Check account existence across 120+ sites with a single email address
Instead of checking each site individually to see if a specific email address is registered, you can get the full list with a single command. holehe is a tool that quietly queries whether an account exists for a given email by using password reset functionality. It operates in a way that does not send notifications to the target email, so it does not raise suspicion during the information gathering process.
Query method using password reset functionality
This tool utilizes the 'Forgot your password?' feature of each site. It analyzes how the site returns the existence of an account when an email is entered to derive the results. During this process, no actual login attempt occurs, and no notification email is sent. It runs in a Python 3 environment and supports more than 120 sites, including major social networks and commerce platforms such as Twitter, Instagram, eBay, and Amazon.
Execution method and result data structure
You can get results immediately by entering just an email, like holehe test@gmail.com, in the terminal. It can also be used by embedding it in a Python application. The query result for each site is returned in a standardized dictionary format. The exists field indicates whether the account exists, and the rateLimit field indicates whether a request limit has been reached. Some sites may also return masked recovery emails or phone numbers.
Installation paths and handling request limits
The easiest way to install it is via PyPI with the pip3 install holehe command. It also provides methods to install by cloning the source from GitHub or by building and running a Docker image. A Python 3 environment is required. Request limits (rate limit) vary by module, and if a limit is reached, you must change the IP address. It also supports integration with Maltego transformers, allowing it to be used alongside visual information gathering tools.
Use limited to educational purposes and legal responsibility
This repository is distributed under the GNU General Public License v3.0 license and explicitly states that it was created for educational purposes only. Unauthorized querying of a specific individual's email address may be illegal under the laws of the respective country. It is safe to use only when testing your own account or publicly available information. The technical capability of the tool and legal responsibility are separate, so you must always check relevant regulations before use.
