Most rankings of the best username OSINT tools count sites. That number is easy to publish and tells you almost nothing, because a hit that is just a URL still leaves you the hard part: is this the same person, and where do they go next. This list ranks nine tools by what a hit actually contains, using a real OSINTsearch export for the top entry and each project's own page for the rest, all read on 2026-09-05. I build OSINTsearch, so it is first; the other eight are here because I use them.
The tools fall into three groups: hosted services that run the sweep and return fields, open source scripts that run on your machine and return URLs, and availability checkers built for brand owners that investigators keep borrowing. Each entry gets a best-for line, what it returns, the price, and where its scope ends.
The best username OSINT tools, ranked
| Rank | Tool | Type | Stated coverage | A hit contains | Price |
|---|---|---|---|---|---|
| 1 | OSINTsearch | Hosted | 770 endpoints | Normalized profile, former usernames, banned state, identity block | Free 15/week, full results; $20 and $49.99/mo |
| 2 | Maigret | Script | 3,000+ sites | URL plus parsed fields, recursion on found ids | Free, MIT |
| 3 | Sherlock | Script | 400+ sites | URL | Free, MIT |
| 4 | WhatsMyName | Dataset and web app | 700+ sites | URL | Free, CC BY-SA 4.0 |
| 5 | Blackbird | Script | 600+ platforms | URL, some metadata, AI profile | Free |
| 6 | Fingerprint.to | Hosted | 700+ platforms | Bio, followers, join date, location, linked accounts | Free start; $30 and $100/mo |
| 7 | Revealer.us | Hosted | 800+ platforms | Profiles plus breach and stealer log hits | Free preview; from $12.99/mo |
| 8 | IDCrawl | Web search | Major networks | Links to profiles by username or name | Free basic search |
| 9 | Namechk | Availability checker | 100+ platforms, 36 domains | Taken or available | Free |
1. OSINTsearch: the most per hit, and a dossier at the end
Best for: going from a handle to a person-shaped answer in one scan. On 2026-09-05 I ran davidbombal, a public educator who publishes his handles, through the live search. 770 endpoints, 59 hits in 29 seconds. The chart above counts what those hits carried: 47 display names, 41 profile pictures, 41 numeric user ids, 26 join dates, 23 bios, 15 locations, 15 follower counts and 12 sets of outbound links. The Instagram hit alone came back with the numeric id, the join month, the follower count, the location and a bio that points at his Twitter and YouTube.
The part no script does is the identity block. Eighteen of the 59 platforms agreed on the display name, so the export names a probable identity with those eighteen sources listed, a probable country, two websites pulled from bios, and every username variant seen, which here included davidbombal.eth from ENS. Bios are parsed for links, which is what a paid deep search follows at four depths. Instagram is resolved through its numeric id, so a banned account is still returned as found with former usernames attached, which is the whole story in who is behind a username.
"probable_name": { "value": "David Bombal", "confidence": 0.31,
"sources": ["mix", "odysee", "behance", "github", "threads", "twitter", "..."] },
"username_variants": [ { "value": "davidbombal" },
{ "value": "davidbombal.eth", "sources": ["ens"] } ],
"websites": [ { "url": "https://www.davidbombal.com", "sources": ["twitter", "tap_bio"] } ]Price: Free runs the full sweep 15 times a week and shows full results, no card needed. Starter is $20 a month for 50 a week with CSV and JSON export. Pro is $49.99 for 500 a week with deep search and full breach records; see the pricing page. Scope: a hosted service, and nothing is kept after the export, so download the file.
2 to 5: the open source scripts
Maigret. Best for the widest free sweep and the best free report. It collects a dossier by username across more than 3,000 sites, checking the 500 highest-ranked by default, extracts account information from profile pages and site APIs, recurses on usernames and ids it finds, filters by tag and country, and exports to HTML, PDF, JSON, CSV, XMind, an interactive graph and Neo4j. MIT licensed. Scope: it runs from your IP, and the tail of a full run needs manual triage. Details in Maigret vs Sherlock.
Sherlock. Best for a quick check on the big networks with nothing to configure. Over 400 sites, one pipx command, output as text, CSV, XLSX or JSON, MIT licensed, and the most starred project in the category. Scope: a hit is a URL, and account state, rename history and links are outside what a static site list describes. The Sherlock alternative post covers when that matters.
pipx install sherlock-project
sherlock davidbombal --csv
maigret davidbombal --htmlWhatsMyName. Best for the cleanest public dataset of profile URL shapes. Created in 2015 by Micah Hoffman and community maintained, it tracks 700+ sites under a CC BY-SA 4.0 license and powers the free web app at whatsmyname.app as well as other tools. Scope: it is a data file with detection rules, so it tells you a profile exists and leaves the fields to whatever tool consumes it.
