How to Only Show Matched Accounts in Holehe Output

Use the --only-used flag when running Holehe to suppress all non-matching results and display only services where the email address is registered.

Holehe is an open-source email OSINT tool that probes hundreds of platforms to determine if a target address is registered. By default, the CLI prints a status line for every site queried—indicating used, unused, rate-limited, or errored states. The --only-used argument filters this output to show only positive matches, streamlining reconnaissance workflows and reducing terminal clutter.

Understanding the --only-used Flag

When Holehe scans an email address, it iterates through its detection modules and returns a result object for each service. Without filtering, the terminal displays a mix of outcomes: "+" for existing accounts, "-" for available addresses, and "x" or "rate" for errors and throttling.

The --only-used CLI argument instructs Holehe to hide every result except successful matches (where exists == True). This is implemented in the argument parser within holehe/core.py at line 184, which stores the flag as args.onlyused for downstream consumption.

How the Filtering Works Internally

The suppression logic operates during the result rendering phase. When Holehe receives a response from a target site, it passes the data through the print_result function in holehe/core.py.

CLI Argument Parsing in holehe/core.py

The flag is defined in the argument parser around line 184:

# Conceptual representation based on source location

parser.add_argument("--only-used", action="store_true", dest="onlyused")

This stores a boolean in the parsed arguments namespace. When present, args.onlyused evaluates to True, signaling the renderer to apply the filter before emitting output.

Result Rendering Logic in print_result

The actual filtering occurs inside print_result (lines 122-135 of holehe/core.py). The function checks the args.onlyused value before printing each entry:

• If args.onlyused is True, the function skips printing for rate-limited sites, connection errors, and negative matches (unused accounts).
• Only entries where the account exists—indicated by the internal exists flag or the "+" symbol in terminal output—are rendered to stdout.

This conditional branching ensures that investigators see only the sites where the target email is actively registered, removing visual noise from the terminal output.

Usage Examples

You can invoke this filtering behavior from the command line or integrate it into Python scripts that consume Holehe's core modules.

Command Line Usage

Run Holehe with the --only-used flag to display only confirmed accounts:

# Default behavior: shows all sites including unused and errors

holehe test@example.com

# Filtered output: shows only matched accounts

holehe test@example.com --only-used

The second command suppresses lines indicating that an email is unused or that a service returned an error, leaving only the list of platforms where test@example.com is registered.

Programmatic Implementation

When calling Holehe functions directly in Python, you must construct an arguments object with the onlyused attribute set:

import argparse
from holehe.core import maincore, print_result

# Simulate parsed CLI arguments

parser = argparse.ArgumentParser()
parser.add_argument("--only-used", action="store_true", dest="onlyused")
args = parser.parse_args(["--only-used"])

# The args object now has args.onlyused = True

# Pass this to core functions that handle output rendering

# Example: await print_result(data, args, email, start_time, sites)

In this pattern, args.onlyused controls whether print_result emits the full status table or restricts output to positive matches only.

Summary

• The --only-used flag filters Holehe output to show only services where the email address is registered.
• The argument is parsed in holehe/core.py (line 184) and stored as args.onlyused.
• The print_result function (lines 122-135) checks this flag and suppresses rate-limits, errors, and negative matches when enabled.
• Use holehe email@example.com --only-used for concise command-line reconnaissance.
• When scripting, set dest="onlyused" to True in your argument namespace to achieve the same filtering behavior.

Frequently Asked Questions

What does the --only-used flag do in Holehe?

The --only-used flag instructs Holehe to hide all output lines except those indicating a successful match. It suppresses notifications about unused emails, rate-limiting, and connection errors, showing only platforms where the target email address has an active account.

How do I filter Holehe results to show only existing accounts?

Append --only-used to your Holehe command: holehe target@email.com --only-used. This applies the internal filter in holehe/core.py that checks the exists status of each probe result before printing.

Can I use --only-used with other Holehe flags?

Yes, --only-used functions as a standard boolean flag and can be combined with other arguments such as --no-clear or timeout modifiers. It only affects output rendering in the print_result function and does not alter the underlying probe logic.

Where is the output filtering logic implemented in the Holehe source code?

According to the megadose/holehe repository, the filtering logic resides in two locations: the argument parser defines the flag at line 184 of holehe/core.py, and the conditional rendering logic appears in the print_result function between lines 122-135 of the same file.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}