What does a Bluesky lookup return?
The full public profile, and more of it than the older platforms in this series hand over.
A measured run against notch came back in 538 milliseconds with the handle notch.bsky.social, the display name, the avatar, the bio, the follower and following counts, the post count, the DID and a creation timestamp of 2023-05-20T08:06:10.500Z.
Read that timestamp again. Not the month, not the day: the second, and the half-second after it. Discord requires arithmetic on the ID to get this, X gives a date, and Bluesky simply publishes it.
That is not an accident or a leak. Bluesky runs on an open protocol where account records are public data by design, so the openness is the product rather than a gap in it.
What is a DID and why does it matter?
It is the permanent identifier underneath the handle, and it is the thing worth writing down.
A Bluesky handle is a domain name. Somebody can move from name.bsky.social to their own domain, or release a handle and let another person take it. The DID, in the measured run did:plc:jrzrj2tzmqd3ikcze5l3mayc, does not move.
This is the same lesson as Discord's numeric ID and Steam's SteamID64, and it is the lesson of the whole cluster: every platform has one identifier that changes and one that does not, and people record the wrong one.
If you are noting an account to check again next month, note the DID. The handle may belong to somebody else by then, and you will have no way to tell that it moved.
The DID also survives the account moving hosts, which is a thing that can happen on an open network and cannot happen on any of the closed ones.
How do you check how old a Bluesky account is?
Read the creation timestamp, which is published rather than inferred.
On most platforms this is the hard part of verifying somebody, and on Bluesky it is the easy part. An account presenting a long history with a timestamp from three weeks ago has contradicted itself, and there is no interpretation step in the middle.
The precision buys you something extra: accounts created seconds apart were almost certainly created by the same process. A cluster of profiles sharing a creation minute is a bulk registration, whatever the individual bios say about being unconnected people.
That check is not available on any other platform in this series, and it is the reason this post exists. Discord hides the same fact inside a number, X rounds it to a date, and the rest do not publish it at all.
Every other platform here rounds the creation date to a day or hides it inside a number. This one publishes the millisecond.
Can you find a Bluesky account from an email address?
No, and it is worth being blunt about it.
Bluesky does not publish email addresses, does not offer a contact-import search, and its registration flow does not leak whether an address is taken in a way that is usable. There is no email route. Our email lookup runs 71 sources and Bluesky is not one of them, because adding a source that cannot answer would be adding noise.
Any service advertising an email-to-Bluesky search is either guessing the handle from the local part of the address, which lands on a stranger, or matching against a breach corpus that happens to contain both, which is a different claim entirely and should be labelled as one.
A missing route is a finding too. Knowing a platform has no email path saves you from buying the search from somebody who says it does.
How do you find the right handle?
Start from a handle you already have somewhere else, because people move their names with them.
Bluesky grew from people leaving X, and a very large share of them registered the same handle they used there. So an X handle is a strong first guess, and a username search across 71 platforms tells you where else the same string resolves in one run.
Custom domain handles complicate this usefully. Somebody using name.example.com has told you they control that domain, which is a verifiable fact rather than a claim, and it links the account to whatever else that domain hosts.
Compare creation dates before treating two accounts as the same person. A shared handle is a lead, not a conclusion, and the timestamp is right there to check it against.
Is a domain handle proof of identity?
It is proof of control over a domain, which is a narrower claim and a more reliable one than a badge.
To use name.example.com as a handle you have to prove you can edit that domain's DNS records. Nobody can fake that without actually holding the domain, so a journalist posting under their newspaper's domain has demonstrated something real.
What it does not prove is who the person is. A domain can be registered by anybody with a card, and a lookalike domain one character away from a real one is the standard impersonation move on every platform that has ever tried this.
So read the domain itself rather than the fact that there is one. That check is free and it is where the answer usually is.
Is a Bluesky lookup legal?
Reading public protocol records is lawful. Use is restricted, exactly as it is everywhere else.
In the United States, using a result to decide employment, housing, credit or insurance falls under the Fair Credit Reporting Act, and we are not a consumer reporting agency. In the EU and the UK, a public post is still personal data and needs a lawful basis under the GDPR.
The open protocol changes the practical position rather than the legal one. Data being trivially available does not make every use of it permitted, and the fact that a record is designed to be read is not consent to be profiled.
That gap is wider on Bluesky than anywhere else in this series, precisely because the collection is so easy. The protocol removes the technical friction that used to stand in for a rule, which leaves the rule doing the work by itself.
Common questions
How do I find someone on Bluesky?
By handle, which returns the display name, bio, avatar, follower and following counts, post count, permanent DID and an exact creation timestamp. A measured run took 538 milliseconds. There is no email route on Bluesky at all, so a handle from another platform is usually the best starting point.
What is a Bluesky DID?
The permanent identifier underneath the handle, in the form did:plc:jrzrj2tzmqd3ikcze5l3mayc. Handles are domain names and can be changed or released to somebody else, but the DID never moves. If you are recording an account to check again later, record the DID rather than the handle.
Can you see when a Bluesky account was created?
Yes, to the millisecond, published directly rather than inferred from an ID. A measured run returned 2023-05-20T08:06:10.500Z. That precision also reveals bulk registrations: a cluster of accounts created seconds apart was almost certainly made by the same automated process, whatever their individual bios claim about being unconnected people.
Can you find a Bluesky account by email?
No. Bluesky does not publish email addresses, offers no contact-import search, and does not usefully leak whether an address is registered. Any service advertising this is either guessing the handle from the address or matching against a breach corpus, which is a different claim and should be labelled as one.
Why is Bluesky data more open than other platforms?
Because it runs on an open protocol where account records are public data by design. Profiles, post counts and creation times are part of the protocol rather than something a product team chose to expose, so the openness is deliberate rather than an oversight somebody will close next quarter.
Does a custom domain handle verify someone's identity?
It proves control of that domain, because using one as a handle requires editing its DNS records. That is real and unfakeable. It does not prove who the person is: anybody can register a domain, and a lookalike one character away from a real one is the standard impersonation move.
How do I find someone's Bluesky if I only know their X handle?
Try the same string first. Bluesky grew from people leaving X and a large share registered identical handles, so it is a strong guess. A username search across 71 platforms confirms where else the string resolves. Compare creation dates before treating two accounts as one person.
Will someone know I looked at their Bluesky profile?
No. Bluesky sends no notification for a profile view, and reading the public protocol record touches nothing on the account. Nothing is posted, no follow is sent, and the owner sees no trace of the lookup in their notifications or their settings.
