# What Is the Forgotten Password Function in Holehe and How Does It Work?

> Discover the forgotten password function in Holehe an OSINT technique that checks email registration on services by abusing password reset endpoints. Learn how it works and its purpose.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-09-01

---

**The forgotten password function in Holehe is an OSINT technique that abuses password-reset endpoints to verify whether an email address is registered on a service without authenticating.**

Holehe is an open-source reconnaissance tool developed by **megadose** that determines email address presence across hundreds of online platforms. Rather than attempting login brute-forcing, it exploits a common service behavior: password-reset endpoints typically validate email addresses and return distinct responses for registered versus unknown accounts. This article explains how Holehe implements this technique, with reference to actual source code from the repository.

## Why Services Expose Email Verification via Password Reset

Most web applications provide a "Forgot Password" flow to help users regain account access. These endpoints accept an email address and return a success message if the account exists, or an error if it does not. **Holehe capitalizes on this discrepancy to perform email enumeration at scale** without triggering account lockouts or rate limits associated with authentication attempts.

According to the repository's own description in [`setup.py`](https://github.com/megadose/holehe/blob/main/setup.py):

```python
"holehe allows you to check if the mail is used on different sites like twitter, instagram, snapchat and will retrieve information on sites with the forgotten password function."

```

This capability is reiterated in the README, which lists as a core feature: *"+ Retrieves information using the **forgotten password function**."*

## How the Forgotten Password Check Is Implemented

Each Holehe module targets a specific service and implements its own password-reset probing logic. The general pattern involves:

1. **Constructing a request** to the service's password-reset endpoint
2. **Parsing the response** for indicators of account existence
3. **Returning a structured result** indicating whether the email is registered

### Concrete Example: The Samsung Module

The **Samsung module** demonstrates this technique explicitly. Located at [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py), it sends a POST request to Samsung's password-reset endpoint and interprets the response.

Key implementation details from lines 75-94:

- **Endpoint**: `https://account.samsung.com/accounts/v1/DCGLIT/resetPassword`
- **Method**: `POST` with email in request body
- **Detection logic**: Response status code and body content distinguish between registered and unknown emails

The module structure follows this pattern:

```python

# Conceptual representation based on samsung.py implementation

async def check_email(self, email, client):
    """Probe Samsung account existence via password reset endpoint."""
    
    # Prepare payload for password reset request

    payload = {
        "email": email,
        # Additional required parameters (CSRF tokens, etc.)

    }
    
    # Send request to Samsung's reset endpoint

    response = await client.post(
        "https://account.samsung.com/accounts/v1/DCGLIT/resetPassword",
        data=payload,
        follow_redirects=True
    )
    
    # Parse response indicators

    if response.status_code == 200:
        # Check response body for success/failure markers

        result_text = await response.text()
        return {
            "exists": "account exists" in result_text.lower() or 
                      "verification" in result_text.lower(),
            "source": "forgotten_password_endpoint"
        }
    
    return {"exists": False, "source": "forgotten_password_endpoint"}

```

## Core Architecture: How Modules Are Orchestrated

The [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) file manages module execution. It coordinates concurrent checks across all configured services, aggregating results into a unified output. When you invoke Holehe programmatically:

```python
import asyncio
from holehe.core import Core

# Initialize with target email

core = Core("target@example.com")

# Execute all module checks concurrently

results = asyncio.run(core.run())

# Process results

for platform, data in results.items():
    if data.get("exists"):
        print(f"[+] Account found on {platform}")
        print(f"    Confidence: {data.get('confidence', 'medium')}")
        print(f"    Source: {data.get('source', 'unknown')}")

```

Each module in `holehe/modules/` follows a consistent interface, implementing an asynchronous `check_email` or similar method that returns a standardized dictionary with keys including `exists`, `source`, and optionally `profile_info`.

## Common Response Patterns Across Services

Different services leak email existence through varying mechanisms. Holehe modules account for these variations:

| Pattern | Detection Method | Example Services |
|---------|---------------|----------------|
| **Direct confirmation message** | String match on "password reset sent" | Generic PHP-based platforms |
| **Response timing** | Time-based side channel (registered = slower) | Some Django applications |
| **Status code differentiation** | HTTP 200 vs 404/400 | REST API-based services |
| **Redirect behavior** | URL path changes on success | Legacy ASP.NET applications |
| **Error code specificity** | Distinct error codes for unknown emails | Enterprise SSO providers |

Module authors reverse-engineer these behaviors through manual testing and traffic analysis, then encode the detection logic in Python.

## Practical Usage Example

To run Holehe against a target email from the command line:

```bash

# Installation

pip install holehe

# Basic usage - checks all supported platforms

holehe target@example.com

# Output includes source of detection

# [+] samsung.com - Account found (source: forgotten_password)

# [+] twitter.com - Account found (source: forgotten_password)

# [-] instagram.com - No account detected

```

The `--output` flag allows structured export (JSON/CSV) for further analysis in threat intelligence workflows.

## Security and Ethical Considerations

Holehe's forgotten password enumeration technique is **passive and non-destructive**—it does not modify account state or trigger actual password reset emails in most implementations. However, users should note:

- Some services *do* send emails during probing; use test accounts when validating
- Rate limiting may apply; the tool includes configurable delays
- This technique violates most platforms' Terms of Service; use only on authorized targets

## Summary

- **Primary purpose**: The forgotten password function in Holehe enables **email enumeration across services** by exploiting password-reset endpoint responses
- **Implementation location**: Service-specific modules in `holehe/modules/*/*.py`, with [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py) serving as a reference implementation
- **Core mechanism**: HTTP POST to reset endpoints with response analysis for account-existence indicators
- **Orchestration**: [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) manages concurrent execution across all platform modules
- **Documentation**: Explicitly described in [`setup.py`](https://github.com/megadose/holehe/blob/main/setup.py) (line 12) and [`README.md`](https://github.com/megadose/holehe/blob/main/README.md) (line 18) as a core reconnaissance technique

## Frequently Asked Questions

### How does Holehe's forgotten password technique differ from traditional credential stuffing?

**Credential stuffing** involves submitting known username-password pairs from breached databases. Holehe's **forgotten password enumeration** requires no password knowledge—it probes whether an email is registered by analyzing how services respond to reset requests. This produces fewer security alerts and avoids account lockout policies.

### Can services prevent this type of email enumeration?

Services can mitigate this by returning **identical responses** regardless of email registration status (e.g., "If an account exists, a reset email has been sent"). However, **timing side channels** and **out-of-band email delivery** often still leak information. Proper implementation requires careful attention to response uniformity, timing consistency, and logging behavior.

### Does Holehe trigger actual password reset emails when probing?

Behavior varies by module implementation. Most Holehe modules use **null-routed or test-mode parameters** where possible, or analyze pre-submit validation responses. Some services, however, send emails regardless. The Samsung module specifically (lines 75-94) targets an endpoint that validates email format and existence before triggering email dispatch.