# What Does the `--no-password-recovery` CLI Flag Do in Holehe?

> Learn what the --no-password-recovery flag does in Holehe. This CLI option skips password-reset checks to only verify email registration on services. Optimize your security checks.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-24

---

**The `--no-password-recovery` (or `-NP`) flag disables Holehe’s optional password-recovery probes, instructing the tool to skip password-reset endpoint checks and only verify if an email address is registered on a service.**

The open-source OSINT tool **Holehe** verifies whether email addresses exist on various online platforms. Understanding what the `--no-password-recovery` CLI flag does is essential for controlling the depth of reconnaissance, as it determines whether the tool will probe "forgot password" endpoints after confirming account existence.

## Flag Definition in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)

The argument is defined in the command-line parser within **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)**. It uses `store_true` to set the destination variable `nopasswordrecovery` to `True` when the flag is present.

```python
parser.add_argument("-NP","--no-password-recovery",
                    default=False,
                    required=False,
                    action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not perform password‑recovery checks")

```

When the flag is omitted, `nopasswordrecovery` remains `False` (the default), signaling the tool to proceed with additional recovery checks.

## Default Behavior vs. Enabled Flag

By default, Holehe operates in a thorough mode that confirms email registration and then attempts to probe the service’s password-reset or "forgot password" endpoint. This secondary check can reveal whether an account is recoverable or if password hints are exposed.

When you supply **`--no-password-recovery`**:

- **Network traffic is reduced** by eliminating secondary HTTP requests to reset endpoints.
- **Detection risk decreases** because fewer suspicious requests are sent to the target services.
- **Execution speed improves** since the tool moves to the next service immediately after verifying email existence.

Individual service modules located in **`holehe/modules/`** check the `nopasswordrecovery` parameter to conditionally bypass this logic.

## Command-Line and Programmatic Examples

Run Holehe with the flag to skip recovery checks:

```bash

# Default behavior - includes password recovery probes

holehe user@example.com

# Skip password recovery checks - faster and quieter

holehe user@example.com --no-password-recovery

# Using the short form

holehe user@example.com -NP

```

When importing Holehe as a library, pass the flag via the arguments dictionary:

```python
from holehe.core import run

args = {
    "email": "user@example.com",
    "nopasswordrecovery": True,  # Equivalent to --no-password-recovery

    # ... other arguments ...

}
run(args)

```

The entry point in **[`holehe/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/__init__.py)** parses these arguments and dispatches them to the appropriate service modules.

## Implementation Across Service Modules

While the flag is registered in [`core.py`](https://github.com/megadose/holehe/blob/main/core.py), the actual conditional logic resides within the individual service implementations. Each module references the `nopasswordrecovery` boolean to decide whether to execute password-recovery specific code blocks after initial email verification succeeds.

This architecture allows the flag to act as a global toggle that consistently alters behavior across all supported platforms without modifying each module's core email-checking functionality.

## Summary

- **Definition**: The flag is defined in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) with `dest="nopasswordrecovery"` and `action="store_true"`.
- **Default State**: By default, Holehe performs password-recovery checks on confirmed accounts.
- **Flag Effect**: When enabled, the tool skips all password-reset endpoint probes, reporting only whether the email is registered.
- **Benefits**: Reduced network traffic, lower detection probability, and faster execution times.
- **Usage**: Available as `--no-password-recovery` or the short form `-NP` in the CLI, or via the `nopasswordrecovery` key when calling `run()` programmatically.

## Frequently Asked Questions

### What is the short form of the `--no-password-recovery` flag?

The short form is **`-NP`**. You can use either `holehe email@example.com -NP` or `holehe email@example.com --no-password-recovery` to achieve the same result.

### Does Holehe perform password recovery checks by default?

**Yes.** By default, the `nopasswordrecovery` parameter is `False`, meaning Holehe will attempt to probe password-reset endpoints after confirming an email address exists on a service.

### Why would I want to disable password recovery checks?

You should disable these checks when you only need to verify email existence without triggering additional requests that may be slower, raise security alerts, or hit rate limits on target services. This is common in large-scale audits where speed and stealth are prioritized over gathering recovery metadata.

### Can I use this flag when importing Holehe as a Python library?

**Yes.** When calling the `run()` function from `holehe.core`, include `"nopasswordrecovery": True` in the arguments dictionary passed to the function. This mimics the behavior of the CLI flag in programmatic workflows.