What does a username actually carry?
A key in one platform's namespace, and nothing else.
No part of the design of a handle holds a person's name. It is unique within one service, it can usually be changed, and it is chosen rather than issued. The display name beside it is free text: sometimes a real name typed without thinking, often a joke, and never a field anything verifies.
Which is why every product promising a name from a handle is describing an outcome rather than a mechanism. The honest version carries a condition: a name appears if the handle is attached to an account somebody opened under one.
The number of sites a tool checks changes none of this. Enumerating a handle across hundreds of platforms measures breadth, not identification, and the 71 platforms answered here say where accounts are rather than who holds them.
Every route that works has the same shape
The person attached the name themselves.
Not one of the methods below extracts a name from a handle. Each finds somewhere that somebody typed their own name next to it, usually for a reason unrelated to being found: to sign work, to be credited, to be reachable, to be believed.
That gives a rule for deciding whether to keep going. Ask what this person had to gain by putting a name somewhere, and search there. A handle that never crossed a real-name surface has left nothing, and no tool changes that.
It also settles the ethics. Attributing work somebody signed is a different act from unmasking somebody who chose to stay anonymous, and the second is where this stops being research.
Can a GitHub username give you a real name?
Often, and from the commits rather than the profile.
Git records an author name and an email address in every commit, and the setting is baked into each one as it is written. Those fields hold whatever the contributor configured locally, which for most people is their own name and a work address, set once and never revisited.
Appending .patch to a public commit URL returns the raw patch, whose second line is a From: header carrying both. No key, no account, and the address it hands you is one you can then run against 71 sources.
It fails on anybody who turned it off. GitHub offers a private commit address instead, and everything pushed after the switch carries that. Anything pushed before it usually still carries the real one, and the shape of that stand-in address says something too.
The name almost never comes from the handle. It comes from a place the person signed, years earlier, for a reason that had nothing to do with this.
What if the handle belongs to a researcher?
Then a published name is one public API call away.
ORCID exists to attach a permanent identifier to a researcher and their work, and the public record returns given and family names, previously used names, and links out to personal pages and other identifiers. Email addresses are opt-in and usually absent, so treat it as a name route rather than a contact one.
OpenAlex covers the same ground from the other side, holding alternative display names beside the ORCID, which turns a nickname on a paper into the canonical spelling.
This route is narrow and exact. It works only for people who publish, and for them it returns a name they placed there deliberately, which is both the strongest evidence and the least invasive.
Does a WHOIS lookup still show a name?
Rarely, and it has been that way longer than most guides admit.
A live RDAP read of socialcatfish.com in July 2026 returned no registrant name from the registry at all, and a privacy proxy from the registrar: the organisation shown is the proxy service, the address is the proxy's, and the contact is a web form.
Redaction became the default for generic domains under ICANN policy in 2018, after the GDPR, and the consolidated registration data policy took effect in August 2025. What stays published is the registrar, the creation and expiry dates, and the nameservers.
Two openings survive. Registrants who deliberately publish an organisation, and domains old enough that a name was captured before redaction. Both are worth checking and neither is the routine result.
What if none of it works?
Then the answer is that you cannot, and that is a finding.
A handle that is unique, used on one platform, and never attached to a real name has left nothing to correlate. Every tool on this query will still hand back a page, because the page is the product. It will contain accounts rather than a person.
Notice who occupies the neighbouring results. Search for how to identify an anonymous account and the ranking pages are law firms selling subpoenas, which is the same admission in commercial form: past a point, identification is a legal process rather than a lookup.
Stopping there is the correct outcome. A search that reports what it could not establish is worth more than one that guesses.
Is it legal to identify somebody behind a handle?
Reading public records is lawful. Assembling them into an identification is regulated, and publishing the result is often prohibited outright.
Under the GDPR, data that can be attributed to a person by combining it with other information is still personal data, and the test is the means reasonably likely to be used. A person doing this for their own reasons is outside the Regulation; a service doing it, or anybody publishing the result, is not.
Platforms are stricter than the law. GitHub's own doxxing policy prohibits posting private email addresses and says that sharing publicly available content with intent to harass still breaks the rules.
General information. Not legal advice, and the rules differ by state and by country. If a decision turns on any of this, ask a lawyer.
The United States has no general anti-doxxing statute, but the federal stalking law reaches electronic surveillance meant to harass. None of this may feed a hiring, tenancy or credit decision.
Common questions
Can I find someone's real name from just their username?
Not from the handle itself, because no protocol attaches a name to one. You can find it where the person wrote it down: the author field of a git commit, an academic record, a domain registration they chose not to proxy, or a profile on a platform whose terms require a real name. If none of those exist, neither does the answer.
What is a reverse username lookup?
Checking one handle against many platforms to see where an account with that name exists. It is enumeration, not identification: the result is a list of places, each of which may or may not belong to the same person. Products that describe it as finding a name are describing what they hope the list leads to.
How do I find a GitHub user's real name?
Read their commits rather than their profile. Every git commit stores an author name and email address configured on the contributor's own machine, and appending .patch to a public commit URL returns them in the From header. Contributors using GitHub's private commit address appear as a noreply address instead.
Can you find a real name from an Instagram username?
Only if the account itself carries one. Instagram has no public directory mapping handles to legal names, and its display name field is free text. The realistic routes are the same as anywhere else: a linked website, a reused handle on a platform that requires real names, or a photograph that appears elsewhere under a name.
Is a reverse username search legal?
Checking public profiles is lawful in itself. What is regulated is the assembly and the use. Under the GDPR, combining public fragments until a person is identifiable is processing personal data and needs a lawful basis, and platform rules separately prohibit publishing what you find with intent to harass.
Does WHOIS still show who owns a domain?
Usually not for generic domains. ICANN's registration data policy took effect in August 2025 and redaction is now the default, so a live lookup typically returns the registrar, creation and expiry dates, nameservers and a privacy proxy in place of the registrant. Older registrations and published organisations are the exceptions.
Can you identify someone using only their username?
Rarely, and never as a direct lookup. A handle used once, on one platform, by somebody who never signed anything under their own name leaves nothing to correlate. The reason law firms rank alongside the tools on this query is that identification past that point is a subpoena rather than a search.
Is it doxxing to find someone's real name?
Finding is not publishing, and the rules turn on the second. GitHub's policy prohibits posting somebody's private email address and notes that sharing publicly available content with intent to harass still violates it. An email address found legitimately in commit metadata is not yours to put anywhere else.
What tools help with username OSINT?
Sherlock and Maigret check a handle across large platform lists from your own machine, WhatsMyName documents the enumeration technique openly, and commit metadata needs nothing but a browser. None of them return a name. They return places to look, which is a different and more honest product.
