How the `--no-password-recovery` Flag Filters Modules in Holehe

The --no-password-recovery flag (or -NP) in Holehe excludes four specific modules—Adobe, Mail.ru, Odnoklassniki, and Samsung—from the email scanning process by evaluating the nopasswordrecovery argument inside the get_functions logic.

Holehe is an open-source email reconnaissance tool developed by megadose/holehe that checks whether an email address is registered across hundreds of online services. Some of these checks involve password-recovery attacks, which can trigger intrusive account reset flows. To give users granular control over these sensitive probes, Holehe implements the --no-password-recovery flag to filter out specific modules at runtime according to the source code in holehe/core.py.

What the --no-password-recovery Flag Does

When enabled, the flag prevents Holehe from executing modules that attempt password-recovery enumeration. Instead of probing services that might send password reset emails or expose account recovery endpoints, the tool limits its scope to standard registration checks. This ensures that scans remain passive for privacy-sensitive environments while still verifying email presence on other platforms.

Where the Filtering Logic Lives in the Source Code

The implementation spans two critical sections in holehe/core.py: the command-line argument parser and the module selection function.

Command-Line Argument Parsing

The flag is registered in the ArgumentParser at lines 90–91. When users pass --no-password-recovery or -NP, the nopasswordrecovery destination variable is set to True:

parser.add_argument("-NP","--no-password-recovery",
                    default=False,
                    required=False,
                    action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not try password recovery on the websites")

Module Exclusion Logic

The actual filtering occurs inside the get_functions function at lines 58–61. Here, the code explicitly checks the args.nopasswordrecovery value and performs string matching against the module names:

if args is not None and args.nopasswordrecovery == True:
    if  "adobe" not in str(modu.__dict__[site]) and
        "mail_ru" not in str(modu.__dict__[site]) and
        "odnoklassniki" not in str(modu.__dict__[site]) and
        "samsung" not in str(modu.__dict__[site]):
        websites.append(modu.__dict__[site])
else:
    websites.append(modu.__dict__[site])

If nopasswordrecovery is True, the function only appends modules to the websites list when their string representation does not contain the four excluded service names.

Which Modules Get Excluded?

When the --no-password-recovery flag is active, Holehe skips exactly four modules that implement password-recovery logic:

• holehe.modules.software.adobe – Checks Adobe account recovery endpoints.
• holehe.modules.mails.mail_ru – Probes Mail.ru password reset functionality.
• holehe.modules.social_media.odnoklassniki – Tests Odnoklassniki account recovery.
• holehe.modules.products.samsung – Attempts Samsung account password recovery.

All other modules in the holehe/modules/ directory continue to execute normally, allowing the tool to verify email registration on remaining services without triggering recovery workflows.

Usage Examples

Run a standard scan that includes password-recovery modules:

holehe user@example.com

Skip password-recovery checks using the long form:

holehe user@example.com --no-password-recovery

Or use the short flag:

holehe user@example.com -NP

When the flag is present, the output will lack results for Adobe, Mail.ru, Odnoklassniki, and Samsung, while still reporting presence or absence for all other supported services.

Summary

• The --no-password-recovery flag is defined in holehe/core.py with action="store_true" and dest="nopasswordrecovery".
• The get_functions function evaluates args.nopasswordrecovery to conditionally filter the module list.
• Four specific modules—adobe, mail_ru, odnoklassniki, and samsung—are excluded when the flag is enabled.
• Users can invoke the feature with either --no-password-recovery or the shorthand -NP.

Frequently Asked Questions

How do I know if a Holehe module uses password recovery?

According to the megadose/holehe source code, modules containing password-recovery logic are manually flagged in the get_functions exclusion list. As of the current implementation, only the Adobe, Mail.ru, Odnoklassniki, and Samsung modules trigger this filter. You can also inspect individual module files in holehe/modules/ to check for password-recovery function implementations.

Will the --no-password-recovery flag make the scan faster?

The performance impact is negligible. While the flag removes four modules from execution, the primary benefit is operational security rather than speed. The scan avoids sending requests that could trigger password reset emails or account lockouts on the target services.

Can I exclude specific modules without using --no-password-recovery?

The source code does not expose a generic module exclusion interface through command-line arguments. The filtering mechanism in holehe/core.py is hard-coded to check specifically for the four password-recovery modules. To exclude other modules, you would need to modify the get_functions logic or comment out specific imports in the modules directory.

Is the --no-password-recovery flag available in all Holehe versions?

The flag is present in the current master branch of megadose/holehe as implemented in holehe/core.py. If you are using an older release, verify that your core.py contains the ArgumentParser configuration for -NP and the corresponding conditional logic in get_functions between lines 58–61.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}