# Holehe vs SocialScan vs UhOh365: Complete OSINT Email Checker Comparison

> Compare Holehe, SocialScan, and UhOh365 OSINT email checkers. Discover Holehe's 120+ services, async execution, and JSON output for comprehensive investigations.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: comparison
- Published: 2026-08-18

---

**Holehe is the most comprehensive open-source email OSINT tool, offering async execution, 120+ services, and structured JSON output, while SocialScan provides ~30 services with synchronous requests and UhOh365 focuses narrowly on ~15 Microsoft services.**

All three are Python-based utilities for discovering email registrations across online platforms. This analysis examines their architectural differences, performance characteristics, and code-level implementations to help security researchers and OSINT investigators choose the right tool.

---

## Architecture and Execution Model

### Holehe: Async-First Modular Design

Holehe leverages **Python 3 async I/O** through `httpx` and `trio`, enabling concurrent checks across all services. The core orchestration resides in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), which loads and executes modules in parallel.

Each service is encapsulated as an **async function** under `holehe/modules/*`. For example, [`holehe/modules/social_media/twitter.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/twitter.py) implements the email registration check with this structure:

```python

# From holehe/modules/social_media/twitter.py (lines 5-37)

async def twitter(email, client, out):
    # Uses Twitter's email availability endpoint

    # Sets frequent_rate_limit=False for this service

    # Returns uniform dict with exists, method, rateLimit fields

```

The modular approach means adding a new service requires only:
1. Creating a new async function file in the appropriate category folder
2. Updating [`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py) with the import
3. No modifications to core execution logic

### SocialScan: Synchronous Monolithic Script

SocialScan takes a **single-file approach**. The entire tool operates as one script iterating through a hardcoded service list using the synchronous `requests` library. Email checks execute sequentially, significantly impacting performance for large target lists.

No abstraction layer separates service implementations—each check embeds directly in the main loop.

### UhOh365: Narrow Focus, Similar Sync Pattern

UhOh365 follows SocialScan's pattern but with tighter scope. It targets primarily Microsoft ecosystem services (Outlook, Office365, Azure AD) through [`uhoh.py`](https://github.com/megadose/holehe/blob/main/uhoh.py) using synchronous `requests`. The ~15 service checks live directly in the central script without modular separation.

---

## Service Coverage and Detection Methods

| Feature | Holehe | SocialScan | UhOh365 |
|---|---|---|---|
| **Services** | >120 | ~30 | ~15 |
| **Categories** | Social media, mail, CRMs, forums, dating, etc. | Major social networks, some mail | Microsoft/Office365 focus |
| **Detection Methods** | register, login, password_recovery | password_recovery, sign-up | password_recovery |
| **Method Metadata** | Explicit `method` field in output | Not tracked | Not tracked |

Holehe's detection diversity matters for accuracy. The `method` field in output distinguishes:
- **`register`** — signup endpoint email availability
- **`login`** — authentication attempt response analysis  
- **`password_recovery`** — "forgot password" flow behavior

This granularity aids forensic validation and false-positive assessment.

---

## Rate Limit Handling

### Holehe: Built-In Throttling Awareness

Every module declares `frequent_rate_limit` (boolean) and catches exceptions to populate a `rateLimit` boolean in results. Example from [`twitter.py`](https://github.com/megadose/holehe/blob/main/twitter.py):

```python

# Pattern seen in multiple Holehe modules

frequent_rate_limit = False  # Service-specific flag

try:
    # ... request logic ...

except Exception:
    # Rate limit detection

    out.append({
        "name": "twitter",
        "rateLimit": True,
        # ... other fields ...

    })

```

This allows automated retry strategies and IP rotation decisions without manual 429 inspection.

### SocialScan and UhOh365: Manual Handling

Both tools lack explicit rate-limit flags. HTTP 429 responses terminate execution or require manual intervention. No structured output indicates which services triggered throttling.

---

## Output Formats and Integration

### Holehe: Structured JSON for Automation

Each service returns a uniform dictionary:

```python
{
    "name": "twitter",
    "domain": "twitter.com",
    "method": "register",
    "frequent_rate_limit": False,
    "rateLimit": False,
    "exists": True,
    # ...

}

```

This enables direct pipeline integration with SIEMs, case management systems, or custom analytical workflows.

