How Holehe Handles the `--no-password-recovery` Flag: Disabling Password Recovery Checks

The --no-password-recovery flag disables Holehe's attempts to use password-recovery endpoints on specific services, filtering out modules like Adobe, Mail.ru, Odnoklassniki, and Samsung during email verification scans.

Holehe is an open-source OSINT tool developed by megadose/holehe that checks whether an email address is registered on various websites. When running an investigation, you may want to skip services that rely on password-recovery mechanisms to avoid rate limits or privacy concerns, which is where the --no-password-recovery flag becomes essential.

What the --no-password-recovery Flag Does

By default, Holehe attempts to verify email registrations across hundreds of services using multiple techniques, including password-recovery endpoints. These endpoints check whether an email exists in a service's database by attempting to initiate a password reset flow. When you enable the --no-password-recovery flag, Holehe excludes modules that implement this specific method, focusing instead on registration checks, login forms, and other verification techniques.

Implementation in the Source Code

The functionality is implemented in the core CLI logic within the megadose/holehe repository.

CLI Argument Definition

In holehe/core.py at lines 190-191, the argument parser defines the flag with the description "Do not try password recovery on the websites":

# Simplified representation of the argument definition

parser.add_argument('--no-password-recovery', '-NP', 
                    help='Do not try password recovery on the websites',
                    action='store_true', dest='nopasswordrecovery')

When invoked, this sets args.nopasswordrecovery to True.

Module Filtering Logic

The filtering occurs in the get_functions helper located at lines 58-62 of holehe/core.py. This function iterates through available modules and conditionally skips those where the method attribute equals "password recovery":

# Conceptual representation of the filtering logic

def get_functions(request, args):
    modules = import_submodules("holehe.modules")
    for module in modules:
        if args.nopasswordrecovery and module.method == "password recovery":
            continue
        yield module

Modules Affected by the Flag

When --no-password-recovery is active, Holehe specifically skips four modules that declare method = "password recovery":

• holehe/modules/software/adobe.py — Checks Adobe account existence via password recovery flows
• holehe/modules/mails/mail_ru.py — Verifies Mail.ru email addresses through recovery endpoints
• holehe/modules/social_media/odnoklassniki.py — Uses Odnoklassniki's password reset mechanism for verification
• holehe/modules/products/samsung.py — Queries Samsung's password recovery system

These modules are excluded from the execution pool while all other verification methods remain active.

Command Line Usage

You can invoke the flag using either the long form --no-password-recovery or the short form -NP.

Run a standard scan including password-recovery checks:

holehe -e example@example.com

Run a scan excluding password-recovery attempts:

holehe -e example@example.com --no-password-recovery

Or using the short form:

holehe -e example@example.com -NP

In the filtered execution, Holehe will still test the email against the majority of services but will omit the four password-recovery-based checks identified above.

Benefits of Disabling Password Recovery

Using the --no-password-recovery flag provides several operational advantages:

• Faster execution scans — Eliminating password-recovery requests reduces network overhead and processing time
• Reduced rate-limiting — Password-recovery endpoints often have stricter rate limits than other verification methods
• Privacy considerations — Prevents the generation of actual password-reset emails to the target address, which could alert the account owner or leave traces in mail server logs
• Focused reconnaissance — Allows investigators to concentrate on active session and registration-based verification methods

Summary

• The --no-password-recovery flag filters out modules that rely on password-recovery endpoints in the megadose/holehe tool.
• The filtering logic resides in holehe/core.py within the get_functions helper (lines 58-62), triggered by the CLI argument defined at lines 190-191.
• Four specific modules are excluded: Adobe, Mail.ru, Odnoklassniki, and Samsung.
• The flag supports a short form (-NP) and prevents both rate-limiting issues and notification emails to target addresses.

Frequently Asked Questions

What services does the --no-password-recovery flag skip in Holehe?

The flag specifically skips four services that implement password-recovery-based verification: Adobe (holehe/modules/software/adobe.py), Mail.ru (holehe/modules/mails/mail_ru.py), Odnoklassniki (holehe/modules/social_media/odnoklassniki.py), and Samsung (holehe/modules/products/samsung.py). Each of these modules declares method = "password recovery" in its implementation.

Is there a short form for the --no-password-recovery flag?

Yes, you can use -NP as the short form alternative to --no-password-recovery. Both forms set args.nopasswordrecovery to True in the argument parser defined in holehe/core.py.

Why would I want to disable password recovery checks in Holehe?

Disabling these checks prevents the target email address from receiving password-reset notifications, which maintains operational security during OSINT investigations. Additionally, password-recovery endpoints often implement strict rate limiting, so skipping them reduces the risk of IP bans and speeds up the overall scanning process.

Does using --no-password-recovery make Holehe faster?

Yes, the scan completes faster because Holehe skips the four modules that implement password-recovery flows. While the time savings may vary based on network conditions, eliminating these specific HTTP requests reduces latency and avoids the additional processing required to handle password-recovery response parsing.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}