How to Exclude Password Recovery Modules in Holehe: Three Effective Methods

You can exclude password recovery modules in Holehe by passing the --exclude-method "password recovery" (or -x) flag via CLI, or by filtering the MODULES list in holehe/modules/__init__.py before runtime.

Holehe is an open-source email reconnaissance tool maintained by megadose/holehe that checks whether an email address is registered across hundreds of online services. By default, the tool loads every available module—including those that probe password recovery endpoints—but you can selectively disable these to speed up scans and reduce network noise.

Understanding Holehe’s Module Architecture

Holehe uses a pluggable architecture where each service integration is defined as a module stored under holehe/modules/. Every module exposes a method attribute that describes its check type, such as "email lookup" or "password recovery".

The central orchestrator in holehe/core.py dynamically imports these modules from the MODULES list exported by holehe/modules/__init__.py. During initialization, the core iterates over this list and inspects each module’s method attribute to determine whether it should execute. This design allows you to filter modules at three distinct layers: command-line arguments, module registration, or programmatic instantiation.

Method 1: Using the Command-Line Flag

The --exclude-method Flag

The simplest way to skip password recovery checks is to use the built-in exclusion flag when invoking Holehe from the terminal. The parser in holehe/core.py accepts the --exclude-method (short form -x) argument, which performs a case-insensitive substring match against each module’s method attribute.

# Exclude all modules with method containing "password recovery"

holehe --exclude-method "password recovery" alice@example.com

# Short form

holehe -x "password recovery" alice@example.com

When this flag is present, the loader iterates over MODULES and omits any entry where "password recovery" appears in the method string. Only standard email lookup modules remain active, reducing the total number of outbound requests.

Method 2: Editing the Module Registration

Filtering MODULES in __init__.py

For persistent exclusion without typing CLI flags, modify the module registration file directly. Open holehe/modules/__init__.py, which aggregates all service modules into a single MODULES list, and apply a list comprehension that filters out unwanted methods.

# holehe/modules/__init__.py

from .software import adobe, lastpass, spotify
from .social import twitter, instagram

# ... additional imports ...

MODULES = [
    adobe,
    lastpass,
    spotify,
    twitter,
    instagram,
    # ... other modules ...

]

# Remove password recovery modules permanently

MODULES = [
    m for m in MODULES
    if "password recovery" not in getattr(m, "method", "").lower()
]

This change takes effect immediately for all subsequent Holehe runs, regardless of CLI arguments. The core loader in holehe/core.py will import only the filtered modules, effectively disabling password recovery probes across the entire tool.

Method 3: Programmatic Exclusion in Python

Instantiating the Holehe Class with Filters

When embedding Holehe into a larger Python application, you can bypass the CLI argument parser entirely by passing a custom module list directly to the Holehe class constructor. This approach offers run-time flexibility without modifying source files.

from holehe.core import Holehe
from holehe.modules import MODULES

# Filter modules programmatically

filtered_modules = [
    m for m in MODULES
    if "password recovery" not in getattr(m, "method", "").lower()
]

# Instantiate Holehe with filtered modules

hh = Holehe(modules=filtered_modules)

# Run the check

import asyncio
results = asyncio.run(hh.run("alice@example.com"))
print(results)

This method is ideal for automation scripts that need to toggle module categories dynamically based on external configuration files or user preferences.

Key Source Files and Functions

File	Purpose
holehe/core.py	Parses CLI arguments (including --exclude-method), loads modules, and executes the async scan loop.
holehe/modules/__init__.py	Exports the MODULES list containing all registered service classes.
holehe/modules/software/adobe.py (example)	Representative module file defining a method attribute (e.g., method = "password recovery").
holehe/core.py → Holehe class	Main orchestrator that accepts a custom modules list for programmatic usage.

Summary

• Use --exclude-method "password recovery" (or -x) to disable recovery modules temporarily via CLI.
• Edit holehe/modules/__init__.py to permanently filter the MODULES list and exclude unwanted methods at the source.
• Pass a filtered list to the Holehe class constructor when integrating the tool into Python applications for dynamic control.
• Each module is identified by its method attribute, which the loader checks before execution.

Frequently Asked Questions

What attribute identifies password recovery modules in Holehe?

Each module defines a method attribute as a string constant within its class definition. Modules that probe password reset endpoints set this attribute to "password recovery" (or similar variants), which the loader in holehe/core.py inspects during the filtering phase.

Can I exclude multiple module types at once?

Yes. The --exclude-method flag accepts any substring, and you can chain logic in Python filters. For CLI usage, you may need to run Holehe with multiple -x flags if supported by the argument parser, or use a broader exclusion string like "recovery" that matches multiple method types simultaneously.

Does excluding modules affect the JSON output format?

No. The JSON structure remains identical regardless of module exclusions. Fields for skipped services simply do not appear in the results array, reducing noise without altering the schema defined in the output formatter within holehe/core.py.

How do I permanently disable specific modules without using CLI flags?

Navigate to holehe/modules/__init__.py and comment out or remove the specific imports from the MODULES list. Alternatively, implement a hardcoded exclusion list right after the imports, filtering out modules by name or method before the list is exported to the core loader.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}