### SocialScan and UhOh365: Plain Text

Both output human-readable lists requiring regex parsing for automation:

```text
[+] Instagram: exists
[-] Twitter: not found

```

---

## Practical Code Examples

### Holehe CLI and Library Usage

Command line execution:

```bash

# Install

pip install holehe

# Basic check

holehe test@example.com

# JSON output for processing

holehe test@example.com --json

```

Async library integration:

```python
import trio
import httpx
from holehe.modules.social_media.twitter import twitter
from holehe.modules.social_media.instagram import instagram

async def check_email(email):
    results = []
    async with httpx.AsyncClient() as client:
        await twitter(email, client, results)
        await instagram(email, client, results)
    return results

# Execute

output = trio.run(check_email, "target@example.com")
print(output)

```

Source reference: [`holehe/modules/social_media/twitter.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/twitter.py) implements the `register` method against Twitter's email availability API.

### SocialScan Installation and Use

```bash
pip install socialscan
socialscan -e test@example.com

```

The tool lives at `megadose/socialscan` with single-script implementation in [`socialscan.py`](https://github.com/megadose/holehe/blob/main/socialscan.py).

### UhOh365 Deployment

```bash
git clone https://github.com/Raikia/UhOh365
cd UhOh365 && pip install -r requirements.txt
python uhoh.py -e test@example.com

```

All logic concentrates in [`uhoh.py`](https://github.com/megadose/holehe/blob/main/uhoh.py) with Microsoft-specific request patterns.

---

## Performance Characteristics

| Scenario | Holehe | SocialScan | UhOh365 |
|---|---|---|---|
| Single email, full service list | ~2-5 seconds | ~30-60 seconds | ~10-20 seconds |
| Large email list throughput | High (async batching) | Low (sequential) | Low (sequential) |
| Network efficiency | Connection pooling via httpx | New connection per request | New connection per request |

Holehe's `trio`+`httpx` stack provides connection reuse and concurrent request saturation, while synchronous tools spend most runtime waiting for I/O.

---

## Extensibility and Maintenance

### Holehe: Community-Ready Contribution Model

The `holehe/modules/` structure encourages community modules. New services follow a template:

1. Async function signature: `async def servicename(email, client, out)`
2. Standard output append to `out` list
3. Rate limit flag declaration
4. Category-appropriate subfolder placement

Active maintenance through 2024-2026 with 1000+ GitHub stars and regular PyPI releases.

### SocialScan and UhOh365: Centralized Maintenance

Adding services requires editing core scripts. SocialScan's ~200 stars and 2022 last release indicate slower evolution. UhOh365 remains niche with minimal fork activity.

---

## Summary

- **Holehe** excels for comprehensive investigations requiring speed, structured output, and broad service coverage—use when you need 120+ services with forensic-grade metadata.

- **SocialScan** suits quick checks against major platforms when installation simplicity matters more than performance or coverage depth.

- **UhOh365** fits Microsoft-centric assessments where Office365/Azure AD enumeration is the primary goal.

Key differentiators favoring Holehe: async architecture in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), modular service implementation under `holehe/modules/`, explicit rate limit handling per-module, and uniform JSON output enabling automation.

---

## Frequently Asked Questions

### What makes Holehe faster than SocialScan and UhOh365?

Holehe uses Python's `asyncio` pattern through `trio` and `httpx` to execute all service checks concurrently. While SocialScan and UhOh365 make sequential synchronous requests with `requests`, Holehe's [`core.py`](https://github.com/megadose/holehe/blob/main/core.py) orchestrates parallel module execution—reducing total runtime from minutes to seconds for full service lists.

### Can I use these tools as Python libraries, or only CLI?

Holehe supports both natively. Import any module from `holehe.modules` and call its async function with an `httpx.AsyncClient`. SocialScan and UhOh365 are primarily CLI-focused; library usage requires manually extracting functions from their monolithic scripts without guaranteed API stability.

### How does Holehe avoid getting rate-limited?

Each module in `holehe/modules/` declares a `frequent_rate_limit` boolean and catches exceptions to set a `rateLimit` flag in results. This lets you implement backoff strategies, proxy rotation, or priority queuing based on real-time throttling indicators—automation that SocialScan and UhOh365 lack.

### Which tool has the most services for email OSINT?

Holehe maintains 120+ services across categories from `holehe/modules/social_media/` to `holehe/modules/crm/`. SocialScan covers approximately 30 major platforms. UhOh365 focuses narrowly on ~15 Microsoft services. The full Holehe list appears in the repository README (lines 19-241).