WhatsMyName Username Search Explained: What It Finds and Misses

WhatsMyName Username Search Explained: What It Actually Searches, and What It Misses

The WhatsMyName username search checks a single username against hundreds of public websites, free, in your browser, and hands you links to whatever it finds. Nothing gets hacked. In fact, there are no logins and no private data. Instead, it asks for public profile URLs and looks for a pattern that proves somebody registered that handle.

Here’s the part most write-ups skip. However, WhatsMyName isn’t really an app. It’s a data file. In fact, the app is one of several front ends reading it, and once you know that, most of the confusion about the results clears up on its own.

Quick Facts

What is the WhatsMyName username search?

The WhatsMyName username search is a username enumeration tool. First, type in a handle. Then it queries a curated list of public profile URLs and reports which sites that handle exists on. Micah “WebBreacher” Hoffman started the project in 2015 because the username checkers available at the time kept annoying him with false positives.

His fix was structural. Instead of writing a better checker, he wrote better data. WhatsMyName is one JSON file, wmn-data.json, published openly on the WhatsMyName GitHub repository. Moreover, every entry explains how to check a single website: which URL to request, what a successful response looks like, and what a “not found” response looks like. Meanwhile, other people’s tools read that file and do the actual requesting.

Split the data from the checker and two useful things happen. First, anyone can build their own checker. Second, the data stays accurate whichever tool you prefer. That’s also why the name shows up attached to a website, a Chrome extension, a Docker container and a Maltego transform, all running off the same brain.

Three rules decide which sites are on the list

Three conditions govern whether a site can join the dataset, and they’re strict on purpose. First, it has to be publicly accessible, because anything behind a paywall or login wall can’t be checked at all. Second, the username has to appear in the profile URL. Finally, the site mustn’t transform the username, since platforms that swap handles for numeric IDs leave nothing to pattern-match against.

Read those back and the coverage gaps stop looking like neglect. For example, a platform that hides profiles behind a login is unreachable by design. Similarly, one that converts your handle into a numeric ID the moment you sign up gives the detection nothing to work with. As a result, the 700-odd sites in the file lean heavily towards forums, gaming services, developer platforms, hobby communities and marketplaces. The older, flatter internet, where a profile URL still ends in your name. Therefore, coverage is thinnest exactly where a beginner assumes it’ll be strongest: the big walled gardens.

Timeline: from bundled script to pure dataset

• 2015 — Hoffman starts the project, shipping the checker script and the site data together in one package.
• May 2023 — the bundled checker scripts come out. As a result, the project narrows its focus to maintaining the data file, and checking moves to third-party tools.
• Now — that dataset feeds a web app, browser extensions, a bookmarklet, several Python clients, Spiderfoot’s sfp_account module, LinkScope’s Online Identity category, local Maltego transforms and the Rust tool sn0int.

Practical upshot: clone the repo expecting a program and you’ll find a JSON file and a schema. Instead, the project points you at whatsmyname.app if you want to run a search right now.

WhatsMyName username search vs Sherlock vs Maigret

Maigret began as a fork of Sherlock, and unless you tell it otherwise, it only runs against the 500 most popular sites on its list. That’s worth knowing before you take those raw coverage numbers at face value. Indeed, people who do this for a living tend to run two or three of these tools, not one.

How to run a self-audit with the WhatsMyName username search

Start with yourself. First, open whatsmyname.app, enter the handle you’ve been reusing since university, and let it finish. Then results appear as green boxes you can click straight through to the profile page. Also, a category filter narrows them to groups like business, dating or shopping.

Next, work the list in roughly this order:

1. Dating, adult and health categories first. Oldest accounts, usually, and also the ones people most regret leaving findable.
2. Open every hit before you believe it. A pattern match is a good lead, but it isn’t proof.
3. Delete or rename rather than switching the profile to private. If the URL still resolves, then the handle is still enumerable.
4. Export the results. For example, the web tool writes to CSV, which turns a panicky evening into a checklist you can chip away at over a week. Also, keep that file somewhere sensible; our guide to securing your data with free encryption software covers what’s worth using if the list runs long.
5. Stop reusing the handle. After all, one repeated username is what makes the whole exercise possible in the first place.

