Sherlock — Install, Use, Optimise (2026)

Hunt usernames across 400+ social networks for OSINT investigations.

Installation

Pick the install method that matches your stack. The Docker option is the cleanest for one-off scans where you don’t want to pollute your workstation.

pipx

pipx install sherlock-project

Docker

docker run --rm -t sherlock target_username

Source

git clone https://github.com/sherlock-project/sherlock && cd sherlock && pip install -r requirements.txt

Core commands

The handful of invocations you’ll actually run on 90% of engagements:

Single username

sherlock johndoe

Multiple usernames

sherlock johndoe janedoe

Output to folder

sherlock johndoe --folderoutput results/

Specific sites only

sherlock johndoe --site GitHub --site Twitter

Check NSFW too

sherlock johndoe --nsfw

JSON output

sherlock johndoe --print-found --json

Performance optimisation

What separates a junior who runs the default invocation from a practitioner who knows the knobs:

• --timeout 5 bounds per-site check (default 60s — slow because some sites are slow).
• --proxy http://... for bypassing rate limits on aggressive runs.
• Site list grows ~5/month. git pull the source for latest.
• False-positive rate is real — a 200 response doesn’t always mean the username exists. Manual verification needed.

Common pitfalls

Real failure modes that bite people on engagements. Most are recoverable; a few are reputation-damaging.

• Some sites use anti-bot (Cloudflare, hCaptcha) — Sherlock returns false negatives.
• Aggressive scanning across 400 sites = trips multiple platform abuse detection. Use --proxy if scanning many usernames.
• Output includes URLs to profile pages — visiting them logs your visit. Use Tor / residential proxy if OPSEC matters.

Modern alternatives in 2026

The ecosystem moves fast. These are tools you should at least be aware of:

• WhatsMyName — broader catalog, simpler.
• Maigret — fork with more features.
• Holehe — same idea but for emails.

India context and engagement notes

For corporate-investigation OSINT in India: Sherlock is the first tool to map a target’s online identity. Pair with holehe for email cross-checks. Document chain of custody for any findings used in HR / legal work.

⚖️ Legal: Use only on systems you own or have explicit written authorisation to test. In India, unauthorised access is punishable under Section 66 of the IT Act, 2000 (up to 3 years imprisonment + fine). Pair every engagement with a signed Statement of Work or Rules of Engagement before running anything from this page.