Username OSINT for Journalists: Verification, Ethics and Source Protection

A tip arrives from an account you have never seen. A viral post claims to come from a witness. A company spokesperson turns out to have a second, less careful profile. In each case a username is the first thing you have, and it is often enough to start checking whether the account is what it claims to be.

Username OSINT is a good fit for newsroom verification because it uses only public information. It also brings real risks: misidentifying someone, exposing a person who did nothing newsworthy, or burning a source who trusted you. This guide covers how to use username searches for verification, the ethical lines, and how to protect sources while you do it.

What a username search can and can't tell you

A username search checks many sites for a profile with a given handle. Our username search checks 3,450+ sites and marks each result Found, Not found, Blocked or Unknown. For Found results, it shows the display name, avatar and bio when the site makes them public.

What you get is a list of leads. A Found result tells you that a profile with that name exists on that site. It does not tell you who runs it. Handles like alex1990 or sunflower are reused by thousands of unrelated people, and even unusual handles get copied by impersonators. Blocked and Unknown mean the check couldn't finish. They are not evidence either way.

What a username search is good for:

• Seeing whether an account claiming to be a long-time resident, expert or employee has any history elsewhere.
• Finding older profiles on the same handle that show a different name, location or set of interests.
• Spotting a cluster of brand-new accounts with a similar naming pattern, which can point to coordinated activity.
• Confirming that a public figure's claimed accounts are consistent with each other.

How sure can you be?

What you have	What it supports
Same username on two sites	A lead only. Many people share handles.
Same username plus the same photo or a link between the accounts	A likely connection, still worth a second check
The person confirms the account through a known channel	Confirmed account, not proof that a specific claim is true

Keep two questions apart: who runs the account, and whether what it says is true. Decline to link two accounts in print when the only evidence is a matching name, or when naming the link could expose a source.

A made-up example: a tipster says they work at a city council and shares the handle @civic_owl. The handle also appears on a forum where it posts about council meetings. That supports a lead, nothing more. The reporter calls the council’s switchboard, asks for the person by the name they gave, and confirms the account by asking them to describe one of their own forum posts. The newsroom now knows who runs the account. Whether the tip itself is true still needs documents or a second source.

A verification workflow

1. Record the original. Before anything else, capture the post or profile you are verifying: screenshot, URL, timestamp. Accounts get deleted fast once a story gains attention. Saving a copy to the Internet Archive's Wayback Machine gives you an independent record.
2. Run the handle across many sites. Use a broad search first. If you have a few spellings to test, check up to five at once.
3. Open every Found result yourself. Compare profile photos, bios, linked websites, join dates, and the topics the person posts about. Look for links that connect profiles directly, such as one profile listing another.
4. Look for disconfirming evidence. Ask what would prove that the accounts belong to different people, and look for it. A different time zone, language or life story is a red flag.
5. Check history. Search engines with the handle in quotes and archived snapshots can show how a profile changed over time.
6. Contact the person. Verification through OSINT supports direct contact. It doesn't replace it.
7. Write down your confidence. Note what is confirmed, what is likely, and what is a guess, and keep the evidence for each.

For more tools to add to this workflow, see our list of free OSINT tools for username investigations and the OSINT tools hub, which includes pages on Sherlock and Maigret if you prefer command-line tools.

The ethics of looking people up

The SPJ Code of Ethics rests on four principles: seek truth and report it, minimize harm, act independently, and be accountable and transparent. Username research touches all four, and the second one most of all.

• Public isn't the same as fair game. A profile being visible doesn't make everything on it newsworthy. Private people, especially those caught up in a story by accident, deserve more care than public officials.
• Collect only what you need. If the question is whether an account is genuine, you don't need its owner's family members, home street or old dating profile.
• Don't publish the trail. Explaining that you verified an account is good practice. Publishing every other profile you linked to it can expose someone to harassment.
• Be careful with misidentification. Naming the wrong person is one of the most damaging mistakes you can make. A shared username is weak evidence on its own.
• Think about minors. Gaming and social handles often belong to young people. Treat any sign that an account belongs to a minor as a reason to stop and check with an editor.

Username searches also have legal limits that vary by country. Our tool is not a consumer reporting agency, and its results must not be used for decisions about employment, credit, housing or insurance. Check with your newsroom's legal team on anything sensitive.

Protecting sources

The same techniques you use to verify an account can be used against your sources. Before you publish or share anything:

• Search your source's handle yourself, with their permission. If a username they use with you also appears on profiles with their real name or photo, they should know before the story runs.
• Suggest a fresh, unique handle for any account they use to contact you. Reused handles are the easiest link between an anonymous account and a real identity.
• Strip identifying details from screenshots: usernames, avatars, timestamps and anything else that would let a reader run the same search.
• Keep your notes secure. A spreadsheet linking a source's handles to their identity is exactly what an adversary would want. Store it encrypted, share it sparingly, and delete what you no longer need.

Protect your own research

Investigations work both ways. People you report on may look you up too.

• Run your own handles through a digital footprint check and close or lock old accounts that reveal more than you'd like.
• Be aware that viewing a profile can be visible to its owner on some platforms. Use logged-out browsing where you can, and research accounts if your newsroom allows them.
• Be careful with tools that send your searches to third parties. We send the username to our server only to run the check, and it is not stored or logged. Still, check any tool's privacy policy before you put sensitive names into it.

Practical notes on our tool

FreeUsername is free and needs no sign-up. You can export results as JSON or CSV to attach to your notes. For a single platform, the platform checkers run one site at a time. The OSINT username search page explains our statuses for investigators, and the journalists use case sits alongside other professional uses in the use cases section.

There is no API, and we do not offer email or phone lookups. Email and phone checks are listed as coming soon in the tool, but they are not live.

In short

Use username searches to raise questions, not settle them. Verify by hand, look for evidence that you are wrong, contact the person, and publish only what the story needs. Protect your sources from the same techniques, and audit your own footprint while you're at it. To start a check, search a username.