# How the `--no-password-recovery` Flag Filters Modules in Holehe

> Learn how the --no-password-recovery flag filters modules in Holehe by excluding Adobe, Mail.ru, Odnoklassniki, and Samsung from email scans. Understand the nopasswordrecovery argument and get_functions logic.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-25

---

**The `--no-password-recovery` flag (or `-NP`) in Holehe excludes four specific modules—Adobe, Mail.ru, Odnoklassniki, and Samsung—from the email scanning process by evaluating the `nopasswordrecovery` argument inside the `get_functions` logic.**

Holehe is an open-source email reconnaissance tool developed by **megadose/holehe** that checks whether an email address is registered across hundreds of online services. Some of these checks involve password-recovery attacks, which can trigger intrusive account reset flows. To give users granular control over these sensitive probes, Holehe implements the `--no-password-recovery` flag to filter out specific modules at runtime according to the source code in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py).

## What the `--no-password-recovery` Flag Does

When enabled, the flag prevents Holehe from executing modules that attempt password-recovery enumeration. Instead of probing services that might send password reset emails or expose account recovery endpoints, the tool limits its scope to standard registration checks. This ensures that scans remain passive for privacy-sensitive environments while still verifying email presence on other platforms.

## Where the Filtering Logic Lives in the Source Code

The implementation spans two critical sections in **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)**: the command-line argument parser and the module selection function.

### Command-Line Argument Parsing

The flag is registered in the `ArgumentParser` at lines 90–91. When users pass `--no-password-recovery` or `-NP`, the `nopasswordrecovery` destination variable is set to `True`:

```python
parser.add_argument("-NP","--no-password-recovery",
                    default=False,
                    required=False,
                    action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not try password recovery on the websites")

```

### Module Exclusion Logic

The actual filtering occurs inside the `get_functions` function at lines 58–61. Here, the code explicitly checks the `args.nopasswordrecovery` value and performs string matching against the module names:

```python
if args is not None and args.nopasswordrecovery == True:
    if  "adobe" not in str(modu.__dict__[site]) and
        "mail_ru" not in str(modu.__dict__[site]) and
        "odnoklassniki" not in str(modu.__dict__[site]) and
        "samsung" not in str(modu.__dict__[site]):
        websites.append(modu.__dict__[site])
else:
    websites.append(modu.__dict__[site])

```

If `nopasswordrecovery` is `True`, the function only appends modules to the `websites` list when their string representation does not contain the four excluded service names.

## Which Modules Get Excluded?

When the `--no-password-recovery` flag is active, Holehe skips exactly four modules that implement password-recovery logic:

- **`holehe.modules.software.adobe`** – Checks Adobe account recovery endpoints.
- **`holehe.modules.mails.mail_ru`** – Probes Mail.ru password reset functionality.
- **`holehe.modules.social_media.odnoklassniki`** – Tests Odnoklassniki account recovery.
- **`holehe.modules.products.samsung`** – Attempts Samsung account password recovery.

All other modules in the `holehe/modules/` directory continue to execute normally, allowing the tool to verify email registration on remaining services without triggering recovery workflows.

## Usage Examples

Run a standard scan that includes password-recovery modules:

```bash
holehe user@example.com

```

Skip password-recovery checks using the long form:

```bash
holehe user@example.com --no-password-recovery

```

Or use the short flag:

```bash
holehe user@example.com -NP

```

When the flag is present, the output will lack results for Adobe, Mail.ru, Odnoklassniki, and Samsung, while still reporting presence or absence for all other supported services.

## Summary

- The `--no-password-recovery` flag is defined in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) with `action="store_true"` and `dest="nopasswordrecovery"`.
- The `get_functions` function evaluates `args.nopasswordrecovery` to conditionally filter the module list.
- Four specific modules—**adobe**, **mail_ru**, **odnoklassniki**, and **samsung**—are excluded when the flag is enabled.
- Users can invoke the feature with either `--no-password-recovery` or the shorthand `-NP`.

## Frequently Asked Questions

### How do I know if a Holehe module uses password recovery?

According to the megadose/holehe source code, modules containing password-recovery logic are manually flagged in the `get_functions` exclusion list. As of the current implementation, only the Adobe, Mail.ru, Odnoklassniki, and Samsung modules trigger this filter. You can also inspect individual module files in `holehe/modules/` to check for password-recovery function implementations.

### Will the `--no-password-recovery` flag make the scan faster?

The performance impact is negligible. While the flag removes four modules from execution, the primary benefit is operational security rather than speed. The scan avoids sending requests that could trigger password reset emails or account lockouts on the target services.

### Can I exclude specific modules without using `--no-password-recovery`?

The source code does not expose a generic module exclusion interface through command-line arguments. The filtering mechanism in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) is hard-coded to check specifically for the four password-recovery modules. To exclude other modules, you would need to modify the `get_functions` logic or comment out specific imports in the modules directory.

### Is the `--no-password-recovery` flag available in all Holehe versions?

The flag is present in the current master branch of megadose/holehe as implemented in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py). If you are using an older release, verify that your [`core.py`](https://github.com/megadose/holehe/blob/main/core.py) contains the `ArgumentParser` configuration for `-NP` and the corresponding conditional logic in `get_functions` between lines 58–61.