Handle & DID Lookup

Open Handle & DID Lookup →

What it does

Every Bluesky account has a permanent ID, its DID (such as did:plc:…), and a handle that can change (such as alice.bsky.social or example.com). Handle & DID Lookup takes either one and shows you both, along with the facts behind them:

• The account as Bluesky shows it: name, avatar, and handle, with Open on Bluesky, Account Inspector, and Top Posts buttons for the same account.
• Identity: the DID and Handle, each with a copy button, DID found through (how the DID was found), and Account created, with the account’s age.
• Handle verification: whether the handle really belongs to this account, with a badge (Verified, Not verified, No handle, or No account), a sentence explaining the verdict, and what each check found.
• DID document: where the account’s DID document was read from, the handles it claims (Also known as), and the account’s server (PDS).
• Handle history: every handle the account has had, newest first, with the date of each change.

Use it to find a DID for another tool, to check whether a custom domain handle is set up correctly, to see how old an account is, or to find out why Bluesky shows an account as handle.invalid.

Before you start

• You do not need to sign in. The tool only reads public records.
• You need a handle, a DID, or a link to the account. The box accepts:
  • a handle, with or without a leading @, such as alice.bsky.social or example.com
  • a DID that starts with did:plc: or did:web:
  • an at:// identifier
  • a bsky.app profile link, with a handle or a DID in it
• Every lookup is a shareable link. The address holds what you looked up (?q=), so you can bookmark it or send it to someone.

Step by step

1. Open Handle & DID Lookup.
2. Type a handle, DID, or profile link in Handle, DID, or profile link. After two characters of a handle, matching accounts are suggested; pick one to look it up at once.
3. Choose Look up, or press Enter.
4. Read the result, from the account at the top down to its handle history.
5. To copy the DID or handle, choose the copy button beside it.
6. To start over, choose Clear in the box. It empties the box, removes the result, and removes the lookup from the address.

Options

The lookup has no filters or settings. What it shows depends on the account.

How the DID is found

For a handle, the tool looks for the DID the way Bluesky does, and DID found through says which one answered:

• DNS record of the handle: a TXT record at _atproto.<handle> that holds did=….
• HTTPS file of the handle: the file at https://<handle>/.well-known/atproto-did.
• Bluesky’s index: neither record named a DID, so the tool used the account Bluesky shows for that handle.

For a DID you type in, it says Entered, and the handle checked is the first one the DID document claims.

When a handle is Verified

A handle is Verified only when both are true:

1. The handle points to this DID, through DNS first or, failing that, HTTPS.
2. The account’s DID document claims the handle back.

Under the verdict, the DNS, HTTPS, and DID document rows say what each one found and where the tool looked. A DNS record verifies only when there is exactly one did= record.

Account created and handle history

Account created and Handle history come from the account’s public record at plc.directory, so they exist only for did:plc accounts. A did:web account shows Not recorded for did:web accounts. Dates are in UTC, as plc.directory records them.

What gets changed

Nothing: it only reads. It reads from:

• Cloudflare’s public DNS service, for the _atproto TXT record of the handle.
• The BskyKit server, for the HTTPS check. Most domains do not let a browser read their /.well-known/atproto-did file directly, so our server fetches that one file and returns the DID in it. This is the only request in any BskyKit tool that passes through our server. See Data on Your Device.
• plc.directory, for the DID document and handle history of a did:plc account. For a did:web account, the DID document is read from the domain’s /.well-known/did.json.
• Bluesky’s public API (AppView), for the name, avatar, and handle Bluesky shows, and for handle suggestions as you type.

The result stays only in the open tab. If you move to another BskyKit page and come back, the lookup is still there; a lookup still loading keeps going.

Undo

Nothing to undo: it only reads.

Limits

• Only did:plc and did:web DIDs can be looked up; Bluesky accounts use only those.
• The HTTPS check reads only https://<handle>/.well-known/atproto-did. It follows at most three redirects, and only redirects that stay on the same domain. It gives up after 3 seconds and reads at most 2 KB.
• Answers to the HTTPS check are kept for 5 minutes. If you just fixed the file, the old answer can show for up to 5 minutes. Timeouts and failed connections are not kept, so the next lookup tries again.
• The HTTPS check is limited to 10 requests in 10 seconds from one IP address. Past that, it is blocked for 10 seconds and the HTTPS row says The HTTPS check could not be completed.
• Account creation dates and handle history exist only for did:plc accounts.

Troubleshooting

“handle.invalid is not a real handle”

Bluesky shows handle.invalid for accounts whose handle does not verify, so it cannot be looked up. Look the account up by its DID or its bsky.app profile link instead. The result explains why the handle does not verify.

“… is not a handle”

The box got something that is not a public domain name, such as a single word, a local name, or an IP address. Enter a handle such as alice.bsky.social, a DID, or a bsky.app profile link.

“Bluesky accounts use did:plc or did:web DIDs”

The DID uses another method. Bluesky accounts use only did:plc and did:web, and the lookup reads only those.

Your own domain handle shows Not verified

Read the sentences under the verdict and the DNS and HTTPS rows:

• No did= TXT record. and The server answered 404.: neither record exists. Add the TXT record at _atproto.<your domain> or the /.well-known/atproto-did file that Bluesky gave you.
• Has 2 did= records; verification needs exactly one.: remove the extra TXT record.
• Names …, a different account.: the record holds another account’s DID. Replace it with your account’s DID, shown under Identity when you look up your DID.
• It redirects to another site, which does not count.: serve the file from the domain itself.
• The DID document claims …, not …: the account’s handle on Bluesky is set to another domain. Change the handle in Bluesky’s settings.

After a fix, DNS changes can take a while to reach Cloudflare, and HTTPS answers are kept for 5 minutes.

Bluesky still shows the old handle

The result can say Bluesky still shows @… It changes to @… after Bluesky’s next check. The handle verifies; Bluesky has not checked it again yet. The same goes for an account Bluesky shows as handle.invalid whose handle now verifies.

“plc.directory has no such DID.”

The DID is mistyped, or it was never created. If the result says This DID was deactivated or deleted at plc.directory., the account is gone.