An account creation date is the one field on a profile the owner cannot type. Display names, bios, photos and usernames change in a minute, but the platform stamps the day the account opened and keeps it. Knowing when an account was created is the most useful single fact for deciding whether an account belongs to the story you are checking. In the public cybercrime cases we reviewed, it sorted accounts into three bins: opened before the case, opened while the person was active, and opened after the name went public.
Below: where GitHub, X, Instagram, YouTube, Reddit and other platforms publish the date, then how to read it as evidence in public cases.
Where each platform shows the account creation date
Here is what each platform publishes today, checked against its own documentation where it exists.
| Platform | Where to look | Precision |
|---|---|---|
| GitHub | The public API: GET /users/NAME returns created_at | Exact second |
| X | "Joined" on the profile. Clicking it opens About this account, which adds where the account is based and how many username changes it has had | Month and year on the profile |
| Instagram and Threads | The three-dot menu, then About this account: date joined, country and former usernames | Month and year |
| YouTube | The channel's About panel ("Joined"), or the Data API field snippet.publishedAt, documented as the date and time the channel was created | Day |
| Reddit Age on the profile card; hover on desktop for the exact date (the cake day) | Day | |
| Chess.com and Lichess | Chess.com's public API returns joined and last_online; Lichess returns createdAt and seenAt | Second |
| Wikipedia | The MediaWiki API with usprop=registration | Second |
| Discord | No date field, but every user ID is a snowflake that encodes its creation time | Millisecond |
| TikTok | No join date on the profile, but the numeric user ID, like video IDs (per Ryan Benson's work), encodes creation time in its top 32 bits for accounts made since about 2016. Some older accounts, likely migrated from musical.ly, do not follow the pattern; for those the oldest video gives a lower bound | Second (newer accounts) |
Three of these take one line each from a terminal:
# GitHub: exact creation time
curl -s https://api.github.com/users/torvalds | grep created_at
# Wikipedia: registration time
curl -s "https://en.wikipedia.org/w/api.php?action=query&list=users&ususers=Jimbo_Wales&usprop=registration&format=json"
# Discord: user ID to UTC time
python3 -c "import datetime as d;i=int(input('ID: '));print(d.datetime.fromtimestamp(((i>>22)+1420070400000)/1000,d.timezone.utc))"Checking one handle on hundreds of platforms by hand is slow; that is the job a username search tool should do for you. OSINTsearch returns the creation date and, where published, the last-active date for every matching profile, so you can sort a whole footprint by age.
Four traps when reading a creation date
- Month precision looks like day precision. Instagram publishes a month and year only. When an Instagram date shows the 1st, read it as the month: "June 1, 2013" means June 2013.
- The account is older than the handle. A creation date dates the account, not the name on it. GitHub's documentation says that after a rename, the old username becomes available for anyone else to claim. Check former usernames where the platform lists them; our guide to finding old usernames covers that trail.
- The account is older than the display name. A 2023 channel can take a new display name in 2025.
- Last active is not ownership. A recent login says someone uses the account, not who.
Reading dates against a case timeline
Line the dates up against the known events: first use of the alias, then naming, arrest or sanctions. Each account falls into one of three bins.
| Created | What it can mean | How to treat it |
|---|---|---|
| Before the alias existed | Someone else held the string first | Unrelated unless other evidence links it |
| While the alias was in use, before the person was named | Consistent with the owner, or with an informed insider | A lead. Corroborate with name, location or an email anchor |
| After the person was named or arrested | Fans, impersonators, journalists or opportunists registering a famous handle | Possible squatter by default |
Case one: the LockBitSupp alias, before and after May 7, 2024
On May 7, 2024 the Justice Department unsealed an indictment charging Dmitry Khoroshev as the developer and administrator of LockBit, and the same day's OFAC entry listed him with the alias "LOCKBITSUPP". The release says LockBit ran from its inception in September 2019. An indictment is an allegation and he is presumed innocent; no public record we checked reports him in custody. Our LockBitSupp post covers his public footprint in full.
A username search on lockbitsupp returns 22 exact-match results, and the dated accounts among them fall into all three bins:
- Before the persona: a Steam account created January 8, 2004, held by an unrelated user. That is fifteen years before LockBit existed. Someone else had the string.
