The Name You Leave

As the old Chinese saying goes: a wild goose leaves its cry, a person leaves a name.

After all these years online, we’ve left names all right. Plenty of people use one username for everything: the forum, the games, the code repos, the video sites. Saves effort, sure, but it’s also like taping a note to every door on the street: “I was here.”

There’s an open source tool whose whole job is going door to door reading those notes.

Cartoon illustration: a grey brick hutong wall with a few wild geese flying overhead. The wall has four red doors, each with a blue house sign above it: “1 Forum”, “2 Games”, “3 Code”, “4 Video”. Doors 1, 2 and 4 have white strips reading lzbob; door 3 has a crooked grey strip reading “Nobody”. On the left, a purple robot in a deerstalker holding a magnifying glass knocks on door 1, with a speech bubble asking “Is lzbob home?” On the right, lzbob in a black baseball cap stands open-mouthed and sweating, with a speech bubble saying “I’m everywhere…” — Door to door, asking if anyone by that name lives here. Every door with your name on it is an account you opened once upon a time.

So what is it?

Sherlock, named after Sherlock Holmes. Open-sourced in late 2018, it’s now at 97k stars (96,964 when I looked), 11,000-plus forks and 100-plus contributors. The code is MIT-licensed and written in Python, and the latest release is v0.16.2, out in September. The official site says it covers 400-plus social sites. I counted its site list: right now it’s 481.

It does exactly one thing. You give it a username, it goes to each of those few hundred sites and asks “Anyone here by this name?”, then lists the hits as a string of links.

How it checks

Once you see it, there’s no magic. Every site’s profile URLs follow a pattern, like “site address/username”. Sherlock plugs the name in, knocks on twenty doors at a time, and sees how each one answers:

Status code: if the page doesn’t exist, the site usually sends back a 404. Nobody by that name. 327 sites on the list get checked this way.
Text on the page: some sites don’t send a 404 when there’s no such user, they just print a line like “User does not exist,” so it looks for that line. There are 127 of these.
Redirects: another 27 sites bounce you back to the home page when they can’t find anyone, so where you end up tells you the answer.

The links it finds get saved in a txt file named after the username.

It’s the same routine as the neighborhood beat cop going door to door checking who’s registered where, only it knocks on dozens of doors a second.

What it doesn’t do

Some write-ups online make it sound almost mystical: nicknames, bios, signup dates and locations rounded up on one page, plus following the links on profiles to dig deeper and deeper. I went through its docs and its code. None of that is in there.

All it tells you is which sites have someone registered under that name. Somebody answers the door; who actually lives there is none of its business, and it has no idea anyway.

A few honest notes:

Same name isn’t same person: a hit only means someone registered that username there, not necessarily the person you’re looking for.
It gets things wrong: the moment a site gets redesigned or starts blocking bots, you get false positives and misses. The project even keeps a dedicated list of 131 sites that were dropped because the checks weren’t reliable.
Chinese sites are mostly missing: Weibo, Bilibili, Douyin and RedNote (Xiaohongshu) aren’t on the list. The only Chinese one I could find was Gitee.

How to use it

Install:

pipx install sherlock-project

pip or uv work too. If you’d rather not install Python, there’s a Docker version: docker run -it --rm sherlock/sherlock. Homebrew, Kali and the like also have community-maintained packages.

Look up a name:

sherlock user123

A few handy options:

Check several at once: sherlock user1 user2 user3.
Put {?} in the name and it swaps in an underscore, a hyphen and a dot, checking each one.
--site checks only the sites you name; --csv and --xlsx export to a spreadsheet; --browse opens every page it finds in your browser; --proxy goes through a proxy.
Adult sites are skipped by default; add --nsfw to include them.

The first person to look up is you

The most legit use of this thing is running your own username through it:

See where you opened accounts back in the day. Old accounts you forgot about: close the ones that should be closed.
Keep your work name and your personal name apart. Don’t take one name everywhere you go.
Before signing up somewhere new, check whether that name got snapped up elsewhere long ago.

Fair warning

Go easy when it’s someone else: it only reads public pages, but gathering up one person’s accounts from all over is, in itself, piecing together their life. Use it to stalk or harass someone and you hurt people, and you may be breaking the law. Being able to look someone up doesn’t mean you should.
Check the results yourself: there are false positives and misses, and plenty of people share a name. Don’t jump to conclusions from a list of links.
You need the command line: there’s no GUI, so you’ll be typing commands in a terminal.
The list keeps changing: when a site gets redesigned, its detection rules have to change with it, so sites get added and dropped every so often.

Before I go

Holmes cracked cases by observation. This one does it by knocking. Whose name is on the door, it spots in a flash; whether the person inside is the one you’re after, that’s for you to deduce.

The old saying about leaving a name meant your reputation. The name you leave online works differently: the more neatly you leave it everywhere, the easier you are to find.