How to Skip Password Recovery Modules in holehe: The Complete Guide

Use the -NP or --no-password-recovery command-line flag when running holehe to exclude password-recovery checks from Adobe, mail.ru, Odnoklassniki, and Samsung while retaining standard email verification modules.

holehe is an open-source OSINT tool by megadose that checks whether an email address is registered on various websites. By default, it includes modules that probe password-recovery endpoints, but you can skip these modules to reduce noise and avoid unnecessary requests. This guide explains exactly how the filtering mechanism works in the source code and how to apply it from both the CLI and programmatically.

Understanding the --no-password-recovery Flag

When you invoke holehe without any flags, it loads every available module—including those that interact with password-recovery endpoints. These specific modules check whether an account exists by attempting to initiate a password reset flow, which some users may wish to avoid for stealth or scope reasons according to the megadose/holehe source code.

The tool provides a built-in toggle to disable this behavior. In holehe/core.py, the argument parser defines the flag at lines 90–92:

parser.add_argument("-NP","--no-password-recovery", default=False,
                    required=False,action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not try password recovery on the websites")

Setting this flag to True triggers conditional logic that excludes four specific modules from the execution list.

How the Filtering Works in holehe/core.py

The filtering logic resides in the get_functions method within holehe/core.py (approximately lines 58–62). When args.nopasswordrecovery evaluates to True, the code explicitly checks the string representation of each module and omits any containing references to specific password-recovery implementations:

if args is not None and args.nopasswordrecovery == True:
    if "adobe" not in str(modu.__dict__[site]) and
       "mail_ru" not in str(modu.__dict__[site]) and
       "odnoklassniki" not in str(modu.__dict__[site]) and
       "samsung" not in str(modu.__dict__[site]):
        websites.append(modu.__dict__[site])
else:
    websites.append(modu.__dict__[site])

This hardcoded exclusion list ensures that when you skip password recovery modules in holehe, the tool never imports or executes the target functions from the affected modules, preventing any outbound password-recovery requests.

Command-Line Usage Examples

You can activate this filter using either the short or long flag format. Both approaches produce identical results.

Standard execution (includes password recovery):

holehe user@example.com

Skip password recovery modules:

holehe -NP user@example.com

Alternative long-form syntax:

holehe --no-password-recovery user@example.com

When the flag is present, holehe suppresses the four password-recovery modules while continuing to check all other sites for email registration status.

Programmatic Implementation

If you are embedding holehe into a larger Python workflow rather than using the CLI, you can still skip password recovery modules in holehe by manipulating sys.argv before importing the core main function:

import sys
sys.argv = ["holehe", "-NP", "user@example.com"]
from holehe.core import main
main()

Alternatively, you can inspect exactly which modules remain after filtering by manually invoking the internal parser and get_functions:

from holehe.core import import_submodules, get_functions, ArgumentParser

parser = ArgumentParser()
parser.add_argument("-NP", "--no-password-recovery", action="store_true")
args = parser.parse_args(["-NP"])

modules = import_submodules("holehe.modules")
sites = get_functions(modules, args)
print([s.__name__ for s in sites])  # Excludes: adobe, mail_ru, odnoklassniki, samsung

Which Modules Are Excluded?

When the --no-password-recovery flag is active, holehe specifically filters out these four modules:

• holehe/modules/software/adobe.py – Adobe password-recovery endpoint checks
• holehe/modules/mails/mail_ru.py – Mail.ru password-recovery probes
• holehe/modules/social_media/odnoklassniki.py – Odnoklassniki password-recovery verification
• holehe/modules/products/samsung.py – Samsung account password-recovery lookups

These files implement logic that interacts with "forgot password" workflows rather than standard registration checks. All other modules in the holehe/modules/ directory continue to execute normally.

Summary

• Primary method: Append -NP or --no-password-recovery to your holehe command to disable password-recovery checks.
• Implementation location: The filtering logic lives in holehe/core.py within the get_functions method (lines 58–62).
• Excluded modules: Adobe, mail.ru, Odnoklassniki, and Samsung modules are removed from the execution list when the flag is set.
• Programmatic access: Set sys.argv to include -NP before importing holehe.core.main, or manually pass parsed arguments to get_functions.

Frequently Asked Questions

What is the exact difference between using holehe with and without the -NP flag?

Without the -NP flag, holehe executes all available modules including those that send requests to password-recovery endpoints to verify account existence. With the -NP flag active, the tool specifically excludes the Adobe, mail.ru, Odnoklassniki, and Samsung modules, performing only standard email registration checks on remaining sites.

Can I exclude specific password-recovery modules individually instead of all four?

According to the current implementation in holehe/core.py, the filtering logic uses a hardcoded string check for the four specific module names. There is no granular CLI option to disable them individually; you must either skip all password recovery modules using -NP or modify the source code in holehe/core.py (lines 58–62) to adjust the exclusion criteria.

Does skipping password recovery modules improve scanning speed?

Removing the four password-recovery modules eliminates network requests to those specific endpoints, which marginally reduces total execution time. However, the primary benefit is operational: you avoid triggering password-reset emails or account lockout mechanisms on the target platforms, making the scan stealthier and less invasive.

Is the -NP flag available in all versions of holehe?

The --no-password-recovery functionality is implemented in the current master branch of megadose/holehe within holehe/core.py. If you are using an older release or fork that lacks the argument definition at lines 90–92 and the conditional filter at lines 58–62, the flag will not be recognized and the tool will throw an unrecognized argument error.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}