Holehe Detection Methods Explained: Register, Login, Password Recovery, and Other Strategies

The four detection methods in holehe—"register", "login", "password‑recovery", and "other"—each use a different service endpoint to determine if an email address has an associated account, with the method attribute in each module dictating how the core engine probes the target service.

Holehe is an open-source OSINT tool by megadose that checks whether an email address is registered across hundreds of online services. Each service-specific module in holehe/modules/ implements one of four detection strategies. Understanding these holehe detection methods helps you interpret results and extend the tool with custom modules.

---

How Detection Methods Work in Holehe

The core engine in holehe/core.py discovers modules via import_submodules() and builds a callable list through get_functions(). Each module sets a method attribute that tells launch_module() which request pattern to execute. The module's async function returns a result object with fields including exists, emailrecovery, phoneNumber, and others, which print_result() renders to the user.

---

The Four Detection Method Types

Register Method

The register method attempts to create a new account using the target email. If the service responds that the email is already taken, holehe marks the account as existing.

This approach works best for services that expose a registration endpoint which explicitly validates email uniqueness. The module submits a registration form and parses the response for indicators like "email already in use" or "account exists."

# Example: a "register" style module (simplified)

async def facebook(email, client, out):
    method = "register"
    data = {"email": email, "submit": "Sign Up"}
    r = await client.post("https://facebook.com/register", data=data)
    exists = "already used" in r.text.lower()
    out.append({
        "name": "facebook",
        "domain": "facebook.com",
        "rateLimit": False,
        "error": False,
        "exists": exists,
        "emailrecovery": None,
        "phoneNumber": None,
        "others": None,
    })

Modules using this method include holehe.modules.social_media.twitter, holehe.modules.software.lastpass, and holehe.modules.porn.pornhub.

Login Method

The login method attempts to authenticate with the email address, typically without providing a password. The service's response reveals whether the account exists—for example, "incorrect password" indicates an existing account, while "email not found" indicates no account.

This method suits services that validate the email before checking the password. The module POSTs to the login endpoint and inspects error messages or response status.

# Example: a "login" style module (simplified)

async def amazon(email, client, out):
    method = "login"
    payload = {"email": email}
    r = await client.post("https://amazon.com/ap/signin", data=payload)
    exists = "incorrect password" in r.text.lower()
    out.append({
        "name": "amazon",
        "domain": "amazon.com",
        "rateLimit": False,
        "error": False,
        "exists": exists,
        "emailrecovery": None,
        "phoneNumber": None,
        "others": None,
    })

Modules with method = "login" include holehe.modules.social_media.snapchat, holehe.modules.shopping.amazon, and holehe.modules.productivity.evernote.

Password Recovery Method

The password‑recovery method initiates a "forgot password" workflow. If the service acknowledges the email—such as by sending a reset link or confirming "instructions sent"—the account is confirmed as existing.

This method excels for services that hide registration endpoints but expose password reset flows that confirm email existence. Some services inadvertently leak account status through their recovery mechanism.

# Example: a "password-recovery" style module (simplified)

async def gmail(email, client, out):
    method = "passwordrecovery"
    r = await client.post(
        "https://accounts.google.com/signup/v2/webcreateaccount",
        data={"Email": email}
    )
    exists = "account already exists" in r.text.lower()
    out.append({
        "name": "gmail",
        "domain": "gmail.com",
        "rateLimit": False,
        "error": False,
        "exists": exists,
        "emailrecovery": "⚡️",
        "phoneNumber": None,
        "others": None,
    })

Other Method

The other method serves as a catch-all for detection logic that doesn't fit the three standard patterns. Modules may query public profile pages, internal APIs, or perform custom scraping to infer email-to-account linkage.

This approach handles services where the only reliable signal is indirect—such as checking a profile page that displays the email, querying a token-based API, or parsing JavaScript-rendered content.

---

Core Engine Architecture

File	Role
holehe/core.py	Orchestrates argument parsing, module discovery via import_submodules(), async execution through launch_module(), and result rendering via print_result()
holehe/modules/**/*.py	Service-specific modules defining detection functions and method attributes
holehe/instruments.py	Provides TrioProgress for displaying async task progress
holehe/localuseragent.py	Supplies random User-Agent strings for requests

---

Summary

• Register method: Submits registration forms to detect "email already used" responses
• Login method: Attempts authentication without passwords to extract account existence from error messages
• Password‑recovery method: Triggers reset flows and interprets service acknowledgments
• Other method: Custom logic for services requiring non-standard detection approaches
• The method attribute in each module directs holehe/core.py how to execute and interpret results

---

Frequently Asked Questions

How do I know which detection method a module uses?

Check the method variable assignment in the module's source file under holehe/modules/. The value is typically set near the function definition and will be one of "register", "login", "passwordrecovery", or "other".

Can I create a custom module with a different detection approach?

Yes. Implement your detection logic in an async function, set method = "other", and ensure your function signature matches (email, client, out). Place your module in the appropriate subdirectory under holehe/modules/ and the core engine will auto-discover it via import_submodules().

Why does the same email return different results across services?

Each service implements email validation differently. Some explicitly confirm existence through registration checks, others leak information through login errors, and some protect against enumeration entirely. The method type determines which endpoint holehe targets, and services vary in what information they expose at each endpoint.

What happens if a service blocks or rate-limits the detection attempt?

Modules set rateLimit: True in their output when they detect blocking. The launch_module() function in holehe/core.py handles these flags, and print_result() communicates rate-limit status to the user. Services implementing strict rate limiting may require delays, proxy rotation, or may be undetectable with default settings.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}