SpiderFoot vs Sherlock vs Maigret vs WhatsMyName

Quick Answer: Which OSINT Tool Should You Use?

The practical answer is not one winner. Choose from the investigation goal outward. A broader platform and a focused username tool can be complementary, while a shared dataset can power more than one client.

SpiderFoot vs Sherlock vs Maigret vs WhatsMyName at a Glance

This table deliberately does not rank the projects by “supported sites.” The figures in project readmes can use different definitions, exclude different disabled or protected sites, and describe an application, a dataset, or a module collection. They are not a common measurement scale.

Why “Number of Supported Sites” Is a Misleading Comparison

A site total sounds objective, but it is only meaningful with a definition and a date. One project may count each regional domain; another may ship definitions that are disabled, experimental, blocked by anti-bot controls, or only usable through a particular client. A third may count data entries while another counts active modules. Comparing those totals as a winner chart confuses coverage inventory with reliable investigation value.

The underlying sites change as quickly as the tools. Profile paths are redesigned, generic pages return HTTP 200, accounts become private, login walls appear, and rate limits change. WhatsMyName documents this maintenance burden directly: each JSON entry describes a URL and found or not-found behaviour, and contributions are needed as sites change. Maigret likewise documents site-database maintenance and flags that public sites can produce false positives.

A better question is: which sources are relevant to my authorized goal, and can I verify the resulting profile? A smaller, current, relevant set of rules can be more useful than a larger list with stale detections. More results are not automatically more accurate results.

SpiderFoot: Broader OSINT Automation and Correlation

SpiderFoot is best understood as a scan-oriented OSINT platform. Its official project describes automated OSINT for threat intelligence and attack-surface mapping, with more than 200 modules, a web UI, CLI, YAML-configurable correlation, and CSV, JSON, and GEXF export. A username can be an input or an observation inside that broader model, but it is not the sole organizing principle.

That breadth is valuable when a permitted engagement needs relationships across entity types: a known organization domain, public DNS and infrastructure, an email address, a username, open web references, and selected third-party sources. The useful output is often the relationship between observations, not a long list of profile URLs. It also makes SpiderFoot more operationally involved: module selection, source credentials, scan data, logging, and output handling deserve planning.

Some SpiderFoot modules use external APIs while others do not. The project notes that many key-requiring sources offer a free tier, but an API key can still create quota, cost, attribution, and data-sharing implications. Treat the open-source project and any commercial or hosted edition as separate products when assessing API capabilities; verify the documentation for the edition you intend to use.

Sherlock: Fast Cross-Platform Username Enumeration

Sherlock has a narrow and useful job: take one or more usernames and check known social and profile sites. Its current command-line documentation lists targeted site selection, timeouts, CSV, XLSX, JSON, text output, and Docker packaging. That focus makes it a sensible first pass when the question is simply whether a handle appears on public profile URLs.

Like most username checkers, Sherlock uses site definitions and expected web behaviour to classify a candidate. In general, the client constructs or queries a profile URL and evaluates platform-specific signals such as response behaviour, redirects, and page content. That is account discovery logic, not identity proof. A common handle may be held by unrelated people, and a platform can return a convincing-looking generic page for a non-existent account.

For automation, the advantage is a CLI-first workflow and machine-readable output. The limitation is equally clear: Sherlock does not turn a matching handle into a validated person, and it does not provide SpiderFoot-style multi-entity correlation as its primary role. Use it to generate candidate URLs, then inspect context and preserve the exact tool version, data file, time, and errors alongside the result.

Maigret: Username Search With Richer Profile Context

Maigret also begins with usernames, but its documented workflow extends toward available profile metadata, reports, tags, recursive discovery, a built-in web interface, and a Python library. Its current documentation describes local installation with Python 3.10 or later, Docker, a bundled database that can obtain compatible updates, and report formats including HTML, PDF, JSON, CSV, TXT, Markdown, XMind, graph, and Neo4j-oriented output.

This makes Maigret a strong option when an analyst wants a username-led dossier rather than only a concise terminal list. The word available matters: metadata is constrained by what a public service exposes, what the rule can retrieve, and whether a request succeeds. Richer reporting should improve review, not inflate confidence.

Maigret also illustrates why maintenance matters. Its contribution guidance discusses sites changing layout, switching engines, introducing anti-bot controls, redirects, and login walls. Its own usage material warns that broad searches can yield false positives. A report can make the evidence easier to examine; it cannot make an unstable platform response reliable by itself.

