How the `--only-used` Flag Filters Results in the Holehe CLI

The --only-used flag in holehe suppresses all output except successful matches where results["exists"] == True, hiding rate-limited sites, errors, and accounts where the email was not found.

The --only-used option is a CLI filter in megadose/holehe that streamlines reconnaissance output by showing only confirmed email-to-service associations. This article explains exactly how the flag works at the source code level.

Where the --only-used Flag Is Implemented

The filtering logic resides in holehe/core.py, specifically within the print_result() function. After all modules complete their checks, the CLI aggregates results into an out list and passes them to print_result(out, args, …) for display.

The function iterates through each result dictionary and applies conditional guards based on args.onlyused.

How the Flag Controls Output

The implementation uses a simple gatekeeping pattern: every branch that reports a negative outcome includes and args.onlyused == False, while the success branch has no such check.

Result Type	Default Output (--only-used off)	With --only-used Enabled
rateLimit == True	[x] (yellow, rate-limited)	Hidden
error present and true	[!] (error)	Hidden
exists == False	[-] (email not used)	Hidden
exists == True	[+] (email used)	Shown

This means --only-used is essentially an exclusion filter: it strips away noise and leaves only confirmed hits.

Source Code Breakdown

Here is the relevant implementation from holehe/core.py (lines 22–46):

for results in data:
    if results["rateLimit"] and args.onlyused == False:
        websiteprint = print_color("[x] " + results["domain"], "yellow", args)
        print(websiteprint)
    elif "error" in results.keys() and results["error"] and args.onlyused == False:
        websiteprint = print_color("[!] " + results["domain"] + " : " + results["error"], "red", args)
        print(websiteprint)
    elif results["exists"] == False and args.onlyused == False:
        websiteprint = print_color("[-] " + results["domain"], "red", args)
        print(websiteprint)
    elif results["exists"] == True:
        websiteprint = print_color("[+] " + results["domain"], "green", args)
        to_append = (results["domain"], results["email"], results["others"])
        if to_append in out:
            out.remove(to_append)
        out.append(to_append)
        print(websiteprint)

Key observations from the source:

• The first three branches all require args.onlyused == False to execute
• The exists == True branch has no flag check, so it always runs
• The out list is only modified on successful matches, which matters for downstream processing

Practical Usage Examples

Run holehe with default output (all results):

holehe user@example.com

Enable the filter to show only confirmed accounts:

holehe user@example.com --only-used

Sample output with --only-used:

[+] example.com   user@example.com
[+] github.com    user@example.com
[+] twitter.com   user@example.com

All [x], [!], and [-] lines are suppressed.

Module Structure and Data Flow

The flag operates on data produced by site-specific modules. Understanding this flow clarifies what results contains:

File Pattern	Purpose
holehe/modules/*/module.py	Individual modules that return dictionaries with exists, rateLimit, error, and others keys
holehe/core.py	Orchestrates execution, collects out list, and applies --only-used filtering via print_result()
holehe/__init__.py	Package entry point and version exposure

Each module returns a standardized result structure. The --only-used flag acts as a presentation-layer filter on this unified output.

Performance and Behavioral Notes

• No speed improvement: The flag does not skip module execution; it only affects what gets printed
• Silent failures risk: With --only-used, you will not see rate limits or errors that might indicate incomplete coverage
• Output parsing reliable: The [+] prefix is deterministic, making the filtered output ideal for automated tooling

Summary

• The --only-used flag is implemented in holehe/core.py within the print_result() function
• It adds and args.onlyused == False guards to negative outcome branches (rate-limit, error, not-found)
• Successful matches (exists == True) are always displayed regardless of the flag
• Use it to reduce noise when you only need confirmed email-to-service mappings

Frequently Asked Questions

Does --only-used make holehe run faster?

No. The flag only affects output formatting in print_result(). All modules still execute their HTTP requests and return full result dictionaries. The filtering happens after data collection, not before.

Can I combine --only-used with other output flags?

Yes. The flag works independently of other CLI options. Any combination that argparse accepts will apply the same logic: hide non-matches, show only exists == True results.

Why do I see fewer total lines with --only-used than expected?

The discrepancy indicates that many modules returned rateLimit, error, or exists == False. To diagnose coverage gaps, run without the flag to see [x], [!], or [-] entries that reveal which checks failed.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}