How to Find Every Account That Uses Your Username (and Clean Up Your Digital Footprint)

Most of us picked a username years ago and then reused it everywhere: a gaming forum, a photo site, a music app, a shop we bought one thing from. Some of those accounts are still sitting there, with an old profile picture, an old email address and a password you have probably used somewhere else too.

You can’t clean up what you can’t see. A free tool can check hundreds of sites for your username in minutes, and the cleanup after that is mostly a checklist.

Prefer to watch? Here’s the short version:

What Sherlock is and why it helps

Sherlock is an open-source command-line program. Its README describes it as a way to “hunt down social media accounts by username across 400+ social networks”. You give it a username, and it checks each site in its list to see whether a profile with that name exists.

It is free and released under the MIT License, so anyone can read, use and modify the code. As of November 14, 2026, the current release on PyPI, Python’s main package index, is version 0.16.2.

Search engines only show pages they have indexed. Sherlock asks each site directly whether a profile exists, which turns up small forums you forgot you ever joined.

Ground rules: search yourself, or with permission

Sherlock can look up any username, which is exactly why it gets used in OSINT (open-source intelligence, meaning research done with publicly available information). That power cuts both ways.

Use it on your own usernames, or on someone else’s only when they have asked for help, such as a parent checking a teen’s old handles together with them. Don’t use it to track or expose another person. Listing someone’s accounts without consent can feed stalking and harassment, and depending on where you live and what you do with it, it can break the law.

How to install Sherlock

Sherlock runs in a terminal. The official README lists these install methods:

1. pipx (listed first in the README): run pipx install sherlock-project. The README notes that pip or uv can be used in place of pipx.
2. Docker: run docker run -it --rm sherlock/sherlock if you already use Docker and don’t want to install Python packages.
3. Fedora and similar: dnf install sherlock-project.

A few practical notes:

• pipx installs Python command-line apps in their own sandbox. If you don’t have it, install it first.
• The PyPI listing says Sherlock needs Python 3.9 or newer.
• The README warns that packages for ParrotOS and Ubuntu 24.04, “maintained by a third party, appear to be broken,” and tells users of those systems to use uv, pipx, pip or Docker instead.
• Community packages also exist for Debian, Ubuntu, Homebrew, Kali and BlackArch, but the project says these “are not directly supported or maintained by the Sherlock Project.” If one misbehaves, fall back to pipx.

How to run your first search

Once installed, the basic command is just the word sherlock followed by your username. The README’s example is sherlock user123. Swap in your own handle.

If you installed with Docker, put your username after the image name: docker run -it --rm sherlock/sherlock yourname.

To check several of your usernames in one go, list them with spaces between: sherlock user1 user2 user3. Handy if you had a teen handle, a gaming handle and a work handle.

Here are the options from Sherlock’s help output that are most useful for a personal audit:

• --print-all also lists the sites where the username was not found. By default Sherlock shows only the hits.
• --txt saves the found profile links to a text file named after the username, such as yourname.txt. The README text says results are saved this way, but in the current code the text file is only written when you add this flag.
• --csv or --xlsx saves the results as a spreadsheet, handy for ticking off accounts as you deal with them.
• --nsfw adds adult sites to the check, which are skipped by default.

Putting it together, a sensible first run looks like this: sherlock yourname --csv. A username with {?} in it checks common variants: Sherlock replaces it with an underscore, a hyphen and a full stop, so sherlock your{?}name checks your_name, your-name and your.name.

Why every result needs checking

Sherlock reports that a username exists on a site. It cannot tell you that the account is yours. Treat each hit as a lead, then open the link and look.

Common reasons a result is wrong or misleading:

• Someone else has the same name. Short or common handles are taken on almost every site. A hit for “alex” means nothing on its own.
• The site blocked the check. Many sites use firewalls and bot protection. Sherlock’s own code notes that these can “lead to false positives and negatives”, meaning wrong “found” results and missed accounts.
• The site changed. When a site redesigns its pages, Sherlock’s check for it can break until the project updates it.
• Excluded sites. The project excludes some sites that give unreliable results. The –ignore-exclusions option brings them back, and the help text warns it “may return more false positives.”