Sherlock vs Maigret: What Is the Real Difference?

Neither row claims that one tool is “more accurate.” They use different data models and defaults, and performance depends on the selected sites, network conditions, the date, and rule maintenance. A fair comparison needs a controlled test, not a site-count screenshot.

WhatsMyName: A Username Detection Dataset and Ecosystem

WhatsMyName is the category mistake that most often distorts this comparison. The project says that, since May 2023, it has focused on maintaining its data file rather than bundling checker scripts. The core asset is wmn-data.json: entries describe a public profile URL pattern and the behaviour a client can use to recognize a found or absent account. Tools and scripts read that data and perform the requests.

That separation is powerful for builders. A data update can serve multiple compatible clients without requiring every client to invent a detection rule. The official project lists web, command-line, desktop, transform, and self-hosted tools that use the dataset, including a SpiderFoot sfp_account integration. This is an ecosystem relationship, not evidence that every client has identical request logic, output, or accuracy.

For a non-developer, the listed whatsmyname.app interface is a low-friction way to conduct a permitted self-audit. For a developer, the dataset is useful when a workflow needs transparent, versioned site rules. The licensing difference is important: unlike the three MIT-licensed code projects, WhatsMyName data is licensed under CC BY-SA 4.0. Check the actual license before redistribution or product integration.

SpiderFoot vs Dedicated Username Search Tools

If the entire question is “where does this username exist?”, launching a broad scan platform may add setup and source-management work without improving the first answer. Sherlock or Maigret is usually the more direct entry point, while a WhatsMyName-backed client is appropriate when its maintained rule data and interface fit the workflow.

The balance changes after verification. If an authorized investigation needs to connect an established account to permitted domains, emails, infrastructure, public-source modules, or threat-intelligence context, SpiderFoot can provide the broader investigation frame. Keep a strict boundary between an observed handle and an attributed person; only promote a candidate profile after manual review establishes relevant public context.

Which Tool Is More Accurate?

There is no defensible universal accuracy percentage for these four projects. The relevant failure modes include stale definitions, soft 404 pages, redirects, account renames, private profiles, rate limits, service redesigns, anti-bot controls, temporary network failures, and platform-specific assumptions. A result marked Found means the tool saw a signal consistent with an account. It does not mean the account belongs to the person under review. A result marked Not Found, Unknown, or an error does not prove absence either.

What a fair accuracy test would require

Without those controls, GitHub stars, claimed site totals, and an anecdotal fast run are not accuracy benchmarks. For a fuller treatment of evidence handling, read Why OSINT Results Can Be Wrong: False Positives.

Installation, Interfaces, Outputs, and API Keys

For beginners, the easiest route is usually the one that produces a small, reviewable result with the least local setup: a web interface for a self-audit or a documented package installation. Sherlock offers current package and Docker paths. Maigret documents pip, Docker, a Windows standalone executable, and optional PDF dependencies. SpiderFoot has a web UI, CLI, and repository Docker files, but its broader module configuration makes it a more involved first project.

CLI workflows are strong for scripting, SSH, repeatability, and machine-readable handoff. Web interfaces are strong for exploratory review, scan management, and users who prefer a visual workflow. Neither interface proves a result. For automated pipelines, prefer explicit structured outputs, retain the raw status for every attempted site, and version the data definitions with the output.

API keys should be assessed source by source. SpiderFoot can use many optional external sources, some of which need credentials. Maigret documents no key requirement for its base search, while optional integrations can have their own requirements. WhatsMyName is data, not an API service. Do not upload sensitive target data to a third-party source merely because a tool supports it.

Privacy, OPSEC, and Maintenance

Username research is not automatically anonymous. Public websites, APIs, and service providers can observe requests according to their own logs and terms. Self-hosting a platform can improve control over its interface and stored results, but it also makes you responsible for patching, access control, logs, scan databases, and API-key security. CLI output is local by default, yet still needs retention and access controls.

Maintenance matters more than popularity because username discovery depends on current website behaviour. Review releases, recent rule-data changes, issue discussion, and documentation before a consequential use. A repository snapshot taken on 4 September 2026 showed active current documentation and releases for the projects discussed, but maintenance evidence is not a quality or accuracy score. Check again at the time of use.

Which Tool Should You Choose?

