How to Skip Password Recovery Modules in Holehe CLI

Use the -NP or --no-password-recovery flag to disable password-recovery attempts while keeping standard email-existence checks.

Holehe is an open-source intelligence tool that verifies whether an email address is registered across hundreds of online services. By default, the CLI attempts both standard existence checks and password-recovery requests on certain platforms. If you want to avoid triggering "forgot password" emails or reduce network traffic, you can configure the tool to skip these specific modules.

Using the --no-password-recovery Flag

The --no-password-recovery argument (short form -NP) instructs Holehe to omit modules that trigger password-recovery workflows. This prevents the tool from sending reset requests to the target email address while maintaining all other verification logic.

Basic Command Syntax

Run Holehe with the flag placed before the target email address:

holehe --no-password-recovery user@example.com

Or use the short form for brevity:

holehe -NP user@example.com

Combining with Other CLI Options

You can combine -NP with other flags such as CSV output (-C) or custom timeout values (-T):

holehe -NP -C -T 15 user@example.com

This command skips password-recovery modules, outputs results in CSV format, and sets a 15-second timeout per request.

How the Filtering Works in the Source Code

According to the megadose/holehe source code, the filtering logic consists of two stages: CLI argument parsing and dynamic module selection.

CLI Argument Parsing in core.py

In holehe/core.py, the argument parser defines the --no-password-recovery option. When this flag is present in the command, the parser sets args.nopasswordrecovery to True. This boolean value is then passed to the module loading logic.

Module Filtering Logic in get_functions()

The get_functions() function evaluates args.nopasswordrecovery. If the value is True, the function filters out every module whose implementation is marked as a password-recovery module, except for four explicit exceptions: Adobe, Mail RU, Odnoklassniki, and Samsung. These services remain active regardless of the flag.

Examples of Filtered Modules

Password-recovery modules are identified by a method attribute set to "password recovery". For instance:

• holehe/modules/software/adobe.py defines method = "password recovery"
• holehe/modules/social_media/odnoklassniki.py uses the same method tag
• holehe/modules/products/samsung.py follows this pattern

When -NP is active, get_functions() excludes these files from the execution list, preventing the associated HTTP requests from firing.

Summary

• Append -NP or --no-password-recovery to your Holehe command to skip password-recovery modules.
• The flag sets args.nopasswordrecovery to True within holehe/core.py.
• The get_functions() filter removes modules containing method = "password recovery".
• Four services—Adobe, Mail RU, Odnoklassniki, and Samsung—are hardcoded exceptions and remain active.
• Using this flag reduces network overhead and prevents unwanted reset emails while preserving standard existence checks.

Frequently Asked Questions

What is the difference between standard email checks and password recovery modules?

Standard modules verify email existence via registration API endpoints or login page analysis without interacting with the account. Password-recovery modules specifically trigger "forgot password" workflows, which may send reset emails to the target address. The -NP flag disables these specific triggers while keeping existence checks intact.

Why are Adobe, Mail RU, Odnoklassniki, and Samsung not excluded when using --no-password-recovery?

These four services are explicitly hardcoded as exceptions in the get_functions() logic within holehe/core.py. Even when password-recovery filtering is enabled, these modules continue to run to ensure comprehensive coverage for high-value targets that only expose account existence through recovery endpoints.

Can I use -NP with other output formats like CSV or JSON?

Yes. The -NP flag operates independently of output formatting. You can combine it with -C for CSV output or rely on the default JSON output without conflicts, allowing you to skip recovery checks while maintaining your preferred data serialization format.

Will skipping password recovery modules make Holehe faster?

Yes. Disabling these modules reduces the total number of HTTP requests sent during a scan. Since password-recovery endpoints often require additional POST requests and response parsing, omitting them decreases network overhead and shortens overall execution time.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}