Understanding the Holehe `--only-used` CLI Flag

The --only-used flag in Holehe filters command-line output to display only services where the target email address is actively registered, suppressing negative results, errors, and rate-limit notifications to streamline threat intelligence workflows.

The holehe tool is an open-source email enumeration framework that checks if an address exists on hundreds of platforms. When investigating a target, sifting through negative results can obscure actionable intelligence, which is why the --only-used flag exists to show only confirmed account registrations.

How the --only-used Flag Is Defined

In holehe/core.py, the flag is registered in the argument parser at lines 84‑85:

parser.add_argument(
    "--only-used",
    default=False,
    required=False,
    action="store_true",
    dest="onlyused",
    help="Displays only the sites used by the target email address."
)

This creates a boolean option stored as onlyused in the parsed arguments, defaulting to False when not specified.

Result Filtering Logic in print_result

The filtering occurs inside the print_result function (lines 1223‑1237 in holehe/core.py). After all modules execute, the code checks args.onlyused before emitting non-positive results:

if results["rateLimit"] and args.onlyused == False:
    # print rate-limit info

elif "error" in results and results["error"] and args.onlyused == False:
    # print error info

elif results["exists"] == False and args.onlyused == False:
    # print "not used" info

elif results["exists"] == True:
    # always print positive match

When --only-used is supplied, the first three branches are skipped. This ensures only entries marked with [+] (confirmed registrations) appear in the terminal, while [-] (not used), [!] (errors), and [x] (rate limits) are suppressed.

Visual Comparison of Output

Without the flag, Holehe produces a comprehensive mixed list:

holehe alice@example.com

Typical output includes:

• [+] Sites where the email is found (positive matches)
• [-] Sites where the email is not found
• [!] Sites that returned an error
• [x] Sites that hit a rate limit

With the flag enabled, the output is strictly filtered:

holehe alice@example.com --only-used

Result (only positive matches):

[+] instagram   → alice@example.com
[+] github      → alice@example.com
[+] skype       → alice@example.com

Practical Usage Examples

Basic Filtering

To see only confirmed accounts for a target email:

holehe target@example.com --only-used

Combining with Export Options

You can combine --only-used with other flags like --csv or --no-color to generate clean reports:

holehe target@example.com --only-used --no-color --csv

This executes the full scan but writes only positive matches to the CSV file, eliminating clutter from errors and negative results.

Summary

• The --only-used flag is defined in holehe/core.py as a store_true argument with destination onlyused.
• It operates as a presentation-layer filter in the print_result function (lines 1223‑1237), not affecting the actual HTTP requests or scanning process.
• When enabled, the flag suppresses [-], [!], and [x] entries, displaying only [+] (confirmed registrations).
• This optimization aligns with typical threat-intel workflows where analysts need to focus exclusively on accounts that exist.

Frequently Asked Questions

Does --only-used make the scan faster?

No. According to the source code in holehe/core.py, every module is still invoked and every request is still made. The flag only controls the final rendering step in print_result, adding virtually no runtime overhead while providing a cleaner output.

Why can I still see rate limits when using --only-used?

If you see rate-limit notifications ([x]) while using the flag, verify that you included it correctly. The implementation explicitly checks args.onlyused == False before printing rate-limit entries at line 1223, so these entries should be completely hidden when the flag is active.

Can I use --only-used with JSON or CSV output?

Yes. The flag functions independently of output formatting options. You can combine it with --csv or similar flags to export only positive matches: holehe email@example.com --only-used --csv. This generates a file containing exclusively the services where the email is registered.

Where exactly is the filtering implemented in the codebase?

The filtering logic resides in the print_result function within holehe/core.py, specifically around lines 1223‑1237. This function evaluates the onlyused argument after all asynchronous scans complete, determining whether to print negative results, errors, and rate limits or to emit only confirmed positive matches.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}