01 · Product name
Holehe
See whether an email is registered on other sites.
Published by megadose.
In short
Holehe is an open-source command-line tool that checks whether an email address is registered on a set of websites. It is built to use registration and password-reset checks rather than to email the account. Those checks can still have side effects. Run it only on addresses you are allowed to investigate, and confirm a hit in a browser before you cite it.
Product pricing strategy
02
Free
Holehe is free. You do not buy a seat to use what the project publishes.
Yes. Holehe is free and open source. You run it locally.
Utility and features
03
Holehe, by megadose, answers a narrow question: does this site already have an account for this email? That is different from Have I Been Pwned, which answers whether the address appeared in a breach, and different from Sherlock, which starts from a username. Together they cover the three strings people actually have at the start of a case.
- What it asks. For each supported site, whether the email appears to be registered. It does not download a profile or a breach dump.
- Side effects. Some sites only reveal registration through flows that can notify a user or rate-limit an address. Read the module if that matters.
- How to confirm. A positive result is a lead. Log in only to accounts you own. For any other account, corroborate with public pages, not a password guess.
The tool is only as current as its modules. Sites change endpoints. A “used” result can be wrong, and an “unused” result can mean the module broke. Because some checks hit password-reset or signup flows, do not point Holehe at arbitrary people. Use it for your own addresses, for a consenting subject, or for an investigation you are authorized to run. Do not treat a list of sites as a biography.
- 1
Install Holehe and run it against an email you are authorized to check.
- 2
Separate “used,” “not used,” and “rate limited” in the output. They are not the same finding.
- 3
Confirm important hits manually. Discard modules that look broken.
- 4
Store the output with the date. A later run will not match if sites changed.
Caveats
04
Holehe is a free local tool. It asks sites whether an email appears registered, using response differences that sites can change or rate-limit at any time. A hit can be wrong. A miss can be a site the tool does not cover or a check that broke.
It is not a breach search. Have I Been Pwned answers a different question. Do not turn a registration hit into a password reset you are not allowed to perform, and do not describe the list as ‘accounts we confirmed.’
Screenshots
05
Potential use cases
06
- You have an email you are allowed to investigate. Run Holehe locally. You get a list of sites that appear to have an account for that address, based on the checks the project ships. Open nothing that would create an account or send a reset. Pivot the same address to Have I Been Pwned for breach history, which is a different question. A registration check is not proof the person still uses the service.
- A brand mailbox might have been used to open consumer accounts. Run Holehe, keep the JSON or the terminal record with the date, and verify any surprising hit on the service’s public page if there is one. Pivot a username you discover to Maigret. False positives happen when a site’s response changes. Update the tool before you rely on a check.
- You are advising someone about their own address. Holehe plus HIBP is the pair: where the address seems registered, and which known breaches included it. The output is a list they can act on with those services’ own recovery flows. Do not use the result to try passwords.
Hard cases
The case where the first result is easy to over-read.
The reset page is not yours to open
Holehe says a major mail or shopping site knows the address. The tempting next step is the ‘forgot password’ flow, which tells you whether an account exists and can also mail the person. Do not do that unless you are the account owner or you have a written reason that covers it. Record Holehe’s result, pivot to HIBP, and leave the provider’s recovery flow alone.
Questions
Is Holehe free?
Yes. Holehe is free and open source. You run it locally.
Will Holehe email the address I check?
It is designed not to send a normal message to the inbox. Individual site checks can still trigger notices or rate limits. Use it only with authorization.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Holehe repository
https://github.com/megadose/holeheDocumentation
Holehe README
https://github.com/megadose/holehe/blob/master/README.md