# What Detection Methods Does Holehe Use Besides Registration Checks?

> Discover Holehe's advanced email detection methods beyond registration checks. Learn about login probing, password recovery, and API requests for service verification without account creation.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: deep-dive
- Published: 2026-09-10

---

**Holehe employs four distinct detection strategies—registration checks, login probing, password recovery flows, and bespoke API requests—to determine if an email address is associated with online services without ever creating an actual account.**

Holehe is an open-source email reconnaissance tool developed by megadose that verifies whether an address is registered across hundreds of online platforms. While many assume it only relies on signup forms, the `megadose/holehe` codebase implements multiple probing vectors to maximize coverage. Each module in `holehe/modules/` explicitly declares its detection technique via a `method` string, enabling the core engine to orchestrate diverse validation strategies uniformly.

## The Four Detection Strategies in Holehe

### Registration Availability (register)

The most common technique involves simulating account creation attempts. In [`holehe/modules/transport/blablacar.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/transport/blablacar.py), the tool either submits a registration request or queries a dedicated "check-email-available" endpoint. When the service responds that the email is already in use, Holehe flags the address as associated with that platform. This method relies on the fact that most services expose a quick "email-already-used" response during the signup flow.

### Login Endpoint Probing (login)

For services that leak existence data through authentication errors, Holehe transmits login requests with dummy credentials. The Snapchat module in [`holehe/modules/social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/snapchat.py) demonstrates this approach by sending the target email paired with an invalid password. The server's error response—distinguishing between "account does not exist" and "incorrect password"—reveals whether the email is registered without requiring valid login credentials.

### Password Recovery Exploitation (password recovery)

Some services expose account existence through their "forgot password" workflows. In [`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py), the module invokes the account recovery endpoint and analyzes the response. If the service returns a confirmation message, security hints, or recovery options, the email is confirmed as registered; unknown addresses typically receive a "not found" or "no account associated" response. This method proves effective when registration and login endpoints are hardened against enumeration.

### Custom API Validation (other)

Certain platforms require unique validation logic that does not fit standardized patterns. The Office 365 check in [`holehe/modules/software/office365.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/office365.py) uses bespoke API calls that return boolean existence flags for organizational tenants. These implementations are categorized under `method = "other"`, allowing authors to devise service-specific requests while maintaining compatibility with the core reporting structure.

## How the Core Engine Orchestrates Detection Methods

The `maincore()` function in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) serves as the asynchronous execution engine that coordinates all detection methods. It dynamically imports every module via `import_submodules("holehe.modules")`, extracts callable functions using `get_functions`, and dispatches them concurrently through `launch_module`.

Each module returns a standardized result dictionary that always contains a `method` field (e.g., `method = "login"`). This design ensures consistent output formatting across all detection strategies, regardless of whether the underlying check exploited a registration form, login error, or recovery flow. The core driver aggregates these results and displays them uniformly, whether the match came from BlaBlaCar's registration endpoint or Adobe's password recovery system.

Support utilities enhance these probing capabilities. The [`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py) file supplies realistic User-Agent strings to avoid trivial fingerprinting, while [`holehe/instruments.py`](https://github.com/megadose/holehe/blob/main/holehe/instruments.py) provides progress-bar instrumentation for the asynchronous runner.

## Practical Usage Examples

Execute Holehe from the command line to run all detection methods against a target address:

```bash

# Basic usage – check an email against every supported service

holehe alice@example.com

# Show only the services where the address is known

holehe alice@example.com --only-used

# Suppress color output (useful for pipelines)

holehe alice@example.com --no-color

# Export the full result set to CSV

holehe alice@example.com --csv

```

The CLI invokes `maincore()` to run modules asynchronously, collecting results that include the specific detection method used for each positive match.

## Summary

- Holehe categorizes every service check into one of four methods: **register**, **login**, **password recovery**, or **other**.
- Each module explicitly defines its technique via a `method` variable (e.g., `method = "login"` in [`social_media/snapchat.py`](https://github.com/megadose/holehe/blob/main/social_media/snapchat.py)), allowing the tool to select the most reliable vector for each platform.
- The asynchronous engine in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) executes all checks concurrently via `launch_module`, normalizing results regardless of whether they originated from registration forms or recovery endpoints.
- Auxiliary components like [`localuseragent.py`](https://github.com/megadose/holehe/blob/main/localuseragent.py) provide rotation capabilities to prevent blocking during these enumeration attempts.

## Frequently Asked Questions

### Does Holehe actually create accounts when using the register method?

No. The tool only simulates the initial registration request or queries dedicated availability endpoints without completing account creation. It interprets "email already taken" or similar HTTP responses as confirmation that the address is registered, then immediately discards the session.

### How does Holehe avoid rate limiting when probing login endpoints?

The codebase employs asynchronous concurrency controls and rotates realistic User-Agent strings via [`holehe/localuseragent.py`](https://github.com/megadose/holehe/blob/main/holehe/localuseragent.py). While this helps avoid trivial blocks, the tool performs rapid requests across hundreds of services, so users should implement appropriate delays and respect target platform terms of service.

### What determines which detection method a specific module uses?

Module authors select the technique based on the target service's API behavior and security posture. If a service exposes a password reset flow that reveals account existence (like Adobe), the module uses `method = "password recovery"`; if login error messages leak existence data (like Snapchat), it uses `method = "login"` instead.

### Can I see which detection method was used for each service result?

Yes. Every result dictionary returned by the core engine includes a `method` field indicating whether the match came from "register", "login", "password recovery", or "other" checks. This metadata appears in standard CLI output and remains available when exporting results to CSV using the `--csv` flag.