Last updated:
🎵 TikTok OSINT
TikTok has a closed API, ephemeral content and an algorithmic feed — three things that break normal investigation method. Here's what actually works: the numeric ID that survives a rebrand, dorking a platform with no search, capturing with yt-dlp before it disappears, and why the follow list beats the videos.
Quick answer: Start with the URL — tiktok.com/@username. There is no public API and no useful native search, so discovery runs on Google dorks (site:tiktok.com "@handle"). Anchor on the numeric user ID, not the handle: handles change, the ID doesn't. Capture with yt-dlp --write-info-json because content is deleted constantly and the metadata is the evidence. The follow list is usually worth more than the videos. And browse logged out — TikTok has a profile-view feature that can tell people you looked.
Why TikTok breaks normal method
- Closed API. There is no sanctioned programmatic access for investigators. Every tool in this space scrapes, which puts terms-of-service exposure into your workflow whether you like it or not.
- Ephemeral content. Videos are deleted constantly and often leave no text shadow behind. Search-engine caches help far less than they do for text platforms.
- Algorithmic, not chronological. The feed is not a record. What you are shown is not what the account posted, in the order it posted. Never treat a scroll as a complete timeline.
- Scale. The US alone has the largest TikTok audience in the world at roughly 136 million users as of 2026 — the platform launched internationally in 2016 (as Douyin domestically in China). This is a mainstream identity surface, not a youth niche.
Anchor on the numeric ID
Every account carries a numeric user ID distinct from the @handle. The handle is cosmetic and changeable; the ID is permanent. If your subject rebrands to shake a tail, the handle moves and the ID does not — so record the ID at first contact, before anything else.
The ID surfaces in the page source and in the metadata that yt-dlp --write-info-json dumps. This is the same anchoring principle as Discord's snowflake IDs, with one important difference: a TikTok ID does not encode a creation timestamp. Discord hands you account age for free. TikTok does not — do not assume otherwise.
Discovery: dorking a platform with no search
TikTok's in-app search is built for content discovery, not investigation. Google has crawled a large share of profile and video pages, which makes it the better index:
site:tiktok.com "@username"
site:tiktok.com "Full Name"
site:tiktok.com/@username # everything under one profile
site:tiktok.com "keyword" after:2026-01-01
"tiktok.com/@handle" -site:tiktok.com # where it's been sharedThat last one matters more than it looks: TikTok links get pasted into Reddit, forums and Discord servers constantly, often with context the profile itself never gives you. Full operator set in our dorking reference.
Tools
| Tool | What it does | Note |
|---|---|---|
| yt-dlp | Download videos with metadata. The single most important tool here. | Free, open source. Use --write-info-json — see below. |
| Maigret / Sherlock | Take the handle, find it across hundreds of platforms. The strongest TikTok pivot, because handle reuse is near-universal. | Free. Our comparison |
| Holehe | Check whether an email is registered on TikTok (and 120+ other services). | Free. Confirms existence, not the profile. |
| Bouncer | Extracts the profile ID from a TikTok, Instagram, Facebook or X profile in one click. | Browser extension |
| Vidnice / TikTok viewers | Browse profiles and videos without an account. | Logged-out viewing — better tradecraft and better legal footing |
| WebPreserver / Pagefreezer | Forensic capture with timestamps and hashes for evidentiary use. | Commercial. Use when it may end up in court. |
| Reverse image / face search | Run the profile photo and video stills to catch cross-platform reuse. | Our reverse image hub |
yt-dlp --write-info-json --download-archive archive.txt "https://www.tiktok.com/@username"--write-info-json is the part people skip and regret. It preserves upload timestamp, description, numeric IDs and engagement counts alongside the file. A bare .mp4 with no provenance is weak evidence; the video plus its info JSON plus a hash is defensible. --download-archive keeps a ledger so re-runs only fetch what's new — which also tells you what has been deleted since last time. That delta is often the finding.
What to actually read on a profile
- The follow list, first. If it's public, it beats the videos. People curate content and neglect follows — geography, language community, school, employer and family fall out of it.
