aeondave/holehe

Holehe

Email-to-account mapper — check if an email is registered across 120+ services.

Quick Start

pip install holehe

# Check a single email
holehe [email protected]

# Output only registered sites
holehe [email protected] --only-used

# JSON output
holehe [email protected] --only-used --json > results.json

Core Flags

| Flag | Purpose | |------|---------| | --only-used | Show only sites where email is registered | | --no-color | Disable color output | | --json | JSON output | | -T N | Timeout per request |

Sites Checked (examples)

Google · Twitter/X · GitHub · Instagram · LinkedIn · Reddit · Snapchat · Spotify · Adobe · Airbnb · Amazon · Dropbox · Flickr · Pinterest · Tumblr + 100 more

Common Workflows

OSINT on target email:

holehe [email protected] --only-used --json | tee email_presence.json

Batch check from file:

cat emails.txt | xargs -I {} holehe {} --only-used

Combine with username pivot:

# If target email is [email protected], extract username
holehe [email protected] --only-used --json | jq '.[] | .name' | \
  xargs -I {} echo "sherlock johndoe --site {}"

How It Works

Holehe uses account-recovery flows (password reset) — not login attempts. Most sites respond differently to "email not found" vs "reset link sent", so holehe detects registration without credentials. Low noise, does not lock accounts.

Email Sources for OSINT

# From company domain — harvest emails with theHarvester first
theHarvester -d target.com -b google,bing,linkedin -l 200

# From breach databases
# dehashed.com, haveibeenpwned.com, intelx.io

# From GitHub commits
curl "https://api.github.com/repos/<owner>/<repo>/commits" | \
  jq '.[].commit.author.email' | sort -u

Resources

| File | When to load | |------|--------------| | references/email-osint.md | Email harvesting sources, breach lookup APIs, pivot from email to full profile |