Usernames and emails
One or more usernames or email addresses per run, or lists loaded from files.
Blackbird OSINT Review: Username and Email Account Search
Blackbird OSINT searches cover two starting points instead of one: a username or an email address. Blackbird runs the community-maintained WhatsMyName checks for usernames, adds a short list of email checks, and can ask a free AI service to summarize what the results suggest. This review looks at what each part does, and at the license, maintenance and platform-terms questions to settle before you rely on it.
- Free, Python, on GitHub
- WhatsMyName data plus 16 email checks
- PDF, CSV and JSON export
- Based on documentation, not our own runs
Short answer
Blackbird is a free Blackbird OSINT command-line tool on GitHub that searches 600+ platforms for accounts by username or email. It uses WhatsMyName data for usernames, exports PDF, CSV and JSON reports, and offers free AI profiling with a daily limit. It suits technical users. On 10 October 2026 the repository showed no license file and no versioned releases.
What Blackbird OSINT Does
It checks which sites have an account for a username or email address, reports the hits, and can summarize them with an AI service.
The README describes Blackbird as a tool that "combines fast username and email searches across more than 600 platforms with free AI-powered profiling", built on community projects such as WhatsMyName (GitHub repository). It is developed by Lucas Antoniaci, runs from the command line after cloning the repository and installing its Python requirements, and is documented on a separate GitBook site (Blackbird docs).
On 10 October 2026 the repository showed about 7,900 stars and 647 commits. This review is based on the repository, its source and its documentation as published on that date.
Blackbird Features
Username and email search, filters and permutations, several export formats and an optional AI summary.
Permutations
Generates username variations from several elements when an exact handle finds nothing.
Query the site list
Limit checks by name, category or detection fields, and exclude adult sites with one flag.
PDF, CSV, JSON
Reports in three formats, plus an option to dump the raw responses of found accounts.
Proxy and limits
Proxy support, request timeouts and a cap on concurrent requests.
Free AI profile
A summary of the sites found, free with an undisclosed daily limit after registering a key.
Where Blackbird's Results Come From
Username checks come from WhatsMyName; email checks come from a separate list of 16 sites maintained in the Blackbird repository.
For usernames, Blackbird reads the WhatsMyName dataset and updates its copy of the site list unless told not to (WhatsMyName). Its accuracy for usernames is therefore largely the accuracy of those community entries, and the README's claim of "low false positive rates" rests on that work. The "600+" figure comes from WhatsMyName's own count, which stood at 717 entries on 10 October 2026.
Email coverage is much narrower. The repository's email data file listed 16 services on 10 October 2026, including Gravatar, Adobe, Duolingo, Chess.com, Notion, Spotify and Strava (email-data.json). A negative email result therefore says little: most services are not checked at all.
The AI Profile: Useful Summary or Guesswork?
It summarizes which kinds of sites an account appears on. It cannot know who the person is, and its inferences should be treated as hypotheses.
According to the documentation, only the names of the discovered sites are sent to the AI service, nothing personal is sent, no data is retained after the response, and use is free within a daily quota (Blackbird AI docs). The documentation does not say who operates the service.
A list of site names supports only broad inferences, for example that an account holder is active in gaming or software communities. That inference also inherits every false positive in the underlying search: if a third of the hits belong to other people, so does a third of the "profile". The project's own documentation warns that Blackbird "can make mistakes" and that results should be checked.
Blackbird Pricing, License and Maintenance
Free to use. The repository showed no license file and no tagged releases on 10 October 2026, which matters for reuse and for judging maintenance.
| Item | Status on 10 October 2026 | What it means for you |
|---|---|---|
| Price | Free; AI features free with a daily limit | No paid tier is offered in the repository or docs |
| License | No license file in the repository and none shown on the GitHub page | Without a stated license, default copyright applies; get advice before redistributing or modifying the code |
| Releases | None published on GitHub | You run whatever is on the main branch; record the commit you used |
| Dependencies | Pinned to versions released in June 2025 | Check for security updates before installing in a work environment |
| Language | Python | Install in a virtual environment or container |
Checked on the repository and its requirements file. The README also carries a disclaimer that the program is for educational purposes only and should not be used without permission.
Instagram Session Mode and Other OSINT Risks
The documented Instagram feature uses your logged-in session cookie, which raises platform-terms and account risks. Email lookups raise their own privacy questions.
The advanced documentation explains how to extract more Instagram metadata, including obfuscated email and phone details, by copying the session cookie of a logged-in Instagram account into a configuration file (advanced usage). Instagram's terms restrict retrieving information without permission, especially by automated means (Open Terms Archive). Using that mode can breach the platform's terms, put the account at risk of suspension, and expose a live session token on disk. We do not recommend it for professional casework.
