# Holehe Detection Methods Explained: Register, Login, Password Recovery, and Other Strategies

> Understand holehe detection methods: register, login, password recovery, and others. Learn how each module probes target services to find email account associations.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: deep-dive
- Published: 2026-08-15

---

**The four detection methods in holehe—"register", "login", "password‑recovery", and "other"—each use a different service endpoint to determine if an email address has an associated account, with the `method` attribute in each module dictating how the core engine probes the target service.**

Holehe is an open-source OSINT tool by megadose that checks whether an email address is registered across hundreds of online services. Each service-specific module in `holehe/modules/` implements one of four detection strategies. Understanding these **holehe detection methods** helps you interpret results and extend the tool with custom modules.

---

## How Detection Methods Work in Holehe

The core engine in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) discovers modules via `import_submodules()` and builds a callable list through `get_functions()`. Each module sets a `method` attribute that tells `launch_module()` which request pattern to execute. The module's async function returns a result object with fields including `exists`, `emailrecovery`, `phoneNumber`, and `others`, which `print_result()` renders to the user.

---

## The Four Detection Method Types

### Register Method

The **register** method attempts to create a new account using the target email. If the service responds that the email is already taken, holehe marks the account as existing.

This approach works best for services that expose a registration endpoint which explicitly validates email uniqueness. The module submits a registration form and parses the response for indicators like "email already in use" or "account exists."

```python

# Example: a "register" style module (simplified)

async def facebook(email, client, out):
    method = "register"
    data = {"email": email, "submit": "Sign Up"}
    r = await client.post("https://facebook.com/register", data=data)
    exists = "already used" in r.text.lower()
    out.append({
        "name": "facebook",
        "domain": "facebook.com",
        "rateLimit": False,
        "error": False,
        "exists": exists,
        "emailrecovery": None,
        "phoneNumber": None,
        "others": None,
    })

```

Modules using this method include `holehe.modules.social_media.twitter`, `holehe.modules.software.lastpass`, and `holehe.modules.porn.pornhub`.

### Login Method

The **login** method attempts to authenticate with the email address, typically without providing a password. The service's response reveals whether the account exists—for example, "incorrect password" indicates an existing account, while "email not found" indicates no account.

This method suits services that validate the email before checking the password. The module POSTs to the login endpoint and inspects error messages or response status.

```python

# Example: a "login" style module (simplified)

async def amazon(email, client, out):
    method = "login"
    payload = {"email": email}
    r = await client.post("https://amazon.com/ap/signin", data=payload)
    exists = "incorrect password" in r.text.lower()
    out.append({
        "name": "amazon",
        "domain": "amazon.com",
        "rateLimit": False,
        "error": False,
        "exists": exists,
        "emailrecovery": None,
        "phoneNumber": None,
        "others": None,
    })

```

Modules with `method = "login"` include `holehe.modules.social_media.snapchat`, `holehe.modules.shopping.amazon`, and `holehe.modules.productivity.evernote`.

### Password Recovery Method

The **password‑recovery** method initiates a "forgot password" workflow. If the service acknowledges the email—such as by sending a reset link or confirming "instructions sent"—the account is confirmed as existing.

This method excels for services that hide registration endpoints but expose password reset flows that confirm email existence. Some services inadvertently leak account status through their recovery mechanism.

```python

# Example: a "password-recovery" style module (simplified)

async def gmail(email, client, out):
    method = "passwordrecovery"
    r = await client.post(
        "https://accounts.google.com/signup/v2/webcreateaccount",
        data={"Email": email}
    )
    exists = "account already exists" in r.text.lower()
    out.append({
        "name": "gmail",
        "domain": "gmail.com",
        "rateLimit": False,
        "error": False,
        "exists": exists,
        "emailrecovery": "⚡️",
        "phoneNumber": None,
        "others": None,
    })

```

### Other Method

The **other** method serves as a catch-all for detection logic that doesn't fit the three standard patterns. Modules may query public profile pages, internal APIs, or perform custom scraping to infer email-to-account linkage.

This approach handles services where the only reliable signal is indirect—such as checking a profile page that displays the email, querying a token-based API, or parsing JavaScript-rendered content.

---

## Core Engine Architecture

| File | Role |
|------|------|
| [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) | Orchestrates argument parsing, module discovery via `import_submodules()`, async execution through `launch_module()`, and result rendering via `print_result()` |
| `holehe/modules/**/*.py` | Service-specific modules defining detection functions and `method` attributes |
| [`holehe/instruments.py`](https://github.com/megadose/holehe/blob/main/holehe/instruments.py) | Provides `TrioProgress` for displaying async task progress |
| [`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py) | Supplies random User-Agent strings for requests |

---

## Summary

- **Register method**: Submits registration forms to detect "email already used" responses
- **Login method**: Attempts authentication without passwords to extract account existence from error messages
- **Password‑recovery method**: Triggers reset flows and interprets service acknowledgments
- **Other method**: Custom logic for services requiring non-standard detection approaches
- The `method` attribute in each module directs [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) how to execute and interpret results

---

## Frequently Asked Questions

### How do I know which detection method a module uses?

Check the `method` variable assignment in the module's source file under `holehe/modules/`. The value is typically set near the function definition and will be one of `"register"`, `"login"`, `"passwordrecovery"`, or `"other"`.

### Can I create a custom module with a different detection approach?

Yes. Implement your detection logic in an async function, set `method = "other"`, and ensure your function signature matches `(email, client, out)`. Place your module in the appropriate subdirectory under `holehe/modules/` and the core engine will auto-discover it via `import_submodules()`.

### Why does the same email return different results across services?

Each service implements email validation differently. Some explicitly confirm existence through registration checks, others leak information through login errors, and some protect against enumeration entirely. The `method` type determines which endpoint holehe targets, and services vary in what information they expose at each endpoint.

### What happens if a service blocks or rate-limits the detection attempt?

Modules set `rateLimit: True` in their output when they detect blocking. The `launch_module()` function in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) handles these flags, and `print_result()` communicates rate-limit status to the user. Services implementing strict rate limiting may require delays, proxy rotation, or may be undetectable with default settings.