx, pip, uv, or Docker instead.
In collections
Topics
FAQ
- What is sherlock?
- A command-line OSINT tool that searches for a username across 400+ social networks and reports where accounts exist. Sherlock takes one or more usernames and checks whether each one has an account on hundreds of social networks and websites. Results for each username are saved to a text file, and CSV and XLSX export options are available. It is aimed at investigators, security researchers and penetration testers doing open-source intelligence and reconnaissance.
- Is sherlock free to use? What license does it have?
- sherlock is open source under the MIT license. Check the license terms before using it in commercial products.
- Is sherlock still maintained?
- Actively maintained. The last commit to sherlock was on Nov 7, 2026.
- What can I use sherlock for?
- Investigating which platforms a handle is registered on during OSINT work. Performing reconnaissance during a penetration test or red team engagement. Checking whether a username is already taken across many sites.
- How do I install sherlock?
- Install with pipx: pipx install sherlock-project Search for a username: sherlock user123
- Where can I get sherlock?
- The source code and installation instructions are on GitHub: https://github.com/sherlock-project/sherlock
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
Open-source cyber threat intelligence platform for structuring, storing and visualizing threat knowledge and observables, built on the STIX2 standard.
Open-source graph-based OSINT investigation platform that links entities like domains, IPs, emails and wallets through automated enrichers.
Fast passive subdomain enumeration tool that finds subdomains of a domain using online sources, without sending traffic to the target.
A Go CLI that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye and more) to find exposed hosts, with output designed for piping into other tools.
A fast, multi-purpose HTTP toolkit CLI that probes lists of hosts, URLs and CIDRs for status codes, titles, tech stack, TLS certificates and more.