# How Holehe Handles the `--no-password-recovery` Flag: Disabling Password Recovery Checks

> Discover how Holehe's --no-password-recovery flag bypasses checks for services like Adobe and Samsung, streamlining your email verification scans.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: internals
- Published: 2026-08-19

---

**The `--no-password-recovery` flag disables Holehe's attempts to use password-recovery endpoints on specific services, filtering out modules like Adobe, Mail.ru, Odnoklassniki, and Samsung during email verification scans.**

Holehe is an open-source OSINT tool developed by megadose/holehe that checks whether an email address is registered on various websites. When running an investigation, you may want to skip services that rely on password-recovery mechanisms to avoid rate limits or privacy concerns, which is where the `--no-password-recovery` flag becomes essential.

## What the `--no-password-recovery` Flag Does

By default, Holehe attempts to verify email registrations across hundreds of services using multiple techniques, including **password-recovery endpoints**. These endpoints check whether an email exists in a service's database by attempting to initiate a password reset flow. When you enable the `--no-password-recovery` flag, Holehe excludes modules that implement this specific method, focusing instead on registration checks, login forms, and other verification techniques.

## Implementation in the Source Code

The functionality is implemented in the core CLI logic within the megadose/holehe repository.

### CLI Argument Definition

In [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) at lines 190-191, the argument parser defines the flag with the description "Do not try password recovery on the websites":

```python

# Simplified representation of the argument definition

parser.add_argument('--no-password-recovery', '-NP', 
                    help='Do not try password recovery on the websites',
                    action='store_true', dest='nopasswordrecovery')

```

When invoked, this sets `args.nopasswordrecovery` to `True`.

### Module Filtering Logic

The filtering occurs in the `get_functions` helper located at lines 58-62 of [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py). This function iterates through available modules and conditionally skips those where the `method` attribute equals `"password recovery"`:

```python

# Conceptual representation of the filtering logic

def get_functions(request, args):
    modules = import_submodules("holehe.modules")
    for module in modules:
        if args.nopasswordrecovery and module.method == "password recovery":
            continue
        yield module

```

## Modules Affected by the Flag

When `--no-password-recovery` is active, Holehe specifically skips four modules that declare `method = "password recovery"`:

- **[`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py)** — Checks Adobe account existence via password recovery flows
- **[`holehe/modules/mails/mail_ru.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/mails/mail_ru.py)** — Verifies Mail.ru email addresses through recovery endpoints  
- **[`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py)** — Uses Odnoklassniki's password reset mechanism for verification
- **[`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py)** — Queries Samsung's password recovery system

These modules are excluded from the execution pool while all other verification methods remain active.

## Command Line Usage

You can invoke the flag using either the long form `--no-password-recovery` or the short form `-NP`.

Run a standard scan including password-recovery checks:

```bash
holehe -e example@example.com

```

Run a scan excluding password-recovery attempts:

```bash
holehe -e example@example.com --no-password-recovery

```

Or using the short form:

```bash
holehe -e example@example.com -NP

```

In the filtered execution, Holehe will still test the email against the majority of services but will omit the four password-recovery-based checks identified above.

## Benefits of Disabling Password Recovery

Using the `--no-password-recovery` flag provides several operational advantages:

- **Faster execution scans** — Eliminating password-recovery requests reduces network overhead and processing time
- **Reduced rate-limiting** — Password-recovery endpoints often have stricter rate limits than other verification methods
- **Privacy considerations** — Prevents the generation of actual password-reset emails to the target address, which could alert the account owner or leave traces in mail server logs
- **Focused reconnaissance** — Allows investigators to concentrate on active session and registration-based verification methods

## Summary

- The `--no-password-recovery` flag filters out modules that rely on password-recovery endpoints in the megadose/holehe tool.
- The filtering logic resides in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) within the `get_functions` helper (lines 58-62), triggered by the CLI argument defined at lines 190-191.
- Four specific modules are excluded: Adobe, Mail.ru, Odnoklassniki, and Samsung.
- The flag supports a short form (`-NP`) and prevents both rate-limiting issues and notification emails to target addresses.

## Frequently Asked Questions

### What services does the `--no-password-recovery` flag skip in Holehe?

The flag specifically skips four services that implement password-recovery-based verification: Adobe ([`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py)), Mail.ru ([`holehe/modules/mails/mail_ru.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/mails/mail_ru.py)), Odnoklassniki ([`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py)), and Samsung ([`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py)). Each of these modules declares `method = "password recovery"` in its implementation.

### Is there a short form for the `--no-password-recovery` flag?

Yes, you can use `-NP` as the short form alternative to `--no-password-recovery`. Both forms set `args.nopasswordrecovery` to `True` in the argument parser defined in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py).

### Why would I want to disable password recovery checks in Holehe?

Disabling these checks prevents the target email address from receiving password-reset notifications, which maintains operational security during OSINT investigations. Additionally, password-recovery endpoints often implement strict rate limiting, so skipping them reduces the risk of IP bans and speeds up the overall scanning process.

### Does using `--no-password-recovery` make Holehe faster?

Yes, the scan completes faster because Holehe skips the four modules that implement password-recovery flows. While the time savings may vary based on network conditions, eliminating these specific HTTP requests reduces latency and avoids the additional processing required to handle password-recovery response parsing.