Does Osintgram still work in 2026?

The short answer

Partly, and the split is clean. Clone the repo, put an Instagram username and password into config/credentials.ini, and in 2026 you will most likely never get past the login line. Put a HikerAPI token into that same file instead and the tool never authenticates to Instagram at all: it calls a paid third-party API, and that is the path the project itself now steers people toward.

Everything below comes from three places: the repository source, the GitHub API as of 8 August 2026, and dated bug reports on the project's own tracker. We did not run the CLI against a live Instagram account. Every terminal string quoted here is either read from the source or copied from a dated issue, cited with its number.

What actually broke

Osintgram is a thin command-line wrapper. It does not talk to Instagram on its own terms: requirements.txt pins instagram-private-api==1.6.0 and hands the entire authentication problem to that library. Osintgram's health is really that library's health, and the library has been standing still for two years.

ping/instagram_private_api was last pushed on 6 May 2024. It works by impersonating Instagram's mobile app against the endpoint https://i.instagram.com/api/{version!s}/. Instagram took that endpoint down. Issue #791, opened 3 May 2023, is where the community collectively noticed: "Lately, we all discovered that Osintgram is not working anymore." Nothing has repaired the legacy code path since; the fix that eventually arrived was a different backend, not a repair.

Three years on, the failure has a readable signature. This is the paste from issue #2627, filed 4 March 2026:

Attempt to login...
ClientError checkpoint_required (Code: 400, Response:
{"message": "checkpoint_required",
 "checkpoint_url": "https://i.instagram.com/web/unsupported_version/",
 "lock": false, "flow_render_type": 0, "status": "fail"})

Read the checkpoint_url. It is not a security checkpoint you clear by confirming an email. It points at /web/unsupported_version/. Instagram is rejecting the client version the library announces, not your credentials. The same reasoning covers bad_password: the author of PR #2660, opened 12 June 2026, writes that it "is actually a bot detection, not wrong password", and the whole point of that PR is to stop people retyping a password that was never wrong.

There is a second-order effect worth knowing about, because it explains why the tool seems to break overnight for people who changed nothing. The legacy backend caches its session in config/settings.json and reuses it on later runs, so an old login can keep working on stale cookies long after fresh logins stopped succeeding. When those cookies expire you get ClientCookieExpiredError/ClientLoginRequiredError, and the code immediately attempts a full re-authentication, straight into the wall above. Clearing the cache with the -C flag does not fix anything; it just brings the failure forward.

The 2026 error inventory

These are the login-stage failures people are actually reporting, with the dates taken from the issues themselves rather than from a blog's publish stamp. If your terminal printed Attempt to login... and then one of these, you are looking at the Instagram side of the problem.

For scale: searching the tracker returns 66 issues mentioning challenge_required, 55 mentioning JSONDecodeError and 7 mentioning checkpoint_required, against 98 for ModuleNotFoundError. That last number is the other half of the story, and it is a different problem entirely.

The distinction matters when you triage your own failure. If pip refused with error: externally-managed-environment, or the traceback ends in ModuleNotFoundError, the tool never reached Instagram and you have an install problem. See how to install Osintgram, or the Kali-specific version. If you got as far as Attempt to login... and then a ClientError, you are in the table above, and reinstalling will not move you out of it.

Is the project abandoned?

Not formally. The repository is public, GPL-3.0 licensed and explicitly not archived, so issues and pull requests still open. But the maintenance signals are worth reading together rather than one at a time.

Laid out on a timeline, the shape of the project is easier to see:

1. 7 June 2019: the repository is created.
2. 17 May 2021: release 1.3 is tagged. It is still the most recent release.
3. 3 May 2023: in issue #791, the community notices the tool has stopped working.
4. 6 May 2024: instagram-private-api, the library the default path depends on, receives its last push.
5. 29 July 2025: the commit "Integration with HikerAPI" lands on master.
6. 11 August 2025: PR #2586 is merged, completing the HikerAPI backend.
7. 25 August 2025: the last commit on master to date.
8. March to June 2026: the tracker fills with checkpoint_required, block_eu_user_login_in_old_app and bad_password.

The honest read: this is not a dead project, but it is not a maintained one either. Someone cared enough in mid-2025 to graft on a working backend, and then the lights went out again. Nobody is triaging 828 open issues, nobody is merging the 55 open pull requests, nobody has cut a release in five years, and the startup banner still announces "Version 1.1 - Developed by Giuseppe Criscione" while the newest tag says 1.3. Plan accordingly: if the HikerAPI path breaks tomorrow, there is no evidence anyone will fix it quickly.

This also tells you how much to trust the guides you will find. The pages currently ranking for Osintgram installs are dated anywhere from 2020 to 2025, and most were written before all of this: before the endpoint takedown, before Kali locked pip behind PEP 668, before the HikerAPI backend existed. A tutorial that never mentions hikerapi_token is describing a version of the tool that no longer connects, however clean its commands look.

