What output formats are available?

Terminal results plus optional --csv and --xlsx. Use --print-found for hits only, or --print-all to include misses.

Can I limit sherlock to specific sites?

Yes. Pass --site with one or more platform names. Scoping cuts run time and noise from platforms you do not care about.

Does sherlock support proxies?

The Trickest node exposes --proxy for SOCKS or HTTP proxies such as socks5://127.0.0.1:1080. Use --timeout to skip slow sites.

How does sherlock differ from socialscan?

Sherlock finds where a handle is already registered. Socialscan answers whether an email or username is available, taken, or invalid.

Updated Jul 14, 2026

Social Engineering

Map social accounts for a username

Username checks across social networks with optional CSV export.

Map an identity's social footprint Export hits to a spreadsheet Narrow to specific platforms

overview

What sherlock does

sherlock takes one or more usernames and checks them across many social networks by requesting each profile URL. Hits show where the handle is registered.

Scope platforms with --site. Export with --csv or --xlsx. Keep only finds via --print-found. Route traffic with --proxy and bound waits with --timeout.

Trickest runs sherlock as a managed Social Engineering node that writes FILE and FOLDER. Start identity OSINT here, then hand profiles to correlation or manual review. Prefer socialscan for availability checks.

source github.com/sherlock-project/sherlock

use cases

Where sherlock fits

Map an identity's social footprint

Check a username across hundreds of networks to find every platform where the handle is registered, the starting point for an OSINT investigation.

Export hits to a spreadsheet

Write CSV or XLSX output so found accounts land in a structured file ready for review, correlation, or reporting.

Narrow to specific platforms

Limit analysis with --site to a chosen list of networks when an investigation only cares about a handful, cutting run time and noise.

Route checks through a proxy

Send requests over a SOCKS or HTTP proxy with --proxy to mask origin or work around rate limits while enumerating accounts.

reference

sherlock inputs and flags

11 inputs

Name	Type	Flag	Description
usernames	STRING	·	One or more usernames to check across social networks.
limit-analysis-to-sites	STRING	--site	Limit analysis to only the listed sites.
csv	BOOLEAN	--csv	Write results to a comma-separated values (CSV) file.
xlsx	BOOLEAN	--xlsx	Write results to a Microsoft Excel spreadsheet (xlsx).
print-found	BOOLEAN	--print-found	Output only the sites where the username was found.
proxy-url	STRING	--proxy	Make requests over a proxy, e.g. socks5://127.0.0.1:1080.
time-to-wait-for-response	STRING	--timeout	Seconds to wait for a response before moving on (default 60).
load-data-from-json	FILE	--json	Load the site list from a local or online JSON file.

Showing key inputs. sherlock exposes 11 inputs in total.

Full flag reference (11 inputs)

Name	Type	Flag	Description
usernames	STRING	·	One or more usernames to check across social networks.
csv	BOOLEAN	--csv	Create a comma-separated values (CSV) file of results.
xlsx	BOOLEAN	--xlsx	Create a Microsoft Excel spreadsheet (xlsx) of results.
print-found	BOOLEAN	--print-found	Output only the sites where the username was found.
print-all	BOOLEAN	--print-all	Output sites where the username was not found as well.
limit-analysis-to-sites	STRING	--site	Limit analysis to only the listed sites.
proxy-url	STRING	--proxy	Make requests over a proxy, e.g. socks5://127.0.0.1:1080.
time-to-wait-for-response	STRING	--timeout	Time in seconds to wait for a response to requests (default 60).
load-data-from-json	FILE	--json	Load site data from a local or online, valid JSON file.
nsfw	BOOLEAN	--nsfw	Include NSFW sites from the default list in the check.
no-color-output	BOOLEAN	--no-color	Do not color the terminal output.

example

Run sherlock

sherlock · command

# find where a handle exists and export the hits to CSVsherlock ksokolov --print-found --csv --timeout 30

sample output

[*] Checking username ksokolov on:[+] GitHub: https://www.github.com/ksokolov[+] GitLab: https://gitlab.com/ksokolov[+] Reddit: https://www.reddit.com/user/ksokolov[+] Instagram: https://www.instagram.com/ksokolov[+] Twitter: https://twitter.com/ksokolov[+] Pinterest: https://www.pinterest.com/ksokolov[+] TikTok: https://www.tiktok.com/@ksokolov

guidance

Choosing sherlock

Use to map where a username already exists across social networks. It checks handles, not emails. Prefer socialscan for email or username availability. Prefer socialhunter for broken social links on a site.

socialscan

Checks whether an email or username is available, taken, or invalid. Sherlock finds where a handle already exists.

socialhunter

Crawls a site for hijackable broken social links rather than enumerating one identity's accounts.

shodan-python

Device and service intel. A different OSINT axis from social identity.

faq

sherlock questions

Pass one or more usernames. Sherlock requests each platform profile URL and lists hits. On Trickest, set the usernames input on the node.

h8mail
Email OSINT against breach services and local dumps.

Run sherlock yourself

A username feeds sherlock, which checks it across hundreds of networks and writes the found accounts as a queryable output.

Run sherlock in Trickest Browse the library

Facts on this page come from the live Trickest tool library.