Username exposure: how one handle connects your accounts, and how to break the link
Breach / exposure. Updated 2026-09-13. About 5 minutes to read.
Search every username you have used, then give any account you want kept private a new handle, a new avatar and its own email address.
A username feels harmless because it is not your real name. The problem is reuse. If you have used the same handle on a gaming platform, a forum, Reddit, GitHub and an old Instagram account, anyone can search that handle across hundreds of sites in a minute and join the pieces together. One of those accounts usually leads to a real name, a photo or a city.
This is how many doxxing cases start, and it is also how scammers build convincing messages about your hobbies and friends. The fix is not to delete your whole online life. It is to find where your handles appear, decide which accounts should stay connected to you, and separate the rest.
How a username links accounts
Breaches and scrapes make this worse because they pair usernames with email addresses. In October 2020, data scraped from the avatar service Gravatar was shared on hacking forums, and Have I Been Pwned reports that 114 million email addresses were recovered alongside names and usernames. A scrape of Twitter data from 2021, circulated in early 2023, linked more than 200 million email addresses to public profiles and usernames.
The same exact handle on several sites, or a small variation such as the handle plus your birth year.
The same profile photo or avatar, which a reverse image search can match across sites.
Links in your bio, such as a personal website, a streaming channel or another social account.
An email address exposed next to the username, for example in a scraped dataset or in public code commits.
Old forum posts and gaming profiles that mention your first name, school, city or workplace.
People-search sites such as PeekYou, which specialise in collecting social handles and connecting them to real names.
Check your own username footprint
List every username, gamertag and handle you have used, including old ones from school, gaming and forums. Your password manager's list of saved logins is a good memory aid.
Search each handle with WhatsMyName at whatsmyname.app. It is a free, community-maintained project that checks whether a username exists on more than 700 sites.
If you are comfortable with a command line, run Sherlock, an open-source tool that checks more than 400 social networks.
Search each handle in quotes on Google and Bing, and add words like your city or first name to see whether they are already connected.
Run a reverse image search on each avatar you have used with Google Lens or TinEye.
Check each of your email addresses with the free email breach check. Breaches that list usernames as exposed data show where a handle and an email address have already been paired.
Search your name and handles on PeekYou and remove any listing using the data broker opt-out tracker.
Do the search from a private browser window and do not log in. You want to see what a stranger sees, not what the site shows its account holder.
Break the link between accounts
Sort your accounts into two groups: public identity accounts that you are happy to connect to your real name, such as LinkedIn, and private accounts that should not lead back to you.
Change the username on each private account where the site allows it. Some sites, including Reddit, do not let you change a username, so the only way to break the link is a new account.
Give each private account a unique avatar that is not a photo of you and has not been used anywhere else.
Remove bio links, cross-posted content and connected accounts that point from a private account to a public one.
Move each private account to its own email alias, so a future breach does not pair it with your main address.
On GitHub, open Settings, then Emails, and turn on Keep my email addresses private so new commits use a no-reply address. Commits made before the change still show your old email.
Delete old accounts you no longer use, starting with any that show the same handle as an account you want to keep private.
What changing a username does not fix
If you are being targeted, for example harassed after someone linked a pseudonymous account to your real name, prioritise safety over tidiness. Lock down or deactivate the exposed accounts, report the harassment on each platform, remove your address and phone number from people-search sites, and keep records of everything in case you need to go to the police.
Archived copies of old profile pages can remain in web archives and search engine caches for some time.
Datasets already scraped or breached keep the old username and email pairing permanently.
Posts you made under the old handle may still be quoted by other people or show in replies.
People who already connected your accounts will still know.
Habits that keep handles separate from now on
Use a different username for anything you want kept private, and avoid patterns such as the same word with different numbers.
Never reuse a username that you also use as an email address, because it hands the other half of the pair to anyone who finds it.
Keep gaming, dating and hobby forum handles separate from your professional identity.
Let your password manager store a unique username as well as a unique password for each site.
Run your main handles through WhatsMyName once a year as part of a privacy check.
Frequently asked questions
Can someone find my real name from my username?
Often, if the username is reused. A search across sites can find an account with a real name, a photo, a linked profile or an email address. A unique username that appears only on one site is much harder to trace.
Is it safe to type my username into a username search site?
The tools covered here check public profile addresses on other sites and do not need your password. Never enter a password into a username checker. As with any website, the service can see what you searched for.
Should I use a different username on every site?
Not necessarily on every site. Use one consistent handle for accounts that are meant to represent you publicly, and unique handles for anything you want kept private or separate, such as dating, gaming or support forums.
Can I check whether my username was in a data breach?
Have I Been Pwned searches by email address and phone number, not by username. Check your email addresses and look at the exposed data for each breach. If usernames are listed, assume your handle and email are now linked in that dataset.