What output formats does sherlock support?

Plain terminal results plus optional CSV (--csv) and XLSX (--xlsx) files. Use --print-found to show only sites where the username exists, or --print-all to include the misses for a complete picture.

Can I limit sherlock to specific sites?

Yes. Pass --site with one or more platform names to restrict analysis to that list. Scoping the run to the handful of networks you care about cuts run time and trims noise from the report.

Does sherlock support proxies or Tor?

The Trickest node exposes --proxy, which sends every request over a SOCKS or HTTP proxy such as socks5://127.0.0.1:1080 to mask origin or dodge rate limits. Upstream sherlock also ships --tor and --unique-tor for routing over Tor, which the node does not expose.

How does sherlock compare to maigret?

Both check a username across many sites. Maigret covers more platforms and pulls extra profile metadata, so it runs slower and returns richer records. Sherlock is the lighter, faster pass when you want a quick registration map for a handle.

What is the difference between sherlock and socialscan?

Sherlock finds where a handle is already registered. Socialscan answers a different question: whether a given email or username is available, taken, or invalid on a target platform. Use sherlock for footprinting, socialscan for availability checks.

Updated Jul 14, 2026

Social Engineering

Find every network where a username is registered

Find usernames across many social networks.

Map an identity's social footprint Export hits to a spreadsheet Narrow to specific platforms

overview

What sherlock does

Sherlock takes one or more usernames and checks them against hundreds of social networks, returning every site where that handle is registered. It works by requesting each platform's profile URL for the username and reading the response, so a single run maps where a person or brand keeps accounts across the web.

The output is built for analysts. Write CSV or XLSX files for spreadsheets, print only the sites where the username was found, or include the misses for a full picture. Route requests through a proxy, set a per-request timeout so slow sites do not stall the run, and narrow the check with --site when you only care about a few platforms.

On Trickest, sherlock is a Social Engineering node that takes a username and writes a file and a folder of results. Reach for it as the first step in an identity investigation, then feed the discovered profiles into deeper correlation or manual review.

source github.com/sherlock-project/sherlock

use cases

Where sherlock fits

Map an identity's social footprint

Check a username across hundreds of networks to find every platform where the handle is registered, the starting point for an OSINT investigation.

Export hits to a spreadsheet

Write CSV or XLSX output so found accounts land in a structured file ready for review, correlation, or reporting.

Narrow to specific platforms

Limit analysis with --site to a chosen list of networks when an investigation only cares about a handful, cutting run time and noise.

Route checks through a proxy

Send requests over a SOCKS or HTTP proxy with --proxy to mask origin or work around rate limits while enumerating accounts.

reference

sherlock inputs and flags

11 inputs

Name	Type	Flag	Description
usernames	STRING	·	One or more usernames to check across social networks.
limit-analysis-to-sites	STRING	--site	Limit analysis to only the listed sites.
csv	BOOLEAN	--csv	Write results to a comma-separated values (CSV) file.
xlsx	BOOLEAN	--xlsx	Write results to a Microsoft Excel spreadsheet (xlsx).
print-found	BOOLEAN	--print-found	Output only the sites where the username was found.
proxy-url	STRING	--proxy	Make requests over a proxy, e.g. socks5://127.0.0.1:1080.
time-to-wait-for-response	STRING	--timeout	Seconds to wait for a response before moving on (default 60).
load-data-from-json	FILE	--json	Load the site list from a local or online JSON file.

Showing key inputs. sherlock exposes 11 inputs in total.

Full flag reference (11 inputs)

Name	Type	Flag	Description
usernames	STRING	·	One or more usernames to check across social networks.
csv	BOOLEAN	--csv	Create a comma-separated values (CSV) file of results.
xlsx	BOOLEAN	--xlsx	Create a Microsoft Excel spreadsheet (xlsx) of results.
print-found	BOOLEAN	--print-found	Output only the sites where the username was found.
print-all	BOOLEAN	--print-all	Output sites where the username was not found as well.
limit-analysis-to-sites	STRING	--site	Limit analysis to only the listed sites.
proxy-url	STRING	--proxy	Make requests over a proxy, e.g. socks5://127.0.0.1:1080.
time-to-wait-for-response	STRING	--timeout	Time in seconds to wait for a response to requests (default 60).
load-data-from-json	FILE	--json	Load site data from a local or online, valid JSON file.
nsfw	BOOLEAN	--nsfw	Include NSFW sites from the default list in the check.
no-color-output	BOOLEAN	--no-color	Do not color the terminal output.

