# The Detection Methods Used by Holehe Modules: Register, Login, Password Recovery, and Other

> Discover the three primary Holehe detection methods: register, login, and password recovery. Learn how these modules verify email account existence for security.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: internals
- Published: 2026-08-24

---

**Holehe modules determine email account existence using four distinct detection methods—`register`, `login`, `password recovery`, and `other`—with each technique defined in the `method` variable of individual service files.**

Holehe is an open-source intelligence (OSINT) tool maintained by megadose that verifies whether an email address is associated with accounts across hundreds of online platforms. Each service implementation within `holehe/modules/` employs specific **detection methods** to probe for account existence without requiring valid credentials, returning the technique used alongside the results.

## The Four Detection Methods in Holehe Source Code

Contrary to the common assumption of three methods, the codebase explicitly defines four distinct values for the `method` parameter. These categorize how each module interacts with target services to verify email registration status.

### Register Method

The **`register`** method queries email-availability or registration-validation endpoints to determine if an address is already claimed by an existing user. This approach checks if the service responds with "email already taken" errors during simulated signup flows.

In [`holehe/modules/social_media/twitter.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/twitter.py), the module implements this method by calling Twitter's email availability API:

```python
async def twitter(email, client, out):
    name = "twitter"
    domain = "twitter.com"
    method = "register"
    # Module queries https://api.twitter.com/i/users/email_available.json

```

This technique is passive and typically leaves no trace on the target account, as it only checks availability without creating sessions.

### Login Method

The **`login`** method attempts partial or complete authentication flows using the target email address. Rather than completing sign-in, the module analyzes error messages or response codes to infer whether the account exists.

The Snapchat module in [`holehe/modules/social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/snapchat.py) demonstrates this approach by initiating the login flow and parsing server responses to detect valid accounts. This method may generate login attempt notifications on some platforms, making it more invasive than registration checks.

### Password Recovery Method

The **`password recovery`** method triggers forgot-password or account-recovery workflows to test email recognition. Services typically reveal account existence when processing reset requests differently for registered versus unrecognized addresses.

For example, [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) utilizes Odnoklassniki's password recovery endpoint to verify account linkage. The module submits the email to the recovery form and interprets whether the server recognizes the address as belonging to an active account.

### Other Method

The **`other`** category encompasses custom detection logic that does not fit the three standard patterns. Currently, only the Office 365 module in [`holehe/modules/software/office365.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/office365.py) uses this classification, implementing domain-specific validation that differs from standard registration or login probes.

## How Detection Methods Are Implemented

Each Holehe module declares its detection strategy through a local `method` variable defined near the function signature. This variable is later included in the result dictionary returned to the core engine.

In [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), the orchestrator collects results from all modules, with each entry containing the `method` field alongside `name`, `domain`, `exists`, and other metadata. This allows the reporting layer to distinguish between a Twitter check that used registration APIs versus a Snapchat check that attempted login flows.

## Practical Usage and Interpreting Results

When running Holehe from the command line, the output includes the detection method used for each service:

```bash
python -m holehe -e user@example.com

```

Sample output structure:

```text
[+] twitter.com: exists=True (method: register)
[-] snapchat.com: exists=False (method: login)
[+] odnoklassniki.ru: exists=True (method: password recovery)
[-] office365.com: exists=False (method: other)

```

Programmatically, you can access the method field when using Holehe as a Python library:

```python
import asyncio
from holehe.core import core

async def analyze_email(email):
    results = await core(email)
    for result in results:
        service = result['name']
        exists = result['exists']
        method = result['method']
        print(f"{service}: {exists} (detected via {method})")

asyncio.run(analyze_email("target@example.com"))

```

## Summary

- Holehe modules use four distinct detection methods: **`register`**, **`login`**, **`password recovery`**, and **`other`**.
- The **`method`** variable in each module file (e.g., [`twitter.py`](https://github.com/megadose/holehe/blob/main/twitter.py), [`snapchat.py`](https://github.com/megadose/holehe/blob/main/snapchat.py)) declares which technique the module employs.
- **`register`** checks email availability APIs, **`login`** attempts authentication flows, and **`password recovery`** exploits reset mechanisms.
- Results aggregated in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) include the detection method, allowing users to understand how each account existence determination was made.

## Frequently Asked Questions

### What are the three main detection methods used by Holehe modules?

While Holehe categorizes techniques into four distinct methods, the three primary detection strategies are **`register`**, **`login`**, and **`password recovery`**. The fourth method, **`other`**, serves as a fallback for custom implementations like the Office 365 module that do not fit standard patterns.

### How does the register detection method work in Holehe?

The **`register`** method queries registration endpoints or email-availability APIs to check if an address is already claimed. For example, the Twitter module uses this method to call `https://api.twitter.com/i/users/email_available.json`, interpreting "already taken" responses as confirmation of account existence.

### Where is the detection method defined in a Holehe module?

Each module defines its detection method through a `method` variable assigned near the top of the async function. In [`holehe/modules/social_media/twitter.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/twitter.py), you will find `method = "register"` declared immediately after the `name` and `domain` variables, before any network requests occur.

### Can I filter Holehe results by detection method?

Currently, Holehe does not provide a built-in CLI flag to filter by detection method. However, when using the Python API as shown in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), you can programmatically filter the results list by checking `result['method'] == 'register'` or your desired technique before processing the output.