holehe is a Python-based OSINT tool that checks whether a given email address is registered on numerous popular websites and services — including social media platforms, e-commerce sites, and productivity tools. It works by abusing each service’s “forgot password” or “account registration” endpoints, which frequently leak whether an email is already associated with an account (via subtly different response messages, status codes, or timing) without ever needing valid credentials. Holehe is a fast, lightweight complement to username-based tools like Sherlock, focusing specifically on email-to-account correlation.
Installation
# Kali/Debian (pre-installed, or reinstall)
sudo apt update && sudo apt install holehe -y
# Via pip (any platform with Python 3)
pip3 install holehe --break-system-packages
# From source
git clone https://github.com/megadose/holehe.git
cd holehe
python3 setup.py install
Verify installation:
holehe --help
Syntax
holehe [OPTIONS] EMAIL
Command-Line Options
| Flag | Description |
|---|---|
EMAIL | The target email address to check (positional argument) |
-C, --csv | Export results in CSV format |
-j, --json | Export results in JSON format |
-o, --output FILE | Write output to a specified file |
--only-used | Show only sites where the email is registered (hide “not used”/”rate limited” entries) |
-nc, --no-color | Disable colored terminal output |
-t, --timeout SEC | Set timeout in seconds for each site’s request |
-N, --no-clear | Do not clear the terminal before displaying results |
-M, --modules | Show a list of all supported modules/websites Holehe can check against |
Basic Usage
holehe target@gmail.com
Expected output:
*********************************
target@gmail.com
*********************************
[+] Twitter
[+] Instagram
[+] Spotify
[-] Pinterest
[x] Adobe (rate limited)
email used : 3
email not used : 1
rate limit : 1
Practical Examples
Example 1 — Basic email check
holehe johnsmith@gmail.com
[+] Twitter
[+] GitHub
[-] Pinterest
email used : 2
email not used : 1
Example 2 — Showing only sites where the email is used
holehe johnsmith@gmail.com --only-used
[+] Twitter
[+] GitHub
Example 3 — Exporting results to CSV
holehe johnsmith@gmail.com --csv
cat johnsmith_gmail_com.csv
email,domain,exists,rateLimit,emailrecovery,phoneNumber,others
johnsmith@gmail.com,twitter.com,True,False,,,
johnsmith@gmail.com,pinterest.com,False,False,,,
Example 4 — Exporting results to JSON
holehe johnsmith@gmail.com --json > results.json
cat results.json
[
{"name": "twitter", "domain": "twitter.com", "exists": true},
{"name": "pinterest", "domain": "pinterest.com", "exists": false}
]
Example 5 — Listing all supported modules
holehe --modules
Modules available: 120
adobe.py
amazon.py
github.com
instagram.py
spotify.py
twitter.py
...
Example 6 — Setting a custom timeout for slow networks
holehe johnsmith@gmail.com -t 15
[+] Twitter
[+] Spotify
email used : 2
Example 7 — Saving output to a plain text file
holehe johnsmith@gmail.com -o johnsmith_results.txt
cat johnsmith_results.txt
[+] Twitter
[+] GitHub
[-] Pinterest
Example 8 — Checking multiple emails in a simple loop
for email in john@gmail.com jane@gmail.com; do
echo "=== $email ==="
holehe "$email" --only-used
done
=== john@gmail.com ===
[+] Twitter
[+] GitHub
=== jane@gmail.com ===
[+] Instagram
[+] Pinterest
Common Use Cases
- Rapidly determining which online services a target email address has registered accounts on, without needing any credentials.
- Building a profile of a target’s digital footprint as part of an authorized social engineering or OSINT investigation, complementing username-based tools like Sherlock.
- Verifying whether a corporate email address has been used to sign up for unauthorized third-party/shadow-IT services, as part of a security awareness or Shadow IT assessment.
- Supporting incident response/fraud investigations by quickly checking whether a suspicious email address associated with an incident has accounts on major platforms.
- Cross-referencing with breach databases (e.g., Have I Been Pwned) to build a complete picture of an email address’s overall exposure.
Automation with Bash
Batch-check a list of email addresses and consolidate “used” results:
#!/bin/bash
# holehe_batch.sh
mkdir -p holehe_results
while IFS= read -r email; do
echo "[*] Checking $email"
safe_name=$(echo "$email" | tr '@.' '_')
holehe "$email" --only-used -o "holehe_results/${safe_name}.txt"
done < emails.txt
echo "[+] All results saved in holehe_results/"
Consolidate all “used” platforms across a batch into a single summary report:
#!/bin/bash
for file in holehe_results/*.txt; do
email=$(basename "$file" .txt)
echo "=== $email ==="
cat "$file"
echo
done > holehe_summary_report.txt
echo "[+] Summary report saved to holehe_summary_report.txt"
Tips and Best Practices
- Use
--only-usedin scripts and reports to cut down noise — most emails will show “not used” for the majority of the 120+ supported modules, and only the positive hits are typically actionable. - Combine Holehe’s results with Sherlock (username-based) and GHunt (Google-account-specific) for a comprehensive email/username OSINT profile rather than relying on any single tool.
- Be mindful of rate limiting — some modules (e.g., Adobe, Amazon) are known to rate-limit or block automated checks after a handful of requests; spread out large batch jobs over time.
- Regularly update Holehe (
pip3 install --upgrade holehe) since websites change their registration/password-reset flows, which can silently break individual modules until patched. - Use JSON/CSV output for integration into larger OSINT reporting pipelines or SIEM/case-management systems.
Troubleshooting
| Problem | Cause | Fix |
|---|---|---|
Many modules show [x] rate limited | Too many requests sent to a service in a short window, or shared IP already flagged | Wait before retrying; consider spacing out checks or using a different network/proxy |
| Module reports incorrect/stale result | Target website changed its registration or password-reset flow, breaking Holehe’s detection logic for that module | Update Holehe to the latest version; report the broken module upstream if still failing |
| No output for any module | Network connectivity issue or firewall blocking outbound HTTPS | Verify general internet connectivity; test with curl to one of the target service domains |
| Extremely slow full scan | Default timeout too long across 120+ modules, some of which are unresponsive | Reduce -t timeout value to skip slow/unresponsive modules faster |
pip install fails with dependency conflicts | Conflicting Python package versions in the system environment | Use a dedicated virtual environment (python3 -m venv venv && source venv/bin/activate) before installing |
References
- Official GitHub repository: https://github.com/megadose/holehe
- Kali Linux tool page: https://www.kali.org/tools/holehe/
- PyPI package page: https://pypi.org/project/holehe/