example

Run sherlock

sherlock · command

# find where a handle exists and export the hits to CSVsherlock ksokolov --print-found --csv --timeout 30

sample output

[*] Checking username ksokolov on:[+] GitHub: https://www.github.com/ksokolov[+] GitLab: https://gitlab.com/ksokolov[+] Reddit: https://www.reddit.com/user/ksokolov[+] Instagram: https://www.instagram.com/ksokolov[+] Twitter: https://twitter.com/ksokolov[+] Pinterest: https://www.pinterest.com/ksokolov[+] TikTok: https://www.tiktok.com/@ksokolov

guidance

Choosing sherlock

Use sherlock to map where a username exists across social networks during OSINT. It checks handles, not emails or availability. For email-and-username availability checks, use socialscan. For broken social links on a site, use socialhunter.

socialscan

Checks whether an email or username is available, taken, or invalid. Sherlock finds where a handle already exists.

socialhunter

Crawls a site for hijackable broken social links rather than enumerating one identity's accounts.

shodan-python

Device and service intelligence. A different OSINT axis from social identity.

faq

sherlock questions

Pass one or more usernames as the argument. Sherlock requests each platform's profile URL for the handle, reads the response to decide whether the account exists, and lists every hit. On Trickest, set the node's username input instead of typing the argument.

h8mail
Email OSINT and breach hunting across multiple breach and reconnaissance services.

Run sherlock yourself

A username feeds sherlock, which checks it across hundreds of networks and writes the found accounts as a queryable output.

Run sherlock in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

usernames

STRING

One or more usernames to check across social networks.

limit-analysis-to-sites

STRING

--site

Limit analysis to only the listed sites.

csv

BOOLEAN

--csv

Write results to a comma-separated values (CSV) file.

xlsx

BOOLEAN

--xlsx

Write results to a Microsoft Excel spreadsheet (xlsx).

print-found

BOOLEAN

--print-found

Output only the sites where the username was found.

proxy-url

STRING

--proxy

Make requests over a proxy, e.g. socks5://127.0.0.1:1080.

time-to-wait-for-response

STRING

--timeout

Seconds to wait for a response before moving on (default 60).

load-data-from-json

FILE

--json

Load the site list from a local or online JSON file.

Name

Type

Flag

Description

usernames

STRING

One or more usernames to check across social networks.

csv

BOOLEAN

--csv

Create a comma-separated values (CSV) file of results.

xlsx

BOOLEAN

--xlsx

Create a Microsoft Excel spreadsheet (xlsx) of results.

print-found

BOOLEAN

--print-found

Output only the sites where the username was found.

print-all

BOOLEAN

--print-all

Output sites where the username was not found as well.

limit-analysis-to-sites

STRING

--site

Limit analysis to only the listed sites.

proxy-url

STRING

--proxy

Make requests over a proxy, e.g. socks5://127.0.0.1:1080.

time-to-wait-for-response

STRING

--timeout

Time in seconds to wait for a response to requests (default 60).

load-data-from-json

FILE

--json

Load site data from a local or online, valid JSON file.

nsfw

BOOLEAN

--nsfw

Include NSFW sites from the default list in the check.

no-color-output

BOOLEAN

--no-color

Do not color the terminal output.

[*] Checking username ksokolov on:[+] GitHub: https://www.github.com/ksokolov[+] GitLab: https://gitlab.com/ksokolov[+] Reddit: https://www.reddit.com/user/ksokolov[+] Instagram: https://www.instagram.com/ksokolov[+] Twitter: https://twitter.com/ksokolov[+] Pinterest: https://www.pinterest.com/ksokolov[+] TikTok: https://www.tiktok.com/@ksokolov

Find every network where a username is registered

What sherlock does

Where sherlock fits

Map an identity's social footprint

Export hits to a spreadsheet

Narrow to specific platforms

Route checks through a proxy

sherlock inputs and flags

Run sherlock

Choosing sherlock

socialscan

socialhunter

shodan-python

sherlock questions

More Social Engineering tools

h8mail

Run sherlock yourself

Find every network where a username is registered

What sherlock does

Where sherlock fits

Map an identity's social footprint

Export hits to a spreadsheet

Narrow to specific platforms

Route checks through a proxy

sherlock inputs and flags

Run sherlock

Choosing sherlock

socialscan

socialhunter

shodan-python

sherlock questions

More Social Engineering tools

h8mail

Run sherlock yourself