How to find someone's GitHub account

What does a GitHub profile publish?

More than most people who made one a decade ago remember.

The public API returns an account's creation date, its company, location, blog and bio, and its follower and repository counts, with no authentication. The email field is null unless a public one was set.

The profile page adds the contribution calendar, pinned repositories, starred projects, organisation memberships and public gists. A handle checked across the username module returned GitHub, GitLab and Docker Hub in 320, 414 and 516 milliseconds.

That first pass returns existence and nothing else, which is exactly the right first step: it costs almost nothing, it needs no interpretation at all, and it tells you whether there is anything here worth the slower work that follows.

Can you find an account from an email address?

Usually, and this is the direction the guides skip.

Every git commit records the author name and email that the committer's machine was configured with, and GitHub's search indexes it: author-email is a documented qualifier on commit search.

Measured on 31 July 2026 against a public maintainer address published on the maintainer's own site: the search returned the username, a count of matching commits, and the five most recent repositories with their messages and dates, in 1,086 milliseconds.

The binding that makes it work is stated in GitHub's own documentation: commits appear on a contribution calendar only if the authoring address is connected to the account. The connection is the feature people actually want, and this lookup is only its shadow.

The two limits that keep it honest

Both are documented, and neither appeared on the pages ranking for this in July 2026.

Commit search reads default branches only. Work that lives on a side branch is invisible to it, so an empty result means the address did not author anything on a default branch of a public repository — not that the person has no account.

The second is throughput. Search is capped at ten requests a minute unauthenticated and thirty with a token, and the general API allows sixty an hour unauthenticated against five thousand with one.

Those numbers are the reason this is a lookup and not a sweep. Checking one address you already hold is what the limits permit, and it is also the only version of this with a defensible reason behind it.

What does a noreply address give away?

The username, the account's numeric id, and roughly when it was created.

GitHub offers a private commit address so contributors do not publish a real one. Its format changed on 18 July 2017, and the username-only shape belongs to accounts that predate it.

So the privacy feature doubles as a dating signal, the same way commit metadata carries more than its author intended. The inference only runs one way, though: the older shape puts the account before July 2017, and the newer one says nothing, since any account can be issued it.

It does still do the job it was built for. The real address is not in the commit, a commit search on it returns nothing at all, and that is both the correct outcome and the whole reason to turn the setting on.

What can you read from the activity?

A recent window, and less of it than people assume.

The public events endpoint returns at most 300 events from the past 30 days, and GitHub warns in the same page that it is not built for real-time use, with latency between thirty seconds and six hours.

Which means quiet is ambiguous. An account with no events may be dormant, or may simply have done nothing in the last month, and the endpoint cannot distinguish those.

The contribution calendar covers a year and is the better read for pattern: when somebody started, whether the activity is continuous or arrives in bursts, and whether it stopped. Account age plus a year of rhythm is most of what verification actually needs.

How do you close this on your own account?

Two settings, and the second is the one people miss.

Turning on the private commit address stops future commits carrying a real one. It does nothing about commits already pushed, which keep whatever was configured at the time, permanently.

The second setting blocks command-line pushes that would expose it. The description is narrower than readers assume: it checks the most recent commit on a push, and blocks when that commit carries a real address you marked private.

Worth doing both, and worth knowing what neither of them fixes. A settings change does not rewrite history, and a repository somebody else forked years ago carries the old commits with the old address in them regardless of anything you do now.

Is any of this against GitHub's rules?

Reading is not. Publishing what you read can be.

GitHub's doxxing policy lists personal, private email addresses first among the things that may not be posted, alongside phone numbers and physical addresses.

It also closes the obvious loophole, in the same place the law does. The policy says GitHub weighs context and whether the content is available elsewhere, and that sharing public content with intent to harass still breaks the rules.

Which sets the line for this whole page. Confirming which account an address you already hold belongs to is one thing, and it is the thing this post is about. Publishing somebody's address somewhere they chose not to put it is another thing entirely, and it is precisely what the policy exists to stop.

Common questions