How holehe Checks for Account Existence Without Sending Password Reset Emails

holehe verifies account existence by issuing silent API requests to password-reset endpoints and parsing informational responses without completing the email-sending step.

holehe is an open-source OSINT tool that enumerates where an email address is registered across hundreds of services. Unlike traditional approaches that trigger actual password-reset emails, the tool exploits public "account lookup" or pre-validation endpoints to determine registration status without side effects. According to the megadose/holehe source code, this works through a consistent pattern implemented across platform-specific modules.

The Core Pattern: Silent Endpoint Probing

Every holehe module follows the same four-step routine to check for account existence without sending password reset emails:

1. Build a targeted request — Typically a GET or POST to a "forgot password," "reset password," or "account recovery" URL
2. Configure safe headers — Including custom Referer values that make the request appear as an internal validation check
3. Parse the response — Looking for status codes, JSON fields, or HTML fragments that indicate whether the email is recognized
4. Return a boolean result — True if an account exists, False otherwise

Because the request never reaches the final step that dispatches the reset email, the target address receives no notification.

Module Examples from the Source Code

Instagram Module

The Instagram checker in holehe/modules/social_media/instagram.py queries the platform's password recovery endpoint and inspects the response for indicators that the email is associated with an existing account.

Insightly CRM Module

The Insightly implementation in holehe/modules/crm/insightly.py demonstrates the pattern clearly. It submits to the forgot-password form and searches the HTML response for the exact phrase:

"An account exists for this address. Use another address or"

Finding this string confirms registration without completing the reset flow.

Samsung Products Module

The Samsung checker in holehe/modules/products/samsung.py uses a more sophisticated approach:

• Sets a Referer header pointing to the reset endpoint itself
• POSTs to /resetPasswordWithRecoveryProc
• Parses the JSON response for status codes that indicate known versus unknown email addresses

This header configuration ensures the server treats the request as an internal validation rather than a user-initiated action.

How the Dispatcher Runs Checks

The holehe/core.py file contains the orchestration logic that loads each module's check coroutine and executes requests concurrently. The signature pattern for every module is:

async def check(email: str, client: aiohttp.ClientSession) -> bool:
    # 1. Prepare request (URL, payload, headers)

    # 2. Send request with the aiohttp client

    # 3. Parse response for a known "account exists" marker

    # 4. Return True if marker found, else False

Using holehe to Check Account Existence

Run holehe from the command line to probe services without triggering emails:

# Check a single service (Instagram) for an email address

holehe -l instagram -e alice@example.com

# Run against the default set of services

holehe -e alice@example.com

Why This Approach Works

Services expose these validation endpoints because they need to provide user feedback during legitimate password-recovery workflows—confirming whether an email is registered before attempting delivery. holehe leverages the same informational responses but stops the process before the email-sending stage.

This technique provides several advantages:

• No notification — The target receives no password-reset email
• No rate-limiting triggers — Requests appear as standard client-side validation
• Scalable enumeration — The same pattern works across hundreds of platforms

Summary

• holehe checks account existence by probing password-reset endpoints without completing the email-sending step
• Each platform module in holehe/modules/ implements a check(email, client) coroutine following the four-step pattern
• Detection relies on parsing status codes, JSON responses, or HTML fragments that indicate registered accounts
• The Insightly module looks for "An account exists for this address..." in HTML responses
• The Samsung module sets a custom Referer and parses JSON status codes
• All modules are orchestrated through holehe/core.py for concurrent execution

Frequently Asked Questions

Does holehe actually send password reset emails?

No. holehe stops each request at the validation stage before the service dispatches any email. The tool only parses informational responses that indicate whether an account exists.

Can services detect that holehe is checking for accounts?

The tool mimics legitimate browser behavior using standard HTTP headers and proper Referer values as shown in the Samsung module. However, repeated requests from the same IP could potentially trigger rate limiting.

What types of responses indicate an existing account?

Modules search for specific markers: HTTP status codes (200 vs. 404), JSON success fields, or HTML text fragments like Insightly's "An account exists for this address" message.

How many services does holehe support?

The repository contains modules organized by category in holehe/modules/ covering social media, CRM platforms, products, and other service types, with the capability to check hundreds of platforms concurrently.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}