Username Search: How One Handle Ties All Your Accounts Together

A username search sounds like something investigators do. In practice it is something anyone can do to you in a few minutes, and the reason is simple. If your handle on a gaming site is “rivercat_87”, there is a fair chance the same name sits on your old forum account, your Reddit profile, a photo site and a dating app. None of them shows your real name. One of them only has to, and the rest fall into line behind it.

This piece takes the side of the person whose handle has been the same for years. It starts with two federal cases in which a reused name made the difference, explains why usernames are so easy to follow, and shows how WhatsMyName and Namechk let you check yourself before a stranger does.

The altoid posts: a forum question from January 2011

On January 27, 2011, a user on shroomery.org, a forum about psychedelic mushrooms, asked whether anyone knew of an anonymous online market. He had come across a site called Silk Road, he wrote, a Tor hidden service that claimed to let you buy and sell anything anonymously. The user called himself “altoid”. It was the only message he ever posted there.

Two days later the same name turned up on bitcointalk.org, a forum about the digital currency. Again the post was about Silk Road, and again it closed with almost the same line: let me know what you think. Silk Road went on to become a market mainly for drugs.

In October 2011, about eight months later, “altoid” posted on Bitcoin Talk once more. This time he was looking for an IT professional to be lead developer at a venture-backed Bitcoin startup. Replies were to go to “rossulbricht at gmail dot com”.

That sequence comes from the criminal complaint against Ross Ulbricht, sworn by an FBI special agent in the Southern District of New York on September 27, 2013. According to Google, the Gmail account was registered to Ross Ulbricht. His Google+ profile used the same picture as his LinkedIn profile. The Google+ page linked to videos from the Mises Institute, a libertarian think tank, and on the institute’s site there was a “Ross Ulbricht” profile with that same photo. The operator of Silk Road, who went by “Dread Pirate Roberts”, linked to the institute in his own forum signature.

The person who first followed the trail appears in the complaint only as “Agent-1”. On December 25, 2015, The New York Times named him: Gary Alford, an IRS special agent assigned since February 2013 to a Drug Enforcement Administration task force. His preferred tool, the paper reported, was Google. He searched for posts from the weeks before Silk Road went online. In the last weekend of May 2013 he landed on “altoid”.

The following weekend he read everything altoid had written. Among it was a message the author had apparently deleted. It had survived anyway, because another user had quoted it in a reply. According to the Times, it still took months before colleagues took the lead seriously. Ulbricht was arrested on October 2, 2013, in a public library in San Francisco.

A rename less than a minute later

One more passage in the same complaint shows what renaming an account achieves. On March 5, 2012, an account named “Ross Ulbricht” was created on Stack Overflow, the programming Q&A site, with the Gmail address. On March 16 it posted a question about connecting to a Tor hidden service using curl in PHP. Less than a minute later the username was changed to “frosty”, and a few weeks after that the email address was changed too.

The name disappeared from the page. It stayed in Stack Overflow’s records, which investigators obtained. To the platform it had been one account all along, with a new label on it.

Alpha02: a handle from 2008

The second case comes six years later and follows the same pattern. AlphaBay went online as a dark web marketplace in December 2014. Its FAQ said it had been founded by “alpha02”, a reputable member of most carding forums, the places where stolen credit card data is traded. In August 2015 the operator announced that the “alpha02” account would be renamed “Admin”. According to the civil forfeiture complaint the Justice Department filed in Fresno, California, on July 19, 2017, the profile later showed it had been the same account throughout. Only the moniker had changed.

In December 2016 investigators learned that an address had appeared in the header of AlphaBay’s welcome email: [email protected]. It belonged to a Canadian named Alexandre Cazes, born on October 19, 1991. The complaint notes plainly that the birth year matched the number in the email address.

Then came the handle itself. On a French tech forum there was a post from December 3, 2008, by a user called “Alpha02”, explaining how to remove a virus from a digital photo. At the bottom he had signed with his full name, Alexandre Cazes, and an email address. Six years separated a helpful answer about a photo virus from a drug market, and the same handle held both ends.

