# What Does the --no-password-recovery Flag Do in Holehe?

> Learn what the --no-password-recovery flag does in Holehe. This flag disables password recovery checks, speeding up email address verification by skipping specific modules.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-15

---

**The `--no-password-recovery` flag disables Holehe's attempts to use password-recovery endpoints when checking an email address, skipping four specific modules that rely on this verification method.**

Holehe is an open-source email OSINT tool developed by megadose that checks if an email address is registered on various websites. By default, it employs multiple verification techniques—including direct registration checks and password-recovery flows—to maximize coverage. The `--no-password-recovery` flag gives you granular control over which methods are used during a scan.

## How the Flag Works in Holehe's Core Module

The flag's behavior originates in **[holehe/core.py](https://github.com/megadose/holehe/blob/master/holehe/core.py)**, where both the CLI argument definition and the filtering logic reside.

### Argument Parser Definition

In **[holehe/core.py at lines 190-191](https://github.com/megadose/holehe/blob/master/holehe/core.py#L190-L191)**, the argument is registered with a clear description:

```

Do not try password recovery on the websites

```

This defines the flag's purpose at the CLI level. The argument stores a boolean value accessible via `args.nopasswordrecovery`.

### Module Filtering Logic

The actual filtering occurs in the `get_functions` helper at **[holehe/core.py lines 58-62](https://github.com/megadose/holehe/blob/master/holehe/core.py#L58-L62)**. When `args.nopasswordrecovery` evaluates to `True`, the function excludes any module whose `method` attribute equals `"password recovery"`.

This is a straightforward string comparison that happens before the async execution loop begins, ensuring no password-recovery requests are dispatched.

## Which Modules Are Filtered Out

Four modules implement the password-recovery verification method and are consequently skipped when the flag is active:

| Module | File Path | Service Type |
|--------|-----------|--------------|
| **adobe** | [holehe/modules/software/adobe.py](https://github.com/megadose/holehe/blob/master/holehe/modules/software/adobe.py) | Software |
| **mail_ru** | [holehe/modules/mails/mail_ru.py](https://github.com/megadose/holehe/blob/master/holehe/modules/mails/mail_ru.py) | Email Provider |
| **odnoklassniki** | [holehe/modules/social_media/odnoklassniki.py](https://github.com/megadose/holehe/blob/master/holehe/modules/social_media/odnoklassniki.py) | Social Media |
| **samsung** | [holehe/modules/products/samsung.py](https://github.com/megadose/holehe/blob/master/holehe/modules/products/samsung.py) | Product/Service |

Each of these files contains the line `method = "password recovery"` that identifies it for filtering. This metadata attribute is checked against the user's CLI flag to determine inclusion.

## Practical Usage Examples

Run Holehe with default behavior (includes password-recovery checks):

```bash
holehe -e example@example.com

```

Run Holehe while disabling password-recovery attempts:

```bash
holehe -e example@example.com --no-password-recovery

```

The same command using the short flag alias:

```bash
holehe -e example@example.com -NP

```

In both restricted examples, Holehe continues checking against all other services in its module library—only the four password-recovery modules are excluded from execution.

## When to Use --no-password-recovery

Consider enabling this flag in the following scenarios:

- **Rate-limit concerns**: Password-recovery endpoints often have stricter rate limiting than other verification methods; skipping them reduces ban risk
- **Speed optimization**: Eliminates four HTTP request sequences, marginally improving scan duration
- **Operational security**: Some practitioners prefer to avoid password-recovery flows that may trigger account security notifications or emails
- **Targeted reconnaissance**: When you only need registration status without the additional context password-recovery might provide

## Summary

- The `--no-password-recovery` flag in Holehe filters out modules using password-recovery verification
- It is defined in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) and implemented via the `get_functions` helper at lines 58-62
- Four modules are excluded: **adobe**, **mail_ru**, **odnoklassniki**, and **samsung**
- Use the short form `-NP` or the full `--no-password-recovery` syntax
- The flag improves speed and reduces rate-limit exposure while maintaining coverage across all other service checks

## Frequently Asked Questions

### What happens if I don't use the --no-password-recovery flag?

Holehe runs its complete default module set, including all four password-recovery modules. This provides maximum coverage but may increase request volume and trigger stricter rate limits on certain services.

### Does --no-password-recovery affect other verification methods?

No. The flag exclusively targets modules with `method = "password recovery"`. All other verification strategies—including direct login page analysis, API endpoint checks, and registration form probing—continue to execute normally.

### Is there a performance difference with --no-password-recovery enabled?

Yes, though typically minor. You eliminate four HTTP request sequences per target email. For single-email scans the difference is negligible; for bulk operations the cumulative savings become more significant.