How to find someone's social media profiles

Finding accounts is the easy half. The hard half — the half almost everyone gets wrong — is proving that the accounts you found belong to the same person.

Start from the strongest identifier you have

Not all starting points are equal. Ranked from most to least useful:

A username. The best possible start. People reuse handles across platforms far more than they realise, and a distinctive handle is close to a unique key. If someone is @marlow_builds on one site, that exact string is worth checking everywhere.

An email address. Strong, because the local part is often the same as the username, and because many platforms let you search by it or reveal a partial hint on password recovery.

A phone number. Moderate. Useful when it's published on a business profile; much weaker for a personal mobile.

A full name. The weakest, and the one most people start with. "James Miller" is thousands of people. A name alone is a starting point for a search, never a basis for a conclusion.

Work the username properly

If you have a handle, don't just check it on the obvious three platforms. Check the variations people actually use when their first choice is taken:

• the bare handle — marlowbuilds
• with separators — marlow_builds, marlow.builds, marlow-builds
• with a number — marlowbuilds1, marlowbuilds02
• truncated, because some platforms cap length — marlowbuild
• with a platform-appropriate prefix or suffix — marlowbuilds_official, realmarlowbuilds

A hit on an identical rare handle across two platforms is meaningful. A hit on a common handle — mike, photos, admin — is meaningless. Judge the signal by how rare the string is, not by how many platforms it appears on.

Use the link-in-bio trick

This is the single highest-yield technique and it is routinely overlooked.

People link their own accounts together. A Linktree, Beacons, Carrd, or about.me page, or just the link field on a profile, frequently lists every account the person wants associated with them. One page, self-declared, no inference required.

Similarly, a personal site's footer, a newsletter's signature block, a conference speaker bio, or a GitHub profile's website field will often name several accounts at once. When the person themselves has published the connection, you are not guessing.

Then verify, because this is where people go wrong

Suppose you now have four accounts with the same handle. The temptation is to declare them the same person. Resist it — handle collisions are common, and squatters deliberately register the same name across platforms.

Look for corroboration, which means independent facts agreeing:

• The same rare handle. Weak alone, strong in combination.
• A mutual link. Account A links to B and B links back to A. This is close to conclusive; it's a declaration by the owner.
• A shared external identifier. The same personal domain, the same business email, the same phone number listed on both.
• Matching biography details. Same employer, same city, same course of study, same niche. Two accounts both saying "cellist, Leeds" is worth more than two accounts both saying "photographer".
• Consistent timeline. An account created in 2015 that describes a job the person didn't start until 2021 needs explaining.

A useful rule: never merge on name alone, and never merge on a single signal. Two or three independent signals that agree, with nothing contradicting them, is a reasonable conclusion. One signal is a hypothesis.

Watch for the things that will fool you

Common names. If the name is common, everything above gets harder and your confidence should drop accordingly.

Parody, fan, and tribute accounts. Often use the real person's name, photo, and bio. Check for a disclaimer, low follower counts relative to the claimed identity, or a creation date long after the person became known.

Old accounts. People abandon profiles. An account that hasn't posted since 2017 may genuinely be theirs and tell you nothing about them now.

Deliberate separation. Many people keep professional and personal accounts apart on purpose, with different names and no links between them. That separation is a choice, and the fact that you could connect them doesn't mean you should act as though they're one public identity.

What you should not do

Some methods are off the table, and it's worth being explicit about why.

Do not attempt to access an account you don't own — that includes password guessing, recovery-flow abuse, and anything involving credentials from a data breach. This is unauthorised access, it's illegal in most jurisdictions, and no research purpose justifies it.

Do not use pretexting: creating a fake profile to befriend someone, or impersonating a recruiter or an old classmate to get information they wouldn't otherwise share. If your method requires deceiving the person, you have left research and entered manipulation.

Do not treat inferred connections as facts. "These accounts are probably the same person" is an honest sentence. Publishing that inference as a certainty about a named individual can do real harm if you are wrong, and you will sometimes be wrong.

Where automated tools fit

A tool can run the mechanical part far faster than you can: checking a handle across hundreds of sites, pulling public profile data, spotting mutual links, and scoring how well the evidence agrees. That's genuine time saved on a task that is otherwise tedious.

What a tool should not do is hide its reasoning. If it tells you an account belongs to someone, it should show you the public source that supports the claim so you can judge it yourself. A confident answer with no sources behind it is worth less than a hedged answer with five links, because only one of those lets you check the work.

For what it's worth, that's the line we try to hold in our own product: search public sources, show the source for every claim, and say "possible match" when that's what the evidence supports.

The limits worth remembering

Public-web research tells you about someone's public footprint. That is not the same as telling you about the person, and it is emphatically not a background check. Information gathered this way isn't assembled to the standard consumer-reporting law requires and must not be used to decide employment, credit, housing, insurance, or tenancy.

Use it to orient yourself before a meeting, to check that a contact is real, or to reconnect with someone you've lost touch with. Don't use it to build a file on a private individual who has done nothing but exist online.