- Before the unsealing: a Lichess account created June 9, 2023, and a YouTube channel created September 15, 2023 whose display name renders Khoroshev's full name. The persona was already notorious in 2023, so fans could register it too, and a display name can be changed at any time. The channel could belong to the persona, to an informed impersonator, or have been renamed after May 2024.
- After the unsealing: Codeforces on May 12, 2024, five days after the announcement; Keybase on October 9, 2024; TikTok on December 21, 2025 and Twitch the next day. Every one of these is a possible squatter or impersonator until something else says otherwise.
Case two: a forum profile from March 2000
The OFAC action of September 7, 2023 designated Maksim Rudenskiy as part of the TrickBot package, listing Saint Petersburg, a 1977 date of birth and the address [email protected]. He is sanctioned and was indicted in 2023 in Ohio and Tennessee, and is presumed innocent.
An email lookup on that address resolves to a GitHub account under a shorter handle. A username search on that handle returns 92 exact-match results, almost all of them other people who share the surname. One stands out on its date: a profile on a long-running Russian-language Linux forum, created March 16, 2000, whose display name matches the sanctioned name in a transliteration variant. That is 23 years before the designation, and fits a man born in 1977. But its location is a Ukrainian city, not Saint Petersburg: a consistency question, not a confirmation.
Andrey Zhuykov, sanctioned in the same action and indicted in the same 2023 Trickbot and Conti cases, shows why dates need a partner. The handle in the email address OFAC lists for him has a Launchpad account from May 2013 displaying the same first name and an Instagram account from February 2014 with a Cyrillic first name and a Russian location, both about a decade before the listing. Those two are consistent with him, not confirmed: a common first name and a country are weak signals. The same handle on X dates from March 2010 but carries an unrelated person's name. Same era, different owner.
Case three: an alias Krebs tied to Kaye, still growing after the arrest
Brian Krebs reported in July 2017 that a seller called "Spdr" offered the GovRAT trojan using [email protected], and that a Gravatar account on [email protected] carried the name Spdr01. Daniel Kaye was arrested in February 2017 and, after pleading guilty, was sentenced to 32 months in the UK in January 2019.
A username search on spdr01, an alias Krebs tied to Kaye, returns 18 exact-match results. The oldest dated account is a YouTube channel from March 22, 2007, which predates everything in the record. Then come accounts that postdate the arrest by years: X on November 8, 2024, showing a different person's name; Twitch on March 14, 2026; TikTok on April 21, 2026. Treat all three as possible squatters; nothing in the record ties them to Kaye.
Dates can also rule an account out. In August 2026 Krebs reported that someone using the name Ruben Thomson registered on HackerOne in June 2025 with the username Deadcatx3. A search on that handle finds accounts from 2013 and 2016. Thomson is reported to be 21, so he would have been a young child when they opened. The dates alone argue that someone else held the string first, and nothing in the record ties them to him. Thomson has been arrested, not convicted, and is presumed innocent; our TeamPCP post covers the case.
A repeatable method
- Write down the anchor dates: first use of the alias, naming, arrest or designation.
- Run the handle through a username search and export every hit with its creation and last-active dates.
- Drop each account into one of the three bins above.
- For every account in the middle bin, look for a second signal: display name, location, bio links or an email that resolves to it. The verification checklist lists what counts.
- Label everything created after the public date a possible squatter, even when it looks convincing.
Creation dates are one clue in how hackers get caught, and the method works outside criminal cases too: a dating match whose every account opened six weeks ago is a warning, as our catfish check guide explains.
FAQ
How can I see when an Instagram account was created?
Open the profile, tap the three-dot menu and choose About this account. Date joined shows the month and year, next to the country and any former usernames.
How do I see when a Twitter/X account was created?
The profile shows "Joined" with a month and year. Tap it to open About this account, which adds where the account is based and how many times its username has changed.
Can you find when a TikTok account was created?
Not on the profile, but the account's numeric user ID encodes its creation time in the top 32 bits for accounts made since about 2016. Shift the ID right by 32 bits and read the result as a Unix timestamp. Some older accounts, likely migrated from musical.ly, do not follow the pattern; for those, the upload time in the oldest video ID tells you the account existed by then.
Does an old creation date prove who owns an account?
No. It proves the account is old. Handles get renamed and reclaimed, and common strings belong to many people. Pair the date with a name, location or email link.
Check the dates on any handle
A creation date turns a list of profiles into a timeline. Run a free username search on OSINTsearch to see creation and last-active dates for every matching profile, then sort them against the dates that matter to your question.
