# How to Filter Holehe Output for Only Websites Where Email Was Found

> Filter holehe output to see only websites where an email was found. Learn how to use the --only-used flag for precise results with the megadose/holehe tool.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-18

---

**Use the `--only-used` flag to display only websites where the target email address was detected.**

Holehe is an open-source OSINT tool by megadose that checks email addresses against hundreds of websites. By default, it prints results for every site checked, but you can filter the output to show only successful matches—sites where the email actually exists. This guide explains exactly how to use Holehe's built-in filtering capability based on the source code implementation.

## Understanding Holehe's Output Status Symbols

Before filtering, it's important to recognize how Holehe communicates results. Each checked website produces a line prefixed with a status symbol in brackets:

- `[+]` — email **used** (found on the site)
- `[-]` — email **not used** (not found)
- `[x]` — rate-limit hit (check blocked temporarily)
- `[!]` — error during check

In [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), the `print_result` function handles this output logic. The function receives a `results` dictionary containing an `"exists"` key that indicates whether the email was found. When you run Holehe without flags, every result prints regardless of status.

## Using the --only-used Flag

The simplest way to filter Holehe output is the dedicated command-line option:

```bash
holehe --only-used <email@example.com>

```

This flag is implemented in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) at lines 84–86, where the argument parser adds the `--only-used` option to the CLI:

```python
parser.add_argument("--only-used", action="store_true",
                    help="Displays only the sites where the email is used.")

```

When activated, the `print_result` function (around lines 31–38) checks `args.onlyused` and skips printing any entry where `results["exists"]` is `False`. This means only `[+]` results appear in your terminal.

### Basic Examples

Show all results (default behavior):

```bash
holehe example@example.com

```

Show only sites where email exists:

```bash
holehe --only-used example@example.com

```

Combine with other common options:

```bash
holehe --only-used --csv --no-color example@example.com

```

The `--csv` flag exports results to CSV format, while `--no-color` removes ANSI color codes for clean text processing.

## How the Filtering Works Internally

The filtering mechanism depends on two components working together:

**1. CLI Argument Parsing** ([`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), lines 84–86)

The `argparse` configuration stores the user's preference in `args.onlyused`, which propagates through the execution flow.

**2. Conditional Output Logic** ([`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), lines 31–38)

The `print_result` function evaluates each website result against this flag:

```python
if not args.onlyused:
    # Print everything (with appropriate status symbol)

    print_result(...)
elif results["exists"]:
    # Only print when email found

    print_result(...)

```

Individual site modules in `holehe/modules/` return standardized dictionaries containing the `"exists"` boolean. This modular design ensures consistent filtering across all supported platforms.

## When to Use Output Filtering

Filtered output proves valuable in several OSINT workflows:

- **Large-scale investigations** — scanning hundreds of emails where only hits matter
- **Pipeline integration** — piping results to other tools without parsing noise
- **Report generation** — creating clean evidence lists for documentation
- **Rate-limited environments** — focusing on confirmed data when checks are slow

Without filtering, you must manually scan output or use external tools like `grep "\[+\]"` to isolate successful matches. The native flag eliminates this friction.

## Summary

- **The `--only-used` flag** is the native way to filter Holehe output for email matches
- **Implementation location:** [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) (argument parser at lines 84–86, output logic at lines 31–38)
- **Mechanism:** Skips results where `results["exists"]` equals `False`, showing only `[+]` entries
- **Compatibility:** Works with all other Holehe flags including `--csv`, `--no-color`, and `--timeout`

## Frequently Asked Questions

### Can I filter output after running Holehe without the flag?

Yes, but it's less efficient. Pipe the output to grep: `holehe email@example.com | grep "\[+\]"`. However, this captures only the display output and doesn't affect CSV exports or structured data. The `--only-used` flag is the recommended approach.

### Does --only-used affect CSV export functionality?

Yes, the filter applies consistently. When using `--only-used --csv`, the resulting `.csv` file contains only websites where the email was found. The same `print_result` logic controls both terminal and file output according to the source code.

### What happens if a site returns an error or rate limit with --only-used enabled?

Those entries are suppressed entirely. Only confirmed finds (`[+]`) display. If you need to troubleshoot check failures, run Holehe without the filter to see `[x]` (rate limits) and `[!]` (errors) statuses.

### Is there a performance benefit to using --only-used?

Minimal direct performance gain—the tool still checks all configured sites. However, reduced console output lowers I/O overhead slightly and significantly improves readability for human analysts reviewing results.