# How to Bypass Rate Limits with Holehe: Methods and Implementation

> Bypass rate limits with Holehe using --no-rate-limit or rotating proxies. Learn effective methods to manage your requests and avoid throttling for smoother operation.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-26

---

**You can bypass Holehe's rate limiting by using the `--no-rate-limit` flag to disable automatic throttling, or by routing requests through rotating proxies and custom headers to distribute traffic across multiple IP addresses.**

Holehe is an open-source email reconnaissance tool that queries numerous third-party services to check account registration status. Because it contacts dozens of APIs simultaneously, it implements built-in throttling mechanisms to prevent blocking. Understanding how to control these limits—either by disabling them or routing around them—is essential for efficient large-scale investigations.

## Understanding Holehe's Built-In Rate Limiting

Holehe manages request velocity through a per-module flag system designed to respect service limits.

Each service module contains a `frequent_rate_limit` boolean descriptor that signals whether a particular endpoint is sensitive to rapid requests. When this flag is set to `True`, Holehe automatically injects a **1-second delay** between consecutive requests to that service. This mechanism is defined in individual module files such as [`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py) (line 9) and [`holehe/modules/social_media/wattpad.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/wattpad.py) (line 9), where the flag appears as a module-level constant.

The central CLI entry point in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) parses user arguments and coordinates these delays across the asynchronous request pool.

## Methods to Bypass or Disable Rate Limits

To bypass rate limits with Holehe effectively, you have three primary technical approaches ranging from simple flag toggles to infrastructure-level routing.

### Disable Automatic Throttling with `--no-rate-limit`

The most direct method to bypass rate limits is invoking the CLI with the `--no-rate-limit` flag. According to the argument parsing section in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), this option disables the automatic 1-second pause for all services marked with `frequent_rate_limit = True`.

When active, Holehe fires requests at maximum concurrency without internal delays. Use this only when you have external rate-limit mitigation in place, such as proxy rotation or whitelisted IP pools.

### Route Traffic Through Proxies

To avoid per-IP rate limits enforced by third-party APIs, combine `--no-rate-limit` with the `--proxy` option. This configuration spreads the burst traffic across multiple exit nodes, making each request appear to originate from a different client.

Holehe supports standard HTTP/HTTPS proxy protocols via the CLI, allowing integration with rotating proxy services or Tor.

### Use Custom API Credentials

Some modules support authentication via API keys or bearer tokens. You can inject these credentials using the `--header` option to bypass strict anonymous rate limits that apply to unauthenticated requests.

Passing a custom `Authorization` header often grants higher tier rate limits or exempts you from the throttling applied to standard detection checks.

## Practical Implementation Examples

The following commands demonstrate how to bypass rate limits with Holehe using different strategies:

```bash

# Default behavior with built-in throttling

holehe -u user@example.com

```

```bash

# Disable automatic delays (use with caution)

holehe -u user@example.com --no-rate-limit

```

```bash

# Combine disabled throttling with proxy rotation

holehe -u user@example.com --no-rate-limit \
       --proxy http://127.0.0.1:8080

```

```bash

# Inject API credentials to bypass anonymous limits

holehe -u user@example.com \
       --header "Authorization: Bearer YOUR_API_TOKEN"

```

## Risks and Best Practices

Bypassing rate limits carries significant operational risks. When you disable throttling without proper infrastructure, services will likely return **HTTP 429 (Too Many Requests)** responses or temporarily blacklist your IP address.

**Best practices** when attempting to bypass Holehe rate limits include:

- **Rotating proxies**: Never use `--no-rate-limit` from a single static IP
- **Respecting terms of service**: Ensure you have legitimate authorization to test the target services
- **Monitoring responses**: Watch for 429 status codes and implement exponential backoff if running custom scripts alongside Holehe
- **Credential management**: Store API keys securely when using `--header` injections

## Summary

- Holehe implements rate limiting via a `frequent_rate_limit` flag in modules like [`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py) and [`holehe/modules/social_media/wattpad.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/wattpad.py), which triggers 1-second delays when enabled.
- You can disable this throttling entirely using the `--no-rate-limit` flag parsed in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py).
- Combining `--no-rate-limit` with `--proxy` allows you to bypass per-IP restrictions by distributing requests across multiple addresses.
- Custom headers via `--header` enable authenticated request flows that often circumvent anonymous rate limits.
- Bypassing limits without proper proxy rotation risks IP bans and HTTP 429 errors.

## Frequently Asked Questions

### What is the `frequent_rate_limit` flag in Holehe modules?

The `frequent_rate_limit` flag is a boolean value defined in individual service modules (such as [`holehe/modules/social_media/wattpad.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/wattpad.py)) that indicates whether a particular API is sensitive to rapid sequential requests. When set to `True`, Holehe automatically adds approximately a 1-second delay between requests to that specific service to avoid triggering server-side rate limiting.

### Does using `--no-rate-limit` guarantee faster results?

While `--no-rate-limit` removes the artificial 1-second delays between requests, it does not guarantee faster results if target services enforce strict per-IP rate limiting. Without rotating proxies or authentication tokens, you may encounter HTTP 429 errors or temporary IP blocks that actually slow down your investigation or cause incomplete results.

### Can I use multiple proxies simultaneously with Holehe?

Holehe's CLI accepts a single `--proxy` argument per execution. To implement rotating proxies, you would typically configure a local proxy pool (such as Burp Suite, mitmproxy, or a rotating proxy service) at a single local address (e.g., `http://127.0.0.1:8080`), then point Holehe to that intermediary which handles the rotation logic upstream.

### Is it legal to bypass rate limits with Holehe?

The legality depends on your jurisdiction and authorization status. Bypassing technical protection mechanisms may violate the terms of service of target platforms or computer fraud statutes in some regions. Only bypass rate limits when you have explicit permission to test the target systems, such as during authorized penetration tests or investigating your own accounts.