tookie-osint enumerates username registrations across hundreds of websites for authorized OSINT investigations, offering a beginner-friendly alternative to Sherlock for footprinting analysts.

tookie-osint occupies the same niche as the venerable Sherlock: give it a username, and it queries a long list of websites to determine whether an account with that handle exists. The README is unusually candid about its own efficacy, claiming success at locating accounts "almost 80% of the time," which is a useful admission for anyone calibrating expectations — no username enumerator is exhaustive, and gaps in site coverage or anti-bot defenses will always leave blind spots. With roughly 2,900 stars, an MIT license, and inclusion in the official Kali Linux package repository (sudo apt install tookie-osint), the project has crossed the threshold from hobby script to distribution-grade tool. That packaging milestone matters for practitioners who want a maintained, reproducible install rather than a git clone of unknown provenance.

The README announces that V4 is a complete rewrite — "100% from scratch for ultimate performance" — which tells you the codebase has been through at least one full architectural reset. Rewrites of this kind usually signal that the original site-checking engine became unmaintainable, and the new version leans on concurrency to parallelize the hundreds of per-site probes. The feature checklist confirms this: Threading and Automation are both marked complete, as are Headless mode and Scripting support. For an operator, threading is the difference between a fifteen-minute sweep and a two-minute one, and headless mode means the enumeration can run on a headless VPS or inside a larger scripted pipeline without a display.

Under the hood, the requirements list is short and revealing: colorama for terminal styling, requests for plain HTTP probing, argparse for the CLI surface, and selenium plus webdriver-manager for sites that render accounts only after JavaScript execution. This two-tier architecture is the standard pattern for username enumeration. Fast requests-based checks handle the majority of sites where a profile URL either returns 200 or 404, while the selenium fallback covers platforms whose profile pages are single-page applications or that actively fingerprint simple HTTP clients. The cost is real: browser automation is slow and noisy, which is presumably why threading matters so much to the project's performance claims.

Installation paths are unusually broad. Beyond the Kali package, the README documents a sudo ./install.sh flow after git clone, a dpkg package from GitHub releases for Debian-based systems, and a manual python3 -m venv route ending in python3 brib.py — that entry-point filename is a quirk worth remembering, since you will need it if you run from source rather than a package. The tested-OS table is one of the most extensive I have seen for a tool of this class: macOS Monterey, Windows 10 and 11, Termux 0.118, Kali, Parrot, Ubuntu, Debian, Alpine, Fedora, Arch, Manjaro, and Void all appear. Termux support in particular signals that the project expects to be run from Android devices in field-OSINT scenarios.

The roadmap section is a candid window into project priorities. Completed items include Webscraper, Data Webscrapping, CSV export, a Restore File mechanism, Web Hooks (in beta), and the accuracy improvements already mentioned. Planned features read like a wish list for a full recon framework: Tor Searching, a WebUi, Custom Plugins, a GUI, Phone Number OSINT, and Email OSINT (in beta). The plugin roadmap deserves attention — a plugin architecture would let investigators add niche regional platforms without forking the tool, which is currently handled by the README's explicit invitation to open pull requests requesting new sites.

The restore-file feature deserves more comment than the README gives it. Long enumeration runs fail — networks drop, sites time out — and a checkpoint file that lets you resume a partial sweep is what separates tools designed for real engagements from demo-ware. Combined with CSV output, this points toward repeatable, documentable workflows: run the sweep, export the results, attach the artifact to your authorized-assessment report. The beta Web Hooks support suggests results can also be pushed to an external channel as they are found, useful for long-running unattended scans, though the README does not specify which webhook formats are supported.

The author is explicit that the tool's purpose is educational: "created to help new programmers or pentesters get into the world of OSINT," with a goal of keeping the codebase approachable for newcomers. That framing is consistent with the project's contribution model — forks and pull requests are the sanctioned way to add sites or features — and with the unusually wide localization effort. The README itself is translated into seventeen-plus languages, from Japanese and both Chinese variants to Farsi, Arabic, Hebrew, and Hindi, with a note that translations for V4 are still catching up. This is rare in the OSINT tooling space and explains some of the project's international press coverage.

From a tradecraft perspective, the telemetry this tool produces is its most operationally significant property. Every query originates from your IP unless you add anonymization yourself, and the README indicates Tor Searching is planned but not yet implemented. Each targeted platform sees a profile-URL probe, and the selenium traffic carries browser-automation fingerprints that sophisticated platforms can detect. For authorized engagements this is usually acceptable — you are querying public profile pages, not authenticating — but investigators who need to preserve operational anonymity should not assume the tool handles it for them. Defensively, blue teams can watch for bursts of non-existent-username lookups from a single source as a signal of reconnaissance against their user base.

Where tookie-osint fits in an authorized workflow is straightforward: it is the first-pass username enumerator you run during the OSINT phase of a pentest with a defined scope and client sign-off, or during brand-abuse monitoring to find impersonator accounts squatting on a company's executive handles. Its accuracy claims, threading, and packaging maturity make it a credible alternative to Sherlock, while its roadmap shows ambition toward becoming a broader recon toolkit. As with any enumeration tool, the results are the beginning of analysis, not the end — a found account still needs verification and relevance assessment before it enters a report.

The community footprint reinforces the project's seriousness: an active issues tracker, a Discord server for support, official video tutorials, and third-party writeups across several languages. Partnerships with related projects like X-OSINT and the GHPM package manager suggest the author is building an ecosystem rather than a one-off script, and sibling tools Bibi-Bird and Open-Wrecks are linked for those wanting the wider fleet. For practitioners selecting a username-enumeration tool today, tookie-osint earns its place on the strength of its V4 rewrite, its Kali packaging, and its unusually honest self-assessment — just remember that its output is public-data reconnaissance, and its use belongs squarely inside authorized, scoped engagements.

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.

Related coverage

• gosearch for mapping usernames across 300+ sites and breach corpora


• Discover for automating recon, scanning and reporting on authorized engagements


• FinalRecon for fast all-in-one web reconnaissance