# How `--no-password-recovery` Filters Password Recovery Modules in holehe

> Learn how holehe's --no-password-recovery flag filters out modules like adobe, mail ru, odnoklassniki, and samsung by excluding them from scans. Enhance your security checks today.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-15

---

**The `--no-password-recovery` flag excludes four specific modules—adobe, mail_ru, odnoklassniki, and samsung—by checking their source code for those identifiers and omitting them from the active scan list.**

holehe is an open-source OSINT tool by **megadose/holehe** that checks for account registrations across hundreds of websites using email addresses. Some modules employ **password recovery** methods rather than direct registration checks, which may trigger security alerts or account lockouts. The `--no-password-recovery` flag lets users skip these higher-risk modules entirely.

## Where the Flag Is Parsed in holehe

The flag processing happens in **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)**, where the CLI argument parser defines `-NP` as the short form:

```python
parser.add_argument("-NP","--no-password-recovery",
                    default=False, required=False,
                    action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not try password recovery on the websites")

```

When present, `args.nopasswordrecovery` becomes `True` and propagates through the module selection logic.

## How Module Filtering Works

holehe discovers all submodules under `holehe/modules` via `import_submodules()`, then builds the execution list in `get_functions()`. The filtering logic checks each module's source code as a string:

```python
if args.nopasswordrecovery == True:
    if  "adobe" not in str(modu.__dict__[site]) \
        and "mail_ru" not in str(modu.__dict__[site]) \
        and "odnoklassniki" not in str(modu.__dict__[site]) \
        and "samsung" not in str(modu.__dict__[site]):
        websites.append(modu.__dict__[site])
else:
    websites.append(modu.__dict__[site])

```

This string-based check is case-sensitive and relies on the module's `__dict__` representation containing those specific identifier substrings.

## The Four Password Recovery Modules Excluded

| Module | File Path | Method Declaration |
|--------|-----------|-------------------|
| **Adobe** | [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py) | `method = "password recovery"` |
| **Mail.ru** | [`holehe/modules/mails/mail_ru.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/mails/mail_ru.py) | `method = "password recovery"` |
| **Odnoklassniki** | [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) | `method = "password recovery"` |
| **Samsung** | [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py) | `method = "password recovery"` |

Each of these modules sets `method = "password recovery"` at line 8 of their respective files, making them easy to identify programmatically through string inspection.

## Command-Line Usage Examples

Run holehe with full module coverage (default behavior):

```bash
holehe target@example.com

```

Disable password recovery checks to reduce detection risk:

```bash
holehe target@example.com --no-password-recovery

```

Or use the short flag:

```bash
holehe target@example.com -NP

```

## Programmatic Access to Filtered Modules

You can replicate the flag's behavior in Python scripts by mocking the argument namespace:

```python
from holehe.core import import_submodules, get_functions

# Load all available modules

modules = import_submodules("holehe.modules")

# Simulate --no-password-recovery flag

class Args:
    nopasswordrecovery = True

args = Args()
filtered_modules = get_functions(modules, args)

# Verify exclusion

print([m.__name__ for m in filtered_modules])

# adobe, mail_ru, odnoklassniki, samsung will NOT appear

```

## Summary

- The `--no-password-recovery` flag sets `args.nopasswordrecovery = True` in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)
- When enabled, `get_functions()` performs string inspection on module source code
- Four modules containing "adobe", "mail_ru", "odnoklassniki", or "samsung" are excluded from the `websites` list
- This prevents password recovery API calls that may trigger rate limits or security notifications
- Both long form (`--no-password-recovery`) and short form (`-NP`) are supported

## Frequently Asked Questions

### What is the difference between standard modules and password recovery modules in holehe?

Standard modules query registration databases or login endpoints directly. **Password recovery modules** exploit the "forgot password" flow, submitting the target email to determine if an account exists. This method carries higher risk of detection and potential account lockouts.

### Why does holehe use string matching instead of checking the `method` attribute directly?

The filtering logic in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) inspects `str(modu.__dict__[site])` rather than accessing `method` attributes programmatically. This implementation choice simplifies the check but ties module exclusion to specific hardcoded identifiers in the source code.

### Can I exclude other modules using the same flag?

No. The `--no-password-recovery` flag only excludes the **four specific modules** with hardcoded identifier checks. To exclude other modules, you would need to modify the filtering logic in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) or use the tool's module selection features if available in your version.

### Is the password recovery method less reliable than other checks?

Password recovery methods can be **equally or more reliable** for determining account existence, but they interact with security-sensitive endpoints. Some platforms monitor these flows more aggressively, making the `--no-password-recovery` flag valuable for stealth-conscious reconnaissance.