Blackbird. Best for a free run that ends in a readable PDF. It searches usernames and emails across more than 600 platforms using the WhatsMyName data, extracts metadata from some pages, and adds an optional AI profile built from the list of sites where accounts were found, with PDF and CSV exports. Scope: it inherits WhatsMyName's coverage, and its profile is behavioral rather than a field-by-field record.
6 to 9: hosted rivals, a web search and a checker
Fingerprint.to. Best for a fast streamed sweep with export. Username, email and phone across 700+ platforms, results shown as they land, with bios, follower counts, join dates, locations and linked accounts on returned profiles. Free to start with a monthly allowance, Pro at $30 a month for 500 tokens with exports, Max at $100 for 2,500 tokens and deep search. Scope: it stops at the profile list; the correlation into a single identity is work you do afterward. Head to head numbers in OSINTsearch vs Fingerprint vs Revealer.
Revealer.us. Best for a username search that also checks breach datasets. It searches public sources and breach and stealer log data for a username, email or phone, says it covers 800+ platforms, and its AI Deep Search follows reused handles. A free tier with preview results, Starter at $12.99 a month for 25 social lookups a day, Basic at $29.99 for 150, Pro at $79.99 for 500 with an API. Scope: the breach side is the differentiator; per-profile depth is where the tools above it spend their budget.
IDCrawl. Best for a no-login first look. It is a free people search engine that groups social profiles, public web pages, phone numbers and email addresses, and its reverse username lookup lists accounts on major networks such as Instagram, TikTok, X, Facebook, YouTube, Snapchat, LinkedIn, Roblox, Flickr and Pinterest. Basic searches by name or username are free. Scope: it is a search engine over profile pages, so the result is a list of links and names rather than a structured record.
Namechk. Best for checking whether a handle is free before you register it. A free web app that checks 100+ social platforms and 36 domain endings and lights each tile green or dim. Scope: availability is not identity. "Taken" tells you someone holds the name and nothing about who; the Namechk alternative post explains the gap.
Reading the ranking
Coverage claims cluster between 400 and 800 with Maigret far above, yet results on a real handle look more alike than the numbers suggest, because every tool reaches the same major platforms and differs at the edges. What separates them is what happens after the URL. OSINTsearch is first because a hit is a record with the fields that let you say "same person" with evidence, and the identity block does the first pass of that correlation for you. Maigret is second because it is the only script that tries to do the same, for free, on your own machine.
The right stack is one hosted service for the case that matters and one script for the throwaway first pass. If your identifier is an email or a phone rather than a handle, the same fleet covers those too, and the best paid OSINT tools post ranks the hosted services on those questions alongside the enterprise platforms. The username search tool guide covers how to read a result set once you have one.
FAQ
Which username OSINT tool has the most sites?
Maigret states more than 3,000, with 500 checked by default. Revealer states 800+, OSINTsearch runs 770 endpoints, WhatsMyName and Fingerprint state 700+, Blackbird more than 600 and Sherlock over 400. Site counts are a floor on breadth, not a measure of what each hit contains.
Which tool finds former usernames or banned accounts?
OSINTsearch returns former usernames where a platform exposes them and resolves Instagram accounts by numeric id, so a banned account is still returned as found. Scripts that test a profile URL report only whether the page resolves today. The old usernames post walks through it.
Is a free username search good enough?
For a quick check, yes. Sherlock, Maigret, WhatsMyName and Blackbird cost nothing, and OSINTsearch's free tier runs the full 770 endpoint sweep and shows every field. Pay when you need an export, breach records or a deep search.
Is it legal to run these tools on someone's username?
They read public pages. Lawfulness depends on why you search and what you do next: research identifiers you own, that a client has authorized, or that fall within a lawful investigation, and never use the output for employment, tenancy, credit or insurance decisions.
One handle, nine tools, one rule
Rank tools by what a hit contains, not by how many sites they claim. A URL is a lead; a record with an id, a join date, a bio and its links is evidence. Start with the tool that returns evidence, keep a script around for the free first pass, and export everything, because the export is what you will be reading when the case comes back in six months.