Email addresses are more directly identifying than handles, and a list of services tied to an email can reveal habits and health or fitness use. Under the GDPR, searches about an identifiable person need a lawful purpose and should collect no more than that purpose requires; public availability does not remove that protection (joint statement on data scraping). Never use Blackbird to locate, monitor or harass a private person.
Blackbird or WhatsMyName.app?
For username checks they share the same data. Blackbird adds email checks, exports and automation; the web app needs no installation.
If you only need a quick username check, the free WhatsMyName web app gives you the same underlying detections in a browser. Blackbird is the better fit when you want to batch many usernames or emails, filter checks precisely, or produce a PDF for your file. Sherlock and Maigret use their own site lists, so running one of them alongside Blackbird gives a second, independent set of checks. Our OSINT tools guide covers tools for other tasks.
Who Blackbird Suits for OSINT Work
Technical users who want WhatsMyName checks plus basic email lookups from the command line, and who will verify results themselves.
Good fit: security teams checking where staff or brand emails and handles are registered, researchers who want filtered, exportable runs, and individuals reviewing their own footprint.
Poor fit: organizations that need a clearly licensed, versioned tool for production use; anyone who needs broad email coverage; and anyone tempted to treat the AI profile as a finding.
Need the Answer, Not the Tool?
When a username or email matters to a fraud, harassment or hiring decision, you need verified links and a documented method.
Our username investigations test every candidate account against independent signals and grade each link, and our social media investigations examine confirmed accounts in context. Where the starting point is an email address, we use lawful sources and do not log into anyone's accounts. Work is quoted at a fixed price after written scoping, and a senior analyst reviews every report. Explore our OSINT services for investigations.
Have a Handle or Email You Need Explained?
Send the identifier and the decision it affects. We reply with a scope, a fixed quote and a delivery date.
Blackbird OSINT FAQ
I found the Blackbird OSINT tool on GitHub — what does it actually search, how many platforms does it cover, and do I have to pay for anything?
Blackbird searches for accounts by username or email address. Username checks use the WhatsMyName dataset, which the README describes as 600+ sites and which held 717 entries on 10 October 2026; email checks cover 16 services listed in the repository. The tool is free, and its AI summary is free within a daily limit (repository).
Our company wants to build Blackbird into an internal monitoring script — can we modify and redistribute it, given what the repository says about its license?
Be careful. On 10 October 2026 the repository had no license file and GitHub showed no license. Without a license grant, default copyright applies, which generally does not permit copying, modifying or redistributing the code. Ask the developer for written permission or have counsel review the position, or use a clearly licensed alternative such as Sherlock or Maigret, both under the MIT license.
I ran Blackbird with the AI option on a username and it described the person's interests and personality — how much of that should I believe?
Very little without verification. The AI receives only the names of the sites where hits were found, so its description is an inference from a list of site names. If some hits belong to other people with the same handle, the profile blends them. Use it, at most, as a prompt for what to check, and confirm every account before drawing conclusions.
The Blackbird docs explain adding my Instagram session cookie to get hidden email and phone details — is that legal and safe to use for my investigation?
We advise against it. It uses your logged-in account to retrieve data in an automated way, which Instagram's terms restrict (Open Terms Archive), and it can lead to account suspension. It also leaves a live session token in a file on disk. Whether it breaks the law depends on your jurisdiction and purpose, but the platform-terms and evidential risks make it unsuitable for professional work.
Blackbird found no accounts for an email address I'm checking — can I conclude that the person behind that email doesn't use any online services?
No. Blackbird checks only 16 services for emails, so most platforms are never queried. Services also change how they respond, and checks can be blocked. A negative result means none of the listed checks returned a hit at the time of the run, nothing more. Breadth for emails requires other lawful sources and methods.
I'm an HR manager — would it be appropriate to run job applicants' personal email addresses through Blackbird to see which sites they use?
Generally no. It reveals lifestyle information unrelated to the job, may surface special category data, and is hard to justify as necessary and proportionate under the GDPR. In the US, screening by a third party for employment can also trigger the FCRA's notice and consent rules. Use a documented, lawful screening process instead.
Sources and Notes
- Blackbird repository and README
- Blackbird documentation
- Blackbird documentation: AI
- Blackbird documentation: advanced usage
- Blackbird email data file
- Blackbird requirements file
- WhatsMyName repository
- Open Terms Archive: Instagram terms on data retrieval
- General Data Protection Regulation (EU) 2016/679
- FTC: Using consumer reports, what employers need to know
- Joint statement on data scraping by data protection authorities (2023)
Sources checked 10 October 2026. Figures about third-party firms and tools are as published by them or by the cited source on that date.