How to Use holehe from the Command Line: Complete OSINT Email Scanning Guide

holehe is an asynchronous Python OSINT tool that checks if an email address is registered across 120+ online services via a simple command-line interface with optional CSV export and filtering.

The megadose/holehe repository provides a robust command-line utility for digital investigations and reconnaissance. When you use holehe from the command line, you trigger an asynchronous workflow that queries "forgot password" endpoints to verify account existence without sending notifications to the target address.

Basic Syntax and Prerequisites

Ensure holehe is installed via pip before executing commands. The CLI entry point is defined in holehe/core.py, where holehe.main() delegates control to the async maincore() function.

The positional argument structure follows this pattern:

holehe [email@address.com] [options]

Core Command Line Options

The ArgumentParser in holehe/core.py (lines 80-96) requires a target email address and supports several optional flags that control result filtering and output formatting.

Running a Basic Email Scan

To check a single email against all supported platforms, provide the address as the sole positional argument:

holehe test@example.com

This command initiates the full scanning pipeline: import_submodules() discovers all modules under holehe/modules, get_functions() filters them into callables (lines 37-64), and each checker executes concurrently via launch_module().

Filtering for Active Accounts Only

To display only services where the email is actually registered, append the --only-used flag:

holehe test@example.com --only-used

This option filters the final result set after all asynchronous tasks complete, suppressing negative matches and showing only confirmed registrations.

Controlling Output Format

For log files or CI/CD environments where ANSI colors cause formatting issues, disable colored output with --no-color:

holehe test@example.com --no-color

To export results for spreadsheet analysis or reporting, use the --csv flag:

holehe test@example.com --csv

Understanding the Asynchronous Architecture

When you invoke holehe from the terminal, maincore() orchestrates a five-stage asynchronous workflow defined in holehe/core.py:

1. Argument validation – The ArgumentParser verifies the email format and parses optional flags.
2. Module discovery – import_submodules() dynamically loads all sub-modules under holehe/modules, while get_functions() extracts the service-specific check functions.
3. HTTP client setup – An httpx.AsyncClient is instantiated for efficient, connection-pooled HTTP/2 requests.
4. Concurrent execution – Each service checker runs inside launch_module() within a Trio nursery (lines 166-173), enabling parallel execution across 120+ platforms while managing rate limits.
5. Result processing – After the nursery closes, results sort alphabetically and print with status symbols (✅, ❌, or ⚠️) before optional CSV export.

Advanced Usage and Flag Combinations

You can chain multiple options to customize both the scan scope and output destination:

holehe test@example.com --only-used --no-color --csv

This combination exports only confirmed accounts to CSV format without color codes, ideal for automated logging or integration with other reconnaissance tools.

Summary

• Entry point: The holehe command calls maincore() in holehe/core.py (lines 32-34) through the Trio async framework.
• Target specification: Provide exactly one email address as the required positional argument.
• Filtering: Use --only-used to show only services where the email is registered.
• Output control: --no-color disables terminal colors, and --csv enables spreadsheet export.
• Concurrency: The tool leverages httpx.AsyncClient and Trio nurseries to parallelize checks across all available modules without manual configuration.

Frequently Asked Questions

How does holehe check so many services simultaneously?

According to the megadose/holehe source code in holehe/core.py, the tool creates an httpx.AsyncClient and launches each service module inside a Trio nursery via launch_module() (lines 166-173). This architecture enables concurrent HTTP requests while the async event loop manages connection pooling and rate limiting across all 120+ platforms.

Why does holehe scan every available service instead of specific ones?

The import_submodules() function dynamically imports all Python files under holehe/modules and get_functions() extracts their check functions (lines 37-64). This design ensures comprehensive OSINT coverage by default, running every available "forgot password" check without requiring users to manually specify target services.

Can I run holehe in automated scripts or pipelines?

Yes. The --no-color flag removes ANSI escape sequences for plain-text logging, and --csv generates machine-readable output suitable for data processing. These options, implemented in the ArgumentParser (lines 80-96), make holehe compatible with cron jobs, CI/CD pipelines, and automated reconnaissance workflows.

Does the CLI support checking multiple emails in one command?

The current implementation in maincore() accepts only a single positional email argument. For batch processing multiple addresses, you must invoke the command sequentially within a shell loop or script, as the underlying architecture processes one target email per execution context.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}