What Does the --no-password-recovery Flag Do in Holehe?

The --no-password-recovery flag disables Holehe's attempts to use password-recovery endpoints when checking an email address, skipping four specific modules that rely on this verification method.

Holehe is an open-source email OSINT tool developed by megadose that checks if an email address is registered on various websites. By default, it employs multiple verification techniques—including direct registration checks and password-recovery flows—to maximize coverage. The --no-password-recovery flag gives you granular control over which methods are used during a scan.

How the Flag Works in Holehe's Core Module

The flag's behavior originates in holehe/core.py, where both the CLI argument definition and the filtering logic reside.

Argument Parser Definition

In holehe/core.py at lines 190-191, the argument is registered with a clear description:

Do not try password recovery on the websites

This defines the flag's purpose at the CLI level. The argument stores a boolean value accessible via args.nopasswordrecovery.

Module Filtering Logic

The actual filtering occurs in the get_functions helper at holehe/core.py lines 58-62. When args.nopasswordrecovery evaluates to True, the function excludes any module whose method attribute equals "password recovery".

This is a straightforward string comparison that happens before the async execution loop begins, ensuring no password-recovery requests are dispatched.

Which Modules Are Filtered Out

Four modules implement the password-recovery verification method and are consequently skipped when the flag is active:

Module	File Path	Service Type
adobe	holehe/modules/software/adobe.py	Software
mail_ru	holehe/modules/mails/mail_ru.py	Email Provider
odnoklassniki	holehe/modules/social_media/odnoklassniki.py	Social Media
samsung	holehe/modules/products/samsung.py	Product/Service

Each of these files contains the line method = "password recovery" that identifies it for filtering. This metadata attribute is checked against the user's CLI flag to determine inclusion.

Practical Usage Examples

Run Holehe with default behavior (includes password-recovery checks):

holehe -e example@example.com

Run Holehe while disabling password-recovery attempts:

holehe -e example@example.com --no-password-recovery

The same command using the short flag alias:

holehe -e example@example.com -NP

In both restricted examples, Holehe continues checking against all other services in its module library—only the four password-recovery modules are excluded from execution.

When to Use --no-password-recovery

Consider enabling this flag in the following scenarios:

• Rate-limit concerns: Password-recovery endpoints often have stricter rate limiting than other verification methods; skipping them reduces ban risk
• Speed optimization: Eliminates four HTTP request sequences, marginally improving scan duration
• Operational security: Some practitioners prefer to avoid password-recovery flows that may trigger account security notifications or emails
• Targeted reconnaissance: When you only need registration status without the additional context password-recovery might provide

Summary

• The --no-password-recovery flag in Holehe filters out modules using password-recovery verification
• It is defined in holehe/core.py and implemented via the get_functions helper at lines 58-62
• Four modules are excluded: adobe, mail_ru, odnoklassniki, and samsung
• Use the short form -NP or the full --no-password-recovery syntax
• The flag improves speed and reduces rate-limit exposure while maintaining coverage across all other service checks

Frequently Asked Questions

What happens if I don't use the --no-password-recovery flag?

Holehe runs its complete default module set, including all four password-recovery modules. This provides maximum coverage but may increase request volume and trigger stricter rate limits on certain services.

Does --no-password-recovery affect other verification methods?

No. The flag exclusively targets modules with method = "password recovery". All other verification strategies—including direct login page analysis, API endpoint checks, and registration form probing—continue to execute normally.

Is there a performance difference with --no-password-recovery enabled?

Yes, though typically minor. You eliminate four HTTP request sequences per target email. For single-email scans the difference is negligible; for bulk operations the cumulative savings become more significant.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}