Watch out for the lookalike sites

Because the dataset ships under a Creative Commons Attribution-ShareAlike 4.0 licence, anyone can legally put up their own username checker on their own domain using the same data. In fact, several people have. Some say so plainly, including one site that describes itself as an independent web interface running on the WhatsMyName detection dataset. Others, however, don’t bother mentioning it.

The results can look identical, because the brain is the same file. What changes is who runs the thing, what analytics they’ve bolted on, and whether your search terms end up in a log. For instance, Bellingcat’s toolkit entry for WhatsMyName notes that the official tool uses tracking cookies and hadn’t been checked for advertising trackers when it was listed. Therefore, if the name you’re searching matters, treat the query itself as data. Similarly, vetting a username checker takes the same habits as vetting any unfamiliar domain, and the checks in our complete overview of Arrowzonee transfer directly.

Enumeration is not identification

“Enumeration does not equal validation” is the standing warning among OSINT practitioners, and it’s the most useful sentence on this page. A hit tells you a string is registered somewhere. However, it tells you nothing about who registered it. In fact, different people use the same username all the time.

Common handles breed spectacular false confidence. Rare ones carry more weight, but even then you want a second data point before you treat two accounts as one person: a matching avatar, a shared link, a bio that lines up. In short, what comes out of the tool is a list of leads, not a finding.

The legal line

The WhatsMyName username search reads public pages, so running it isn’t hacking. However, what you do afterwards can still break the law. For example, one tools directory puts the standard plainly: keep searches to legitimate investigative or research purposes, avoid harassment, stalking or misuse of the accounts you turn up, and respect privacy and data protection rules. Likewise, in the UK, a course of conduct that causes someone alarm or distress can fall under the Protection from Harassment Act 1997, whether or not each individual step relied on public information.

Also, apply the same scepticism to the services you use while you’re looking. Logging policies matter and rarely get advertised, a point our breakdown of what NZBGeek is and how it handles user data goes into properly.

Auditing your own footprint, checking a handle before a brand launch, verifying a seller before you pay: all fine. Building a file on an ex, on the other hand, isn’t.

FAQ

Is the WhatsMyName username search free?
Yes. The web version at whatsmyname.app costs nothing, runs in the browser and needs no installation. Moreover, the dataset behind it is free to download, audit or host yourself.

Is it legal to use?
In most places, yes, because it only requests publicly accessible pages. However, tool directories advise keeping searches to legitimate investigative or research work and staying well clear of harassment or stalking. In other words, your purpose creates the legal risk, not the tool.

Can WhatsMyName see private accounts or passwords?
No. In fact, anything behind a paywall or login wall can’t be checked at all, and the tool only looks for evidence that a public profile page exists.

Why did it find a profile that isn’t mine?
Usernames aren’t unique, so two unrelated people can hold the same handle. Additionally, detections break when sites redesign their pages, which is why the project asks contributors to report broken checks and new sites.

What’s the difference between WhatsMyName and Sherlock?
Coverage and access. WhatsMyName’s dataset spans more than 700 sites and runs in a browser. Sherlock, on the other hand, covers 400+ social networks from the command line, which suits scripting and batch jobs better.

Written by Sarah Preston for Derek Time, covering technology, business, entertainment, and digital trends with a focus on making complex topics clear and practical. Usually found testing new apps or watching what’s next in tech and business.

Sarah Preston

Founder & Lead Writer, Derek Time

Derek covers technology, business, entertainment, and digital trends for Derek Time, focusing on making complex topics clear and practical. Outside of writing, he’s usually testing new apps or keeping an eye on what’s next in tech and business.