# How to Exclude Password Recovery Modules in Holehe: Three Effective Methods

> Learn how to exclude password recovery modules in Holehe using three effective methods. Master CLI flags and file filtering for enhanced security and control.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-28

---

**You can exclude password recovery modules in Holehe by passing the `--exclude-method "password recovery"` (or `-x`) flag via CLI, or by filtering the `MODULES` list in [`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py) before runtime.**

Holehe is an open-source email reconnaissance tool maintained by megadose/holehe that checks whether an email address is registered across hundreds of online services. By default, the tool loads every available module—including those that probe **password recovery** endpoints—but you can selectively disable these to speed up scans and reduce network noise.

## Understanding Holehe’s Module Architecture

Holehe uses a pluggable architecture where each service integration is defined as a **module** stored under `holehe/modules/`. Every module exposes a **`method`** attribute that describes its check type, such as `"email lookup"` or `"password recovery"`.

The central orchestrator in **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)** dynamically imports these modules from the **`MODULES`** list exported by **[`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py)**. During initialization, the core iterates over this list and inspects each module’s `method` attribute to determine whether it should execute. This design allows you to filter modules at three distinct layers: command-line arguments, module registration, or programmatic instantiation.

## Method 1: Using the Command-Line Flag

### The `--exclude-method` Flag

The simplest way to skip password recovery checks is to use the built-in exclusion flag when invoking Holehe from the terminal. The parser in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) accepts the `--exclude-method` (short form `-x`) argument, which performs a case-insensitive substring match against each module’s `method` attribute.

```bash

# Exclude all modules with method containing "password recovery"

holehe --exclude-method "password recovery" alice@example.com

# Short form

holehe -x "password recovery" alice@example.com

```

When this flag is present, the loader iterates over `MODULES` and omits any entry where `"password recovery"` appears in the `method` string. Only standard email lookup modules remain active, reducing the total number of outbound requests.

## Method 2: Editing the Module Registration

### Filtering MODULES in [`__init__.py`](https://github.com/megadose/holehe/blob/main/__init__.py)

For persistent exclusion without typing CLI flags, modify the module registration file directly. Open **[`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py)**, which aggregates all service modules into a single `MODULES` list, and apply a list comprehension that filters out unwanted methods.

```python

# holehe/modules/__init__.py

from .software import adobe, lastpass, spotify
from .social import twitter, instagram

# ... additional imports ...

MODULES = [
    adobe,
    lastpass,
    spotify,
    twitter,
    instagram,
    # ... other modules ...

]

# Remove password recovery modules permanently

MODULES = [
    m for m in MODULES
    if "password recovery" not in getattr(m, "method", "").lower()
]

```

This change takes effect immediately for all subsequent Holehe runs, regardless of CLI arguments. The core loader in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) will import only the filtered modules, effectively disabling password recovery probes across the entire tool.

## Method 3: Programmatic Exclusion in Python

### Instantiating the Holehe Class with Filters

When embedding Holehe into a larger Python application, you can bypass the CLI argument parser entirely by passing a custom module list directly to the **`Holehe`** class constructor. This approach offers run-time flexibility without modifying source files.

```python
from holehe.core import Holehe
from holehe.modules import MODULES

# Filter modules programmatically

filtered_modules = [
    m for m in MODULES
    if "password recovery" not in getattr(m, "method", "").lower()
]

# Instantiate Holehe with filtered modules

hh = Holehe(modules=filtered_modules)

# Run the check

import asyncio
results = asyncio.run(hh.run("alice@example.com"))
print(results)

```

This method is ideal for automation scripts that need to toggle module categories dynamically based on external configuration files or user preferences.

## Key Source Files and Functions

| File | Purpose |
|------|---------|
| [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) | Parses CLI arguments (including `--exclude-method`), loads modules, and executes the async scan loop. |
| [`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py) | Exports the `MODULES` list containing all registered service classes. |
| [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py) (example) | Representative module file defining a `method` attribute (e.g., `method = "password recovery"`). |
| [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) → `Holehe` class | Main orchestrator that accepts a custom `modules` list for programmatic usage. |

## Summary

- **Use `--exclude-method "password recovery"`** (or `-x`) to disable recovery modules temporarily via CLI.
- **Edit [`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py)** to permanently filter the `MODULES` list and exclude unwanted methods at the source.
- **Pass a filtered list** to the `Holehe` class constructor when integrating the tool into Python applications for dynamic control.
- Each module is identified by its **`method`** attribute, which the loader checks before execution.

## Frequently Asked Questions

### What attribute identifies password recovery modules in Holehe?

Each module defines a **`method`** attribute as a string constant within its class definition. Modules that probe password reset endpoints set this attribute to `"password recovery"` (or similar variants), which the loader in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) inspects during the filtering phase.

### Can I exclude multiple module types at once?

Yes. The `--exclude-method` flag accepts any substring, and you can chain logic in Python filters. For CLI usage, you may need to run Holehe with multiple `-x` flags if supported by the argument parser, or use a broader exclusion string like `"recovery"` that matches multiple method types simultaneously.

### Does excluding modules affect the JSON output format?

No. The JSON structure remains identical regardless of module exclusions. Fields for skipped services simply do not appear in the results array, reducing noise without altering the schema defined in the output formatter within [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py).

### How do I permanently disable specific modules without using CLI flags?

Navigate to **[`holehe/modules/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/__init__.py)** and comment out or remove the specific imports from the `MODULES` list. Alternatively, implement a hardcoded exclusion list right after the imports, filtering out modules by name or method before the list is exported to the core loader.