How to Filter Holehe Output for Only Websites Where Email Was Found

Use the --only-used flag to display only websites where the target email address was detected.

Holehe is an open-source OSINT tool by megadose that checks email addresses against hundreds of websites. By default, it prints results for every site checked, but you can filter the output to show only successful matches—sites where the email actually exists. This guide explains exactly how to use Holehe's built-in filtering capability based on the source code implementation.

Understanding Holehe's Output Status Symbols

Before filtering, it's important to recognize how Holehe communicates results. Each checked website produces a line prefixed with a status symbol in brackets:

• [+] — email used (found on the site)
• [-] — email not used (not found)
• [x] — rate-limit hit (check blocked temporarily)
• [!] — error during check

In holehe/core.py, the print_result function handles this output logic. The function receives a results dictionary containing an "exists" key that indicates whether the email was found. When you run Holehe without flags, every result prints regardless of status.

Using the --only-used Flag

The simplest way to filter Holehe output is the dedicated command-line option:

holehe --only-used <email@example.com>

This flag is implemented in holehe/core.py at lines 84–86, where the argument parser adds the --only-used option to the CLI:

parser.add_argument("--only-used", action="store_true",
                    help="Displays only the sites where the email is used.")

When activated, the print_result function (around lines 31–38) checks args.onlyused and skips printing any entry where results["exists"] is False. This means only [+] results appear in your terminal.

Basic Examples

Show all results (default behavior):

holehe example@example.com

Show only sites where email exists:

holehe --only-used example@example.com

Combine with other common options:

holehe --only-used --csv --no-color example@example.com

The --csv flag exports results to CSV format, while --no-color removes ANSI color codes for clean text processing.

How the Filtering Works Internally

The filtering mechanism depends on two components working together:

1. CLI Argument Parsing (holehe/core.py, lines 84–86)

The argparse configuration stores the user's preference in args.onlyused, which propagates through the execution flow.

2. Conditional Output Logic (holehe/core.py, lines 31–38)

The print_result function evaluates each website result against this flag:

if not args.onlyused:
    # Print everything (with appropriate status symbol)

    print_result(...)
elif results["exists"]:
    # Only print when email found

    print_result(...)

Individual site modules in holehe/modules/ return standardized dictionaries containing the "exists" boolean. This modular design ensures consistent filtering across all supported platforms.

When to Use Output Filtering

Filtered output proves valuable in several OSINT workflows:

• Large-scale investigations — scanning hundreds of emails where only hits matter
• Pipeline integration — piping results to other tools without parsing noise
• Report generation — creating clean evidence lists for documentation
• Rate-limited environments — focusing on confirmed data when checks are slow

Without filtering, you must manually scan output or use external tools like grep "\[+\]" to isolate successful matches. The native flag eliminates this friction.

Summary

• The --only-used flag is the native way to filter Holehe output for email matches
• Implementation location: holehe/core.py (argument parser at lines 84–86, output logic at lines 31–38)
• Mechanism: Skips results where results["exists"] equals False, showing only [+] entries
• Compatibility: Works with all other Holehe flags including --csv, --no-color, and --timeout

Frequently Asked Questions

Can I filter output after running Holehe without the flag?

Yes, but it's less efficient. Pipe the output to grep: holehe email@example.com | grep "\[+\]". However, this captures only the display output and doesn't affect CSV exports or structured data. The --only-used flag is the recommended approach.

Does --only-used affect CSV export functionality?

Yes, the filter applies consistently. When using --only-used --csv, the resulting .csv file contains only websites where the email was found. The same print_result logic controls both terminal and file output according to the source code.

What happens if a site returns an error or rate limit with --only-used enabled?

Those entries are suppressed entirely. Only confirmed finds ([+]) display. If you need to troubleshoot check failures, run Holehe without the filter to see [x] (rate limits) and [!] (errors) statuses.

Is there a performance benefit to using --only-used?

Minimal direct performance gain—the tool still checks all configured sites. However, reduced console output lowers I/O overhead slightly and significantly improves readability for human analysts reviewing results.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}