A doorbell, not a detective
Sherlock takes one username and knocks on a few hundred websites to see whether a profile page answers. Despite the name, it doesn't deduce anything. It checks whether https://site.example/<username> returns a profile or a "no such user" page, and gives you a list of URLs.
That's useful, because people reuse handles the way they reuse passwords: often, and with no thought for whoever comes along later. One handle can point you to a GitHub account, a forum account from 2014, and a music profile its owner has forgotten.
How the check works
For each site, Sherlock's data file stores a URL pattern and a rule for spotting a missing account. That rule is usually one of these:
- **Status code:** a 404 means no account; a 200 means an account exists.
- **Error message:** the page loads either way, but includes text like "This user does not exist".
- **Redirect:** a missing user gets bounced to the home page.
If the rule passes, Sherlock reports the URL as found. It doesn't log in, read private data or contact the account holder. It loads a public URL, the same as you would in a browser, just a few hundred times faster.
Where it sits in OSINT101
Sherlock is one of the 12 tools in this course and the one we start with. It's the oldest and best-known username checker, its code is readable, and it fails in ways that teach you something. Maigret, WhatsMyName and the others in later lessons use the same idea with more sites and better parsing.
Rule of thumb: Sherlock tells you where a username **exists**. It doesn't tell you who owns it. That second question is your job, and it's where most beginners get it wrong.