ForkFree

Security and privacy

holehe

by megadose

Holehe is a Python command-line tool that checks whether an email address has an account on more than 120 websites, such as Twitter, Instagram and Adobe. It uses sign-up and forgotten-password checks, so it does not alert the email owner, and it is mainly used for open-source intelligence research.

Worth a lookEstablished, with a few things to check (listed below).

View on GitHub

Stars
15.5k
Licence
GPL-3.0
Runs on
Your computer
Setup
Easy
Language
Python
Age
2317 days

What you can do with it

  • Run a single command to see which websites an email address is registered on
  • Pick up partly hidden recovery emails or phone numbers that some sites reveal
  • Embed the checks in your own Python scripts and get structured results

Make money with it

A freelancer could offer small digital footprint or exposure reports for businesses, using this as one of several research tools.

An idea, not financial advice. Check the licence before charging for anything built on it.

Ways a business could use it

  • Check whether staff or company email addresses are exposed on third-party sites as part of a basic security review
  • Support fraud or identity checks by seeing which services an email address is linked to

Can you use it commercially?

Free to use. Anything you distribute that includes it must be open-sourced under the same licence.

Not legal advice. Read the project's licence file before building a product on it.

Getting it running

Install with pip3 install holehe, or clone the repository, or build the Docker image, then run holehe followed by an email address.

Follow the official instructions in the project README.

Things to check

  • Can be used to profile or stalk individuals, so use only with a legitimate reason and permission
  • Probes many third-party sites, which may breach their terms of service
  • Sites often rate-limit requests, and site checks can break when the sites change
  • GPL-3.0 licence requires derived work to stay open source
  • README says it is built for educational purposes only

Who's talking about it

Checked 30 Oct 2026. Summary drafted by AI from the project's README.

More in Security and privacy

RemoveMacAI omlahore
New and promising

RemoveMacAI is a tool to debloat macOS by turning off Apple Intelligence, analytics, ads, and pop-ups, allowing users to regain disk space and privacy.

5.6k stars +69 a day MIT
sherlock sherlock-project
Worth a look

Sherlock is a command-line tool that checks whether a given username exists on many social networks and websites. It is used to find a person's or brand's online accounts for research and investigation.

95.2k stars +68 a day MIT
pentagi vxcontrol
Ready to use

PentAGI is an open-source, self-hosted system for autonomous penetration testing that uses AI agents to perform complex tasks in a secure, isolated environment.

32.8k stars +67 a day MIT