# How to Skip Password Recovery Modules in Holehe CLI

> Learn to skip password recovery modules in Holehe CLI using the NP flag. Maintain email checks while disabling recovery attempts for efficient security testing.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-26

---

**Use the `-NP` or `--no-password-recovery` flag to disable password-recovery attempts while keeping standard email-existence checks.**

Holehe is an open-source intelligence tool that verifies whether an email address is registered across hundreds of online services. By default, the CLI attempts both standard existence checks and password-recovery requests on certain platforms. If you want to avoid triggering "forgot password" emails or reduce network traffic, you can configure the tool to skip these specific modules.

## Using the --no-password-recovery Flag

The `--no-password-recovery` argument (short form `-NP`) instructs Holehe to omit modules that trigger password-recovery workflows. This prevents the tool from sending reset requests to the target email address while maintaining all other verification logic.

### Basic Command Syntax

Run Holehe with the flag placed before the target email address:

```bash
holehe --no-password-recovery user@example.com

```

Or use the short form for brevity:

```bash
holehe -NP user@example.com

```

### Combining with Other CLI Options

You can combine `-NP` with other flags such as CSV output (`-C`) or custom timeout values (`-T`):

```bash
holehe -NP -C -T 15 user@example.com

```

This command skips password-recovery modules, outputs results in CSV format, and sets a 15-second timeout per request.

## How the Filtering Works in the Source Code

According to the megadose/holehe source code, the filtering logic consists of two stages: CLI argument parsing and dynamic module selection.

### CLI Argument Parsing in core.py

In [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), the argument parser defines the `--no-password-recovery` option. When this flag is present in the command, the parser sets `args.nopasswordrecovery` to `True`. This boolean value is then passed to the module loading logic.

### Module Filtering Logic in get_functions()

The `get_functions()` function evaluates `args.nopasswordrecovery`. If the value is `True`, the function filters out every module whose implementation is marked as a password-recovery module, **except** for four explicit exceptions: **Adobe**, **Mail RU**, **Odnoklassniki**, and **Samsung**. These services remain active regardless of the flag.

### Examples of Filtered Modules

Password-recovery modules are identified by a `method` attribute set to `"password recovery"`. For instance:

- [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py) defines `method = "password recovery"`
- [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) uses the same method tag
- [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py) follows this pattern

When `-NP` is active, `get_functions()` excludes these files from the execution list, preventing the associated HTTP requests from firing.

## Summary

- Append `-NP` or `--no-password-recovery` to your Holehe command to skip password-recovery modules.
- The flag sets `args.nopasswordrecovery` to `True` within [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py).
- The `get_functions()` filter removes modules containing `method = "password recovery"`.
- Four services—Adobe, Mail RU, Odnoklassniki, and Samsung—are hardcoded exceptions and remain active.
- Using this flag reduces network overhead and prevents unwanted reset emails while preserving standard existence checks.

## Frequently Asked Questions

### What is the difference between standard email checks and password recovery modules?

Standard modules verify email existence via registration API endpoints or login page analysis without interacting with the account. Password-recovery modules specifically trigger "forgot password" workflows, which may send reset emails to the target address. The `-NP` flag disables these specific triggers while keeping existence checks intact.

### Why are Adobe, Mail RU, Odnoklassniki, and Samsung not excluded when using --no-password-recovery?

These four services are explicitly hardcoded as exceptions in the `get_functions()` logic within [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py). Even when password-recovery filtering is enabled, these modules continue to run to ensure comprehensive coverage for high-value targets that only expose account existence through recovery endpoints.

### Can I use -NP with other output formats like CSV or JSON?

Yes. The `-NP` flag operates independently of output formatting. You can combine it with `-C` for CSV output or rely on the default JSON output without conflicts, allowing you to skip recovery checks while maintaining your preferred data serialization format.

### Will skipping password recovery modules make Holehe faster?

Yes. Disabling these modules reduces the total number of HTTP requests sent during a scan. Since password-recovery endpoints often require additional POST requests and response parsing, omitting them decreases network overhead and shortens overall execution time.