# How the `--only-used` Flag Filters Results in the Holehe CLI

> Learn how the holehe CLI --only-used flag filters results, showing only successful matches and hiding errors, rate limits, and non-existent accounts for efficient searching.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-20

---

**The `--only-used` flag in holehe suppresses all output except successful matches where `results["exists"] == True`, hiding rate-limited sites, errors, and accounts where the email was not found.**

The `--only-used` option is a CLI filter in [megadose/holehe](https://github.com/megadose/holehe) that streamlines reconnaissance output by showing only confirmed email-to-service associations. This article explains exactly how the flag works at the source code level.

## Where the `--only-used` Flag Is Implemented

The filtering logic resides in **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)**, specifically within the `print_result()` function. After all modules complete their checks, the CLI aggregates results into an `out` list and passes them to `print_result(out, args, …)` for display.

The function iterates through each result dictionary and applies conditional guards based on `args.onlyused`.

## How the Flag Controls Output

The implementation uses a simple gatekeeping pattern: every branch that reports a *negative* outcome includes `and args.onlyused == False`, while the success branch has no such check.

| Result Type | Default Output (`--only-used` off) | With `--only-used` Enabled |
|-------------|-----------------------------------|---------------------------|
| `rateLimit == True` | `[x]` (yellow, rate-limited) | **Hidden** |
| `error` present and true | `[!]` (error) | **Hidden** |
| `exists == False` | `[-]` (email not used) | **Hidden** |
| `exists == True` | `[+]` (email used) | **Shown** |

This means `--only-used` is essentially an exclusion filter: it strips away noise and leaves only confirmed hits.

## Source Code Breakdown

Here is the relevant implementation from [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) (lines 22–46):

```python
for results in data:
    if results["rateLimit"] and args.onlyused == False:
        websiteprint = print_color("[x] " + results["domain"], "yellow", args)
        print(websiteprint)
    elif "error" in results.keys() and results["error"] and args.onlyused == False:
        websiteprint = print_color("[!] " + results["domain"] + " : " + results["error"], "red", args)
        print(websiteprint)
    elif results["exists"] == False and args.onlyused == False:
        websiteprint = print_color("[-] " + results["domain"], "red", args)
        print(websiteprint)
    elif results["exists"] == True:
        websiteprint = print_color("[+] " + results["domain"], "green", args)
        to_append = (results["domain"], results["email"], results["others"])
        if to_append in out:
            out.remove(to_append)
        out.append(to_append)
        print(websiteprint)

```

**Key observations from the source:**

- The first three branches all require `args.onlyused == False` to execute
- The `exists == True` branch has **no flag check**, so it always runs
- The `out` list is only modified on successful matches, which matters for downstream processing

## Practical Usage Examples

Run holehe with default output (all results):

```bash
holehe user@example.com

```

Enable the filter to show only confirmed accounts:

```bash
holehe user@example.com --only-used

```

**Sample output with `--only-used`:**

```

[+] example.com   user@example.com
[+] github.com    user@example.com
[+] twitter.com   user@example.com

```

All `[x]`, `[!]`, and `[-]` lines are suppressed.

## Module Structure and Data Flow

The flag operates on data produced by site-specific modules. Understanding this flow clarifies what `results` contains:

| File Pattern | Purpose |
|-------------|---------|
| `holehe/modules/*/module.py` | Individual modules that return dictionaries with `exists`, `rateLimit`, `error`, and `others` keys |
| [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) | Orchestrates execution, collects `out` list, and applies `--only-used` filtering via `print_result()` |
| [`holehe/__init__.py`](https://github.com/megadose/holehe/blob/main/holehe/__init__.py) | Package entry point and version exposure |

Each module returns a standardized result structure. The `--only-used` flag acts as a presentation-layer filter on this unified output.

## Performance and Behavioral Notes

- **No speed improvement**: The flag does not skip module execution; it only affects what gets printed
- **Silent failures risk**: With `--only-used`, you will not see rate limits or errors that might indicate incomplete coverage
- **Output parsing reliable**: The `[+]` prefix is deterministic, making the filtered output ideal for automated tooling

## Summary

- The `--only-used` flag is implemented in **[`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py)** within the `print_result()` function
- It adds `and args.onlyused == False` guards to negative outcome branches (rate-limit, error, not-found)
- Successful matches (`exists == True`) are always displayed regardless of the flag
- Use it to reduce noise when you only need confirmed email-to-service mappings

## Frequently Asked Questions

### Does `--only-used` make holehe run faster?

No. The flag only affects output formatting in `print_result()`. All modules still execute their HTTP requests and return full result dictionaries. The filtering happens after data collection, not before.

### Can I combine `--only-used` with other output flags?

Yes. The flag works independently of other CLI options. Any combination that `argparse` accepts will apply the same logic: hide non-matches, show only `exists == True` results.

### Why do I see fewer total lines with `--only-used` than expected?

The discrepancy indicates that many modules returned `rateLimit`, `error`, or `exists == False`. To diagnose coverage gaps, run without the flag to see `[x]`, `[!]`, or `[-]` entries that reveal which checks failed.