# Understanding the Holehe `--only-used` CLI Flag

> Master Holehe's --only-used CLI flag. Filter results to show only active email registrations, streamlining your threat intelligence. Focus on what matters.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-17

---

**The `--only-used` flag in Holehe filters command-line output to display only services where the target email address is actively registered, suppressing negative results, errors, and rate-limit notifications to streamline threat intelligence workflows.**

The `holehe` tool is an open-source email enumeration framework that checks if an address exists on hundreds of platforms. When investigating a target, sifting through negative results can obscure actionable intelligence, which is why the `--only-used` flag exists to show only confirmed account registrations.

## How the `--only-used` Flag Is Defined

In [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), the flag is registered in the argument parser at lines 84‑85:

```python
parser.add_argument(
    "--only-used",
    default=False,
    required=False,
    action="store_true",
    dest="onlyused",
    help="Displays only the sites used by the target email address."
)

```

This creates a boolean option stored as `onlyused` in the parsed arguments, defaulting to `False` when not specified.

## Result Filtering Logic in `print_result`

The filtering occurs inside the `print_result` function (lines 1223‑1237 in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)). After all modules execute, the code checks `args.onlyused` before emitting non-positive results:

```python
if results["rateLimit"] and args.onlyused == False:
    # print rate-limit info

elif "error" in results and results["error"] and args.onlyused == False:
    # print error info

elif results["exists"] == False and args.onlyused == False:
    # print "not used" info

elif results["exists"] == True:
    # always print positive match

```

When `--only-used` is supplied, the first three branches are skipped. This ensures only entries marked with `[+]` (confirmed registrations) appear in the terminal, while `[-]` (not used), `[!]` (errors), and `[x]` (rate limits) are suppressed.

## Visual Comparison of Output

Without the flag, Holehe produces a comprehensive mixed list:

```bash
holehe alice@example.com

```

Typical output includes:

- **[+]** Sites where the email is found (positive matches)
- **[-]** Sites where the email is **not** found
- **[!]** Sites that returned an error
- **[x]** Sites that hit a rate limit

With the flag enabled, the output is strictly filtered:

```bash
holehe alice@example.com --only-used

```

Result (only positive matches):

```

[+] instagram   → alice@example.com
[+] github      → alice@example.com
[+] skype       → alice@example.com

```

## Practical Usage Examples

### Basic Filtering

To see only confirmed accounts for a target email:

```bash
holehe target@example.com --only-used

```

### Combining with Export Options

You can combine `--only-used` with other flags like `--csv` or `--no-color` to generate clean reports:

```bash
holehe target@example.com --only-used --no-color --csv

```

This executes the full scan but writes only positive matches to the CSV file, eliminating clutter from errors and negative results.

## Summary

- The `--only-used` flag is defined in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) as a `store_true` argument with destination `onlyused`.
- It operates as a presentation-layer filter in the `print_result` function (lines 1223‑1237), not affecting the actual HTTP requests or scanning process.
- When enabled, the flag suppresses `[-]`, `[!]`, and `[x]` entries, displaying only `[+]` (confirmed registrations).
- This optimization aligns with typical threat-intel workflows where analysts need to focus exclusively on accounts that exist.

## Frequently Asked Questions

### Does `--only-used` make the scan faster?

No. According to the source code in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), every module is still invoked and every request is still made. The flag only controls the final rendering step in `print_result`, adding virtually no runtime overhead while providing a cleaner output.

### Why can I still see rate limits when using `--only-used`?

If you see rate-limit notifications (`[x]`) while using the flag, verify that you included it correctly. The implementation explicitly checks `args.onlyused == False` before printing rate-limit entries at line 1223, so these entries should be completely hidden when the flag is active.

### Can I use `--only-used` with JSON or CSV output?

Yes. The flag functions independently of output formatting options. You can combine it with `--csv` or similar flags to export only positive matches: `holehe email@example.com --only-used --csv`. This generates a file containing exclusively the services where the email is registered.

### Where exactly is the filtering implemented in the codebase?

The filtering logic resides in the `print_result` function within [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), specifically around lines 1223‑1237. This function evaluates the `onlyused` argument after all asynchronous scans complete, determining whether to print negative results, errors, and rate limits or to emit only confirmed positive matches.