Both investigations had far more resources than a search engine. The decisive clue in each was still open to anyone. An old post under a reused name and a birth year in an email address were enough. The same thing works on people with nothing to hide. Then the one searching may be an ex-partner, a curious employer, or someone writing a phishing email tailored to you.

Why a username is so easy to follow

Most platforms build a profile’s address directly from the name. If you are “rivercat_87” on a site, your page usually lives at something like site.com/rivercat_87. A 2009 study from Arizona State University checked 36 online communities and found addresses of that kind on every one of them.

The rest follows almost by itself. Anyone who knows a name can drop it into the address pattern of one site after another and see where a profile answers. Username lookup tools automate exactly that. WhatsMyName, the best known, is an open list started in 2015 by Micah Hoffman and now maintained by a community of volunteers. For each site it records which address to request and what a found or not-found page looks like. When we counted the list on October 6, 2026, it held 717 sites, from social networks and gaming platforms to coding sites and dating apps. Sherlock, a popular command-line tool, works on the same principle and covers more than 400.

One of WhatsMyName’s rules for adding a site is telling. The profile URL has to contain the username directly. Sites that swap names for numeric IDs are left out. The address pattern is the foundation the whole method rests on.

Then there is human habit. The 2009 study looked at roughly a hundred thousand pairs of usernames from people who had listed their own accounts on other sites. In 59 percent of the pairs the name was identical. In a second count, 77 percent of people used the same name as at least one of their handles elsewhere. The sample is old and self-selected, but the direction is hard to miss.

How much a single name gives away was the subject of a 2011 paper by researchers at INRIA, the French national research institute for computing. They worked with millions of usernames from Google profiles and eBay. Most names in their data were rare enough to single out one person among a billion. Slight variants such as “daniele.perito” and “d.perito” could be linked to each other in a large share of cases. People rarely change their usernames, the authors added, and when they do, they change them in predictable ways.

What a handle gives away

Many usernames carry more information than their owners realize. A birth year is the classic example. The 91 in Cazes’s address meant nothing on its own. Next to a first name, it became a search filter.

The INRIA paper describes the puzzle effect directly: a date of birth on one site can be linked with a city and a first name on another, and the end of that chain is a real, identifiable person.

The fourth row is the quietest. Use the part of your email address before the @ as your handle, and every profile hands out half the address. How attackers then check which services an email is registered with is covered in our article on what OSINT is, and this piece is part of the same OSINT series.

A username search on yourself: WhatsMyName and Namechk

People who want to find the social media accounts behind a name usually reach for these very services. The simplest way to see your own trail is to run them on yourself. The web version of WhatsMyName lives at whatsmyname.app, and Namechk at namechk.com. Both are free and need no account. Namechk was built for people about to start a business who wanted to see whether a name was still available as a domain and on social platforms. According to the investigation toolkit published by Bellingcat, the open-source research group, it covers more than a hundred sites. WhatsMyName, with its list of over 700, goes considerably deeper.

Do not stop at your current handle. The interesting ones are the names you have forgotten: the one from high school, the one from your first online game, the one from a forum you posted on constantly at twenty. Add variants with a dot, an underscore or a number at the end. The INRIA researchers showed that variants like these are easy to match.

For every hit, open the profile itself. Is it actually yours? What does the bio say, which picture is shown, does it link to other accounts? Such links help a stranger more than any list of sites. Write down what you find. You will probably end up with a few accounts you had stopped thinking about.

If you want to go further, combine the handle search with a search for your real name and your old email addresses. Our guide to searching yourself online walks through it.

Separating accounts: what actually helps

The most important step sounds almost too simple. Use different names for different parts of your life. The INRIA researchers ended their paper with the same advice in 2011. They had also put a self-test online, and more than 10,000 people used it. In practice that means one name for the professional profile and another for games. The support forum about your illness or your hobby gets a third. None of them should carry a birth year or a town.