The HikerAPI path, and what it costs you

In late July 2025 the project grew a second backend. main.py now makes a single decision at startup, before any Instagram traffic happens:

if config.getHikerToken():
    api = HikerCLI(args.id, args.file, args.json, args.command,
                   args.output, args.cookies)
else:
    api = Osintgram(args.id, args.file, args.json, args.command,
                    args.output, args.cookies)

src/config.py defines getHikerToken() as the hikerapi_token field of config/credentials.ini falling back to the HIKERAPI_TOKEN environment variable. If either is set, main.py builds HikerCLI, which never reads a username or password. The two blank fields therefore stay blank, and no Instagram login is attempted.

[Credentials]
username =
password =
hikerapi_token = <your token>

You can tell which backend you got from the first line of output. The legacy path prints Attempt to login...; the HikerAPI path prints Connect to HikerAPI... and drops the [FOLLOWING] / [NOT FOLLOWING] tag from the target banner, because there is no logged-in account to compare against. That single line is the fastest way to check that your token was actually picked up.

The README points you at hikerapi.com/tokens and states that the "first 100 requests are free after registration and confirmation of your tg". After that it is a commercial pay-per-request API. Three things follow from that, and none of them are in the tutorials still ranking for this query.

• You are paying a third party, and telling them who you research. Every target username you query goes through HikerAPI's infrastructure rather than your own session. For some investigative work that is a disclosure problem on its own.
• The HikerAPI path has its own breakage. Issue #2664, opened 21 June 2026, is titled "Handle alternate HikerAPI user response formats": the response shapes the code expects are not the only ones being returned.
• Some commands are dead on this path by design. photodes on the HikerAPI backend does nothing but print Instagram has disabled this functionality. (that is what the source says, verbatim).

Will it get your Instagram account banned?

The project answers this itself. The README carries a red warning: "It is advisable to not use your own/primary account when using this tool." That is not boilerplate; it is an admission of how the legacy path behaves.

Mechanically, the default backend logs in as a real account and then behaves like nothing a human would. The four contact-harvesting commands make one extra API call per follower, and there is no sleep or backoff anywhere in those loops. When Instagram objects, you get Error: Instagram blocked the requests. Please wait a few minutes before you try again. on those commands, or an unhandled urllib.error.HTTPError: HTTP Error 429: Too Many Requests on followers and followings, which lack the handler entirely.

The scale at which that happens is documented, in volumes rather than minutes. Issue #366 shows a run cut off after 41,643 collected follower records, and the crash that followed the throttle message discarded every one of them; issue #342 reports the scan being blocked at around 35,000. No verified wall-clock timing exists for any of this, so do not trust a guide that promises you a follower dump in some number of minutes. Community patch #657 exists precisely because the upstream loops have no delay in them at all.

challenge_required is the account-level version of the same objection: Instagram deciding the session looks automated. Issue #1638 documents that the tool frequently triggers it, with temporary locks or permanent loss of the account used as the reported consequences. The README's own FAQ tells you to open the challenge link and complete it, which works right up until it does not.

What still works, and what to use instead

There are four ways people actually run this thing, plus one way to skip it. Their 2026 status is not the same.

Two footnotes on that table. The Docker route is not the isolation win it looks like: the Dockerfile does COPY config/ /home/osintgram/config, so whatever sits in credentials.ini at build time is baked into the image, which you must therefore never push anywhere. And the v2 beta branch, which a few guides still recommend, predates the HikerAPI work entirely; its requirements.txt drops hikerapi and pins requests==2.24.0, so all it has is the path that no longer works.

Even on a backend that authenticates, "works" is per-command. photodes calls the long-retired https://www.instagram.com/<target>/?__a=1 endpoint on the legacy path and is a no-op on the HikerAPI one. addrs usually answers Sorry! No results found :-( because geotagged posts are rare now. That is a successful request returning nothing, not a failure. The full command reference marks which is which. And against a private account your logged-in session does not follow, 19 of 21 data commands refuse outright; by design only info and propic are ungated, which is the private-accounts question in one sentence.

If what you actually need is a report on a public profile rather than a Python project to maintain, a hosted lookup removes the failing component: you never log into Instagram, so checkpoint_required cannot happen to you, and there is no venv, no credentials.ini and no burner account to lose. That is not a claim about the CLI being bad; it is the same public data, reached without the part that broke.

The 2026 verdict

Osintgram is not dead, and it is not fine. The default install (the one every tutorial from 2020 to 2025 describes) is dead in practice: the library underneath it stopped being updated in May 2024, the endpoint it depends on is gone, and Instagram now answers its login handshake with checkpoint_required and an unsupported_version URL. No configuration change on your machine fixes that.

The HikerAPI backend is a genuine, current, documented path that removes the login problem by removing the login. It costs money past 100 requests, it routes your targets through a third party, and it has its own open bug about response formats. If you want the CLI specifically (for scripting, for reproducibility, for an offline output folder), that is the version to install, and the install guide covers it. If you only wanted the data, the CLI was never the point.