How the `--no-password-recovery` Option Works in holehe Module Filtering

The --no-password-recovery (or -NP) flag in holehe filters out specific modules that perform password recovery attempts by excluding four hard-coded service names from the execution pipeline.

The holehe tool by megadose is an OSINT utility that checks where an email address is registered across hundreds of services. Some modules attempt password recovery flows to verify account existence—a behavior users may want to disable. The --no-password-recovery option provides this control through straightforward module filtering.

CLI Flag Definition and Storage

The flag is registered in holehe/core.py through Python's argparse module. When users pass -NP or --no-password-recovery, the parser sets args.nopasswordrecovery to True【/blob/master/holehe/core.py#L90-L92】.

# From holehe/core.py – argument parser configuration

parser.add_argument('-NP', '--no-password-recovery', action='store_true',
                    help='Removes the modules that use the password recovery')

This boolean value propagates through the application to control downstream filtering behavior.

Module Discovery Process

Before filtering occurs, holehe discovers all available modules through the import_submodules function in holehe/core.py (lines 37-47). This function recursively imports every submodule under holehe.modules and returns a dictionary mapping fully-qualified module names to module objects.

The keys follow this pattern: holehe.modules.social_media.twitter, holehe.modules.shopping.amazon, etc.

Filtering Logic in get_functions

The core filtering happens in get_functions, located in holehe/core.py【/blob/master/holehe/core.py#L58-L62】. When args.nopasswordrecovery is True, the function checks each module name against an exclusion list:

# Simplified logic from holehe/core.py

excluded_services = ['adobe', 'mail_ru', 'odnoklassniki', 'samsung']

for module_name, module in modules.items():
    if args.nopasswordrecovery:
        if any(service in module_name for service in excluded_services):
            continue  # Skip this module

    # Module passes filter – add to execution list

    websites.append(module)

The four excluded services are:

• adobe – Adobe account password recovery
• mail_ru – Mail.ru account password recovery
• odnoklassniki – Odnoklassniki social network password recovery
• samsung – Samsung account password recovery

Modules matching these substrings are omitted from the websites list entirely. Consequently, they never reach the async execution nursery.

Execution Flow Impact

After filtering, the sanitized websites list is passed to maincore (lines 19-21), where each remaining module executes in an async nursery. The excluded modules are absent from this list, so no password-recovery traffic generates for those services.

Practical Usage Examples

Command-Line Usage

# Standard run – all modules including password recovery

holehe target@example.com

# Skip password-recovery modules only

holehe target@example.com -NP

# Long-form equivalent

holehe target@example.com --no-password-recovery

Programmatic Filtering

from holehe.core import import_submodules, get_functions

# Load all available modules

modules = import_submodules("holehe.modules")

# Mimic CLI arguments with -NP enabled

class Args:
    nopasswordrecovery = True
    # ... other args omitted for brevity

args = Args()

# Get filtered function list

filtered_functions = get_functions(modules, args)

print(f"Total modules after filtering: {len(filtered_functions)}")
print("Excluded services: adobe, mail_ru, odnoklassniki, samsung")

Technical Characteristics

Aspect	Implementation Detail
Exclusion method	Substring matching on fully-qualified module names
Hard-coded list	Four service names embedded in get_functions
Scope	Module-level exclusion (entire service removed, not individual functions)
Default behavior	Disabled – password-recovery modules run unless -NP is explicitly passed
Version stability	List defined in source; requires code modification to extend

Summary

• The --no-password-recovery flag sets a boolean in the parsed arguments object
• get_functions in holehe/core.py consults this boolean to filter modules
• Four services (adobe, mail_ru, odnoklassniki, samsung) are excluded when the flag is active
• Filtering occurs before execution, so excluded modules never run
• The implementation uses simple substring matching against module names

Frequently Asked Questions

What services does --no-password-recovery actually disable?

The flag disables four modules: Adobe, Mail.ru, Odnoklassniki, and Samsung. These are hard-coded in holehe/core.py at lines 58-62 according to the megadose/holehe source code.

Can I customize which modules are excluded with -NP?

No. The exclusion list is hard-coded in the source. To modify it, you would need to edit holehe/core.py directly and reinstall the tool, or fork the repository.

Does -NP prevent all password-related checks?

Only for the four listed services. Other modules may still interact with password fields or login forms—the flag specifically targets modules that trigger actual password recovery email/SMS flows.

Is there a performance benefit to using --no-password-recovery?

Minimal. You save four HTTP request sequences. The primary benefit is operational: avoiding password-reset emails or SMS messages that might alert the target account owner.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}