# Holehe Detection Methods Explained: Login, Register, and Password Recovery Checks

> Discover Holehe detection methods for login, register, and password recovery. Learn how this tool checks over 100 services to identify email account associations.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: deep-dive
- Published: 2026-08-15

---

**Holehe uses four distinct detection methods—`login`, `register`, `password recovery`, and `other`—to determine whether an email address is associated with accounts across 100+ online services.**

Holehe is an open-source OSINT tool developed by megadose that checks if an email address is registered on various websites. Each service module declares a **`method`** attribute that tells the engine exactly how to probe for account existence without actually signing in. Understanding these detection methods helps security researchers, penetration testers, and OSINT analysts interpret results accurately and choose the right probes for their investigations.

---

## The Four Detection Methods in Holehe

Every module in `holehe/modules/` defines a `method` class attribute that determines which technique the [`core.py`](https://github.com/megadose/holehe/blob/main/core.py) dispatcher uses. Here are the four methods implemented in the codebase:

### Login Detection Method

The **`login`** method attempts authentication with the supplied email and a dummy password. If the server responds with "wrong password" or similar rather than "email not found," the address is confirmed as registered.

**Implementation pattern:**
- Sends `POST /login` or `GET /auth` with email in payload
- Parses error messages for existence indicators ("incorrect password," "email exists," etc.)
- Never completes actual authentication

**Example modules using login detection:**

| Service | File Path |
|---------|-----------|
| Snapchat | [`holehe/modules/social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/snapchat.py) |
| Patreon | [`holehe/modules/social_media/patreon.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/patreon.py) |
| Amazon | [`holehe/modules/shopping/amazon.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/shopping/amazon.py) |

These modules target services that expose sign-in endpoints but restrict account creation (invite-only or closed registration).

---

### Register Detection Method

The **`register`** method initiates a new account creation flow. If the server reports the email is already taken, Holehe marks the address as present.

**Implementation pattern:**
- Submits `POST /register` or `GET /signup` with email
- Captures responses like "already registered" or "email already in use"
- Abandons flow before account creation completes

**Example modules using register detection:**

| Service | File Path |
|---------|-----------|
| Blablacar | [`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py) |
| Tumblr | [`holehe/modules/social_media/tumblr.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/tumblr.py) |
| Facebook | [`holehe/modules/social_media/facebook.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/facebook.py) |

This method works best on platforms with open registration where anyone can attempt to create an account.

---

### Password Recovery Detection Method

The **`password recovery`** method triggers a forgot-password flow. The server's response—whether it claims to send a reset link or reports the email as unknown—reveals account status.

**Implementation pattern:**
- Calls `POST /password-recovery` or `GET /reset` endpoints
- Interprets confirmations ("reset link sent") or errors ("email not found")
- Does not actually trigger email delivery in most implementations

**Example modules using password recovery detection:**

| Service | File Path |
|---------|-----------|
| Adobe | [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py) |
| Odnoklassniki | [`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py) |
| Samsung | [`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py) |

Services without accessible login or registration probes often expose this vector through their account recovery flows.

---

### Other Detection Method

The **`other`** method serves as a fallback category for custom heuristics that don't fit the three standard patterns. These modules may check public profile pages, API endpoints, or service-specific behaviors.

**Notable example:**

- **Office 365** ([`holehe/modules/software/office365.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/office365.py))—uses tenant discovery endpoints rather than authentication flows

This method is rarely used; most services map cleanly to one of the three primary detection patterns.

---

## How Detection Methods Work in Practice

Each module follows a consistent structure, as shown in this simplified pattern from [`holehe/modules/social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/snapchat.py):

```python
class Snapchat:
    method = "login"  # Detection method declaration

    
    async def request(self, client, email):
        # Build and send probe request

        # Parse response for existence indicators

        # Return standardized result dict

        pass

```

The [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) dispatcher loads all modules, reads their `method` attribute, and executes the appropriate request routine. Results return as standardized dictionaries containing:

- `email`: queried address
- `status`: `"present"` or `"absent"`
- `type`: detection method used (`login`, `register`, or `password recovery`)

---

## Command-Line Usage by Detection Method

Holehe's CLI supports filtering by detection method to speed up scans or target specific probe types:

```bash

# Default scan using all detection methods

holehe -l alice@example.com

# Scan only login-based probes

holehe -l alice@example.com --method login

# Restrict to register detection only

holehe -l alice@example.com --only-register

```

---

## Programmatic API Access

For integration into larger workflows, the detection methods are accessible through Holehe's Python API:

```python
import asyncio
from holehe import core

async def check_email_probes(email):
    """Check email against all Holehe detection methods."""
    results = await core.check_email(email)
    
    for service, data in results.items():
        print(f"{service}: {data['status']} (via {data['type']})")

# Execute scan

asyncio.run(check_email_probes("alice@example.com"))

```

The `core.check_email()` function automatically iterates through all modules, respecting each one's declared detection method.

---

## Summary

- **Four detection methods** power Holehe's email enumeration: `login`, `register`, `password recovery`, and `other`
- Each module declares its **method attribute** in `holehe/modules/` subdirectories by service category
- **Login detection** probes authentication endpoints with dummy credentials
- **Register detection** attempts account creation to trigger "already exists" responses
- **Password recovery detection** abuses forgot-password flows to confirm account linkage
- Results standardize across all methods into `present`/`absent` status with method provenance

---

## Frequently Asked Questions

### What is the most reliable detection method in Holehe?

**Login detection** generally provides the highest confidence because authentication endpoints are explicitly designed to validate account existence. However, rate limiting and CAPTCHA protections often make register and password recovery methods more practical for high-volume scanning. The best method depends on the target service's defensive posture.

### Can services block Holehe detection methods?

Yes. Services implement various countermeasures: IP-based rate limiting, CAPTCHA challenges, requiring JavaScript execution, or returning ambiguous error messages. The `method` abstraction allows Holehe contributors to switch detection vectors when one path becomes unreliable—moving from login to register detection, for example.

### How does Holehe choose which detection method to use for a service?

Module authors select the **method** attribute based on which endpoint provides the cleanest existence signal. According to the megadose/holehe source code, this is determined during module development by manually testing each service's responses. The [`core.py`](https://github.com/megadose/holehe/blob/main/core.py) dispatcher respects this declaration without override capability in standard usage.

### Why would I filter scans by detection method?

Filtering reduces **time-to-result** and **operational footprint**. Login probes may trigger security alerts more readily than register checks. Password recovery flows sometimes bypass stricter authentication protections. Targeting specific methods also helps validate findings—cross-referencing login-detected accounts against register probes increases confidence in positive matches.