- The bio. Cross-platform handles, Linktree, email, business links. Every one is a pivot off TikTok. Take handles to username search, emails to email OSINT.
- The sound page. Every video using a track is listed on that track's page — a reliable route into the same community, event or trend from a different angle.
- The video content itself. Backgrounds, reflections, landmarks, on-screen text, geotags. Standard geolocation tradecraft applies; a two-second pan often locates someone better than anything they typed. See AI dorks to geolocate a photo.
- Their own comments. People are markedly less guarded in replies than in posts.
- Cross-post the profile photo through reverse image search — TikTok avatars get reused on Instagram and X constantly.
Frequently asked questions
Can you find someone's TikTok by phone number or email?
Not directly — TikTok has no public lookup by phone or email, and no public API you can query for it. The indirect route is the one that works: if the person reused the handle elsewhere, run it through Maigret or Sherlock across hundreds of sites; if you have an email, Holehe will tell you whether it is registered on TikTok, though it will not hand you the profile. TikTok is a platform you pivot *to* from another identifier, rarely one you start at.
How do I find a TikTok profile by username?
Go straight to the URL: tiktok.com/@username. That is the fastest check and it costs nothing. If the handle is wrong or changed, dork it instead — site:tiktok.com "@handle" or site:tiktok.com "full name" — because Google has crawled a large share of TikTok profile and video pages even though TikTok itself offers no useful search.
What is a TikTok user ID and why does it matter?
Every account has a numeric user ID separate from the @handle. The handle can be changed at any time; the numeric ID cannot. That makes the ID the correct anchor for an investigation — a subject who rebrands their handle to evade you keeps the same ID. It appears in page source and in API responses that tools like yt-dlp surface in their metadata output. This is the same principle as Discord's snowflake, but without an embedded creation timestamp.
How do I download TikTok videos for evidence?
yt-dlp is the standard and it is free and open source. Critically, use it with --write-info-json so you capture the metadata alongside the file rather than just the video: yt-dlp --write-info-json --download-archive archive.txt "https://www.tiktok.com/@username". The info JSON preserves upload timestamp, description, numeric IDs and engagement counts. A video file with no metadata is much weaker as evidence than a video plus its provenance record.
Is TikTok OSINT legal?
Viewing public profiles and videos is lawful — it is public content published by the user. The complications are TikTok-specific: the platform has no open API, so most collection tools scrape, and scraping while logged in puts you in breach of terms you accepted. Logged-out collection of public pages sits on the strongest footing under hiQ v. LinkedIn. If your subject is in the EU or UK, GDPR applies to their personal data regardless of it being public. See our guide on whether OSINT is legal.
Why is TikTok harder to investigate than other platforms?
Three reasons stack up. The API is closed, so there is no sanctioned programmatic access. Content is ephemeral — videos are deleted constantly, and unlike a tweet there is often no cached text version to fall back on. And the feed is algorithmic rather than chronological, so what you see is not a complete or ordered record of what the account posted. Together these make archiving-first the only sensible method: capture now, analyse later, because it may not be there tomorrow.
Can I see who someone follows on TikTok?
Often yes, if the account is public and has not hidden its following list — and it is one of the most useful things on the profile. Following lists reveal geography, language community, employer, school and family long before the videos do. People curate their content carefully and their follow list barely at all, which is exactly why it is worth more.
What can I get from a TikTok video itself?
More than the caption. Look at: background audio (the sound page shows every other video using that track), on-screen text and geotags, reflections and landmarks for geolocation, the account's own comments, and the video description including hashtags. Bellingcat-style geolocation applies directly here — a two-second background pan often locates someone better than anything they wrote.
Does TikTok notify people that I viewed their profile?
TikTok has a profile view history feature that can show users who viewed their profile, and it is enabled for some users. Treat it as live: if you are logged in, assume the subject may be able to see that you looked. This is exactly the operational reason to browse logged out — it is better tradecraft and a stronger legal position at the same time. See our OPSEC guide.