• Quick username search: start with Sherlock when a concise CLI-first enumeration pass is the job.
• Deeper username investigation: start with Maigret when reports, supported metadata, tags, or a web UI will help the review.
• Broader OSINT investigation: use a SpiderFoot-oriented workflow when the authorized scope connects usernames with domains, email, IP, modules, and correlated observations.
• Automation or machine-readable workflows: select the tool whose documented CLI, JSON, library, or data format fits the pipeline; preserve statuses and versions, not only found URLs.
• Reusable site rules: use WhatsMyName when building or selecting a compatible client around maintained detection data.
• Beginner self-audit: begin small, use only your own identifiers or documented authorization, export a short candidate list, and verify in a browser.
• Security analyst workflow: choose SpiderFoot for repeatable broad correlation, then add a focused username tool where the question demands it.

Do You Need to Choose Only One?

Usually, no. A responsible layered workflow can use a focused username tool to identify candidates, manual inspection to verify relevant public context, and a broader platform only for the related entities within scope. The tools do different jobs at different stages.

Fictional self-audit: PixelOrbit47

1. The owner of the fictional handle PixelOrbit47 defines a self-audit scope: only accounts they own and publicly visible information.
2. They run one focused username workflow and record candidate URLs, timestamps, tool versions, and error states.
3. They compare results from another tool as a coverage check, then open candidates manually and identify the accounts that are actually theirs.
4. Only after that verification, they use a permitted broader OSINT workflow to understand public associations that matter to their own exposure review.
5. They remove or secure unwanted public information through the relevant platforms, rather than treating the scan output as a permanent identity dossier.

Do not treat three matching tool results as three independent confirmations. They may query the same public URL, use overlapping rule data, or make similar assumptions about the same response. Independent identity confirmation comes from relevant corroborating context, not duplicate “Found” labels.

Video: A Practical Maigret Installation and Report Workflow

The Maigret documentation links to this installation video guide. It is useful for seeing the report-oriented, username-led workflow described above; use it only for accounts and targets you are authorized to research.

Frequently Asked Questions

Is SpiderFoot better than Sherlock?

Not as a blanket statement. SpiderFoot is better aligned to broader, multi-entity OSINT correlation; Sherlock is better aligned to a focused username-enumeration task.

Is Maigret better than Sherlock?

Choose Maigret when its reports, web UI, available metadata, tags, or library fit the job. Choose Sherlock when a direct, lightweight CLI check is the better fit.

What is the difference between Sherlock and WhatsMyName?

Sherlock is an application that performs username checks. WhatsMyName is principally a maintained detection dataset used by compatible applications and interfaces.

Does SpiderFoot search usernames?

Usernames are part of SpiderFoot broader OSINT model, but its purpose is not limited to username enumeration.

Which tool supports the most websites?

There is no fair universal answer without matching definitions, disabled entries, client behaviour, and a check date. Do not use totals alone to select a tool.

Which username OSINT tool is the most accurate?

No current controlled benchmark establishes a universal winner. Verify candidates manually and measure both false positives and false negatives for the sites that matter.

Can Sherlock and Maigret produce false positives?

Yes. Generic pages, soft 404s, redirects, stale rules, and shared usernames can all produce misleading leads.

Do these tools require API keys?

SpiderFoot modules can use optional external services; Maigret base searches do not require a key; WhatsMyName is data rather than an API; requirements vary by integration.

Which tool is easiest for beginners?

For a small self-audit, a web interface or a documented focused tool is often easiest. A broad SpiderFoot scan has more configuration concepts to learn.

Which tool is best for automation?

Use the documented CLI, JSON, library, or data format that matches the pipeline. Store raw statuses and rule versions so the result remains reviewable.

Can I use SpiderFoot and Sherlock together?

Yes, in an authorized workflow. Use a focused tool for candidate discovery, verify the candidates, then use broader correlation only for permitted related data.

Are username search results proof that accounts belong to the same person?

No. A matching username is a lead. Attribution needs contextual, relevant, and independently assessed evidence.

Final Recommendation

Choose SpiderFoot when the investigation is genuinely about relationships across multiple public entity types. Choose Sherlock for a focused and repeatable username check. Choose Maigret when username-led reports and available profile context matter. Choose WhatsMyName when your need is maintained detection data and a compatible ecosystem. Combine them only when each stage has a clear authorized purpose.

The most reliable habit is simple: start with a small question, keep a record of uncertainty, verify candidate profiles manually, and avoid turning public discovery output into an identity conclusion. For practical foundations, see How to Use SpiderFoot, What Can Someone Find From Your Username?, and Is SpiderFoot Safe to Use?.