Old accounts you no longer use are better deleted than left to sit. A forgotten profile from 2012 keeps tying your handle to whatever you wrote back then. How account deletion actually works, and why it is rarely as final as it sounds, is in our guide on how to really delete data.

Renaming is the weaker fix. The Stack Overflow and AlphaBay cases show that the platform keeps treating the account as the same one. Quotes in other people’s replies and copies in web archives keep the old name too. A rename protects you from future searches for the old handle on that one site. It does not reach back into the past. Whether and how often a name can be changed varies widely. Check the help pages of the service before you switch.

The profile picture tends to get overlooked. Use the same photo on separate accounts and you have linked them again, different names or not. In the Ulbricht case it was one link in the chain: the same image on Google+, LinkedIn and the institute’s site. How easily identical pictures can be found across the web is the subject of our reverse image search guide. Give each account its own picture, or none.

Where a username lookup falls short

A hit on WhatsMyName only means that an account with that name exists on a site. It says nothing about who owns it. Bellingcat’s toolkit warns that one username may be used across several platforms by different people, and that results should be treated as clues rather than definitive results. Common names light up almost everywhere and tell you nothing. The INRIA researchers deliberately did not link “johnsmith” and “johnsmith82”, because the name is too common.

Then there are technical false alarms. WhatsMyName was started because the username checkers available at the time were full of false positives. Websites change their profile addresses and responses all the time. Some show a normal page for any name you type, whether the account exists or not. Others report every name as available. Sherlock keeps its own list of sites it has removed for exactly these reasons.

For a self-check, that means you verify every hit before you worry about it. It also works the other way. An empty result proves little. In the 2009 study the name was different on the other site in roughly four out of ten cases. Platforms that use numbers instead of names in their addresses are invisible to these tools.

What stays with you

A username is convenient because it is easy to remember. That is exactly why the same name keeps appearing on new sites year after year, and why the trail grows with each one. Ross Ulbricht deleted the post with his email address, and it survived in someone else’s quote. Alexandre Cazes renamed his account, and the handle from 2008 was still sitting in a forum thread about digital photos.

For most people the question is not whether a federal agent will find them. It is whether a stranger can get from a gaming profile to a real name, and from there to a street address. Half an hour with your own handle in WhatsMyName answers that fairly precisely. Deleting a few old accounts afterwards and picking a fresh name for the next part of your life costs very little. A link that already exists is hard to undo completely. A new one is easy to avoid.

Frequently asked questions

Can someone find me by my username?

Often, yes, if the name is unusual and you use it on more than one site. Many platforms build the profile address straight from the username, along the lines of site.com/name. Anyone who knows the name can plug it into address after address and see where a profile answers. If one of those profiles carries a real name, a photo or an email address, every other account with the same handle now points to you. Common names work poorly for this, because many different people share them.

How do I check where my username is registered?

Free services such as WhatsMyName and Namechk run a username lookup across hundreds of sites at once. You type in your own handle and the service reports where an account with that name exists. WhatsMyName relies on an open list of more than 700 sites. Treat every result as a lead. A hit can just as easily be a stranger who picked the same name, so open each profile and check it yourself.

Does changing my username help?

Going forward, somewhat. Looking backward, much less. A new name stops showing up in fresh searches for the old one on that site, but the platform still treats it as the same account, and old replies, quotes and archived copies keep the former name. In two well-known federal cases, the rename sat in the platform records and the profile history where investigators could see it. Deleting accounts you no longer use, and picking a separate name for each new part of your life, does more.

What should a username never contain?

Your birth year, your age, your town and, ideally, any part of your real name. A number like 91 or 1987 at the end looks harmless, but next to a first name and a city it narrows the field to a handful of people. Just as risky is a handle that doubles as the part of your email address before the @ sign, because every profile then hands out half your address.

Is it legal to use WhatsMyName or Namechk?

These services only request public profile pages that anyone could open in a browser, and checking your own name is both legal and sensible. The picture changes when someone uses the results to follow, harass or frighten a specific person. Stalking and harassment laws do not care whether the information was public.