To confirm a hit is yours, look for things only you would recognise: your old photo, a bio you wrote, posts you remember, or a working password reset sent to an email address you control. If you can’t confirm it, leave it on the list as “unknown” rather than assuming.

A clean result isn’t proof either. Sherlock only checks sites in its list, for the exact usernames you give it.

The cleanup checklist

Sort your confirmed accounts into two piles, keep and delete, then work through these steps.

1. Delete the accounts you no longer need

Download anything you want to keep first, then use the site’s official deletion page. Two big examples:

• Google: Google’s Delete your Google Account page tells you to back up your data first and to move any banking or app logins that use the Gmail address. You start deletion from the Data & privacy section of your Google Account. Google warns that you’ll lose all the data in the account, including emails, files, calendars and photos.
• Facebook: Meta’s permanently delete your account page explains the difference between deactivating (a temporary break; your profile is hidden but kept) and deleting (permanent). From Settings, open your Meta account settings and choose Deactivation or deletion. Meta says you can cancel if it has been less than 30 days since you started, though the window can vary by region.

For smaller sites, search their help pages for “delete account”, or email support and ask them to close it and erase your data.

2. Check whether your details have leaked

Have I Been Pwned is a free service that collects data from known breaches, so you can check whether an email address has turned up in one. Search each email address you’ve used over the years. If an address appears in a breach, change the password on that site and anywhere else you reused it. You can also sign up to be notified if your address appears in a future breach.

3. Fix your passwords with a password manager

Reused passwords turn one forgotten account into a problem for all of them. The UK’s National Cyber Security Centre lists using a password manager in its top tips for staying secure online, along with protecting your email with a strong, separate password. That matters because, as the NCSC puts it, criminals “can use your email to access many of your personal accounts.” A password manager creates a different long password for every site and remembers them for you, so you only need to remember one strong master password. For new passwords you type yourself, the NCSC suggests three random words.

4. Turn on two-step verification

Two-step verification (2SV, also called two-factor authentication, 2FA, or multi-factor authentication, MFA) means you need a second thing, such as a code from an app, as well as your password. The same NCSC tips recommend turning it on. Even if someone gets hold of your password, they still need that second step to get in. Start with your email accounts and bank, then do the rest of your keep pile.

5. Ask Google to hide your contact details

Google’s Results about you tool checks whether your phone number, home address or email address shows up in Google Search, and lets you request removal of those results. You can reach it at myactivity.google.com/results-about-you, or through the Results about you option in the Google app’s profile menu. You can also turn on alerts so Google tells you when new matches appear.

Google may turn down some requests, for example for news sites or government and educational pages. And removal only affects Google Search: the information stays on the original page unless that website’s owner takes it down.

6. Tidy the accounts you keep

For accounts you keep, switch to an email address you actually check, remove old phone numbers and review what’s public. While you’re in the settings, tidy features you never chose, such as Spotify DJ’s voice commentary.

A tidy account list matters more now that some phone malware goes after the text-message codes that protect your logins. Our ArcticRAT explainer shows how one Android trojan does it. If you also look after sign-ins for a small team, our guide to setting up ChatGPT Business walks through roles, domain verification and SSO.

Make it a yearly habit

Your footprint grows back with every new game, shop and app. A yearly Sherlock run on your handles, a Have I Been Pwned check on your emails, and an up-to-date browser (here’s how to make sure yours is patched) keep the list short. If you like to tie habits to a date, the weekend the clocks change is an easy one to remember.

The bottom line

Sherlock gives you a fast, free starting list of where your username exists, but only you can confirm which hits are really yours. Use it on your own handles, check each result by hand, then delete what you don’t need, check your emails for breaches, move to unique passwords in a password manager, and switch on two-step verification for the accounts you keep.

If you also look after a server or a cloud machine, the same tidy-up applies there: here is how to set up SSH keys and log in without a password.