Holehe explained: what it reveals and how to protect your email
Holehe is an open-source tool that checks whether an email address is registered on many websites. This page explains what that means for your privacy and how to make your own address harder to map. It is written for awareness and self-protection, not as a guide to looking up other people.
Email account enumeration. Project: github.com/megadose/holehe · License: GPL-3.0 · Last reviewed 2026-10-13
What is Holehe?
Holehe is a Python project by megadose, released under GPL-3.0. Its README describes it as finding registered accounts from emails by using sites' forgotten-password functions, and says it does not alert the owner of the address.
The general weakness behind it is account enumeration. When a sign-up or password-reset page answers differently for a registered address than for an unknown one, anyone can learn that the address has an account there. Repeating that across many sites builds a list of services tied to one email.
WhatsMyName Apps does not offer email account enumeration. Our email tools are listed as coming soon and are not live.
Why it matters for your privacy
- A list of the services you use can reveal interests, health or dating apps, and employers you would rather keep private.
- Attackers use the same information to write convincing phishing emails that mention services you really use.
- Knowing where an address is registered helps credential-stuffing attacks focus on the right sites.
- You get no notification, so you will not know someone checked.
How to protect yourself
- Use different email aliases for different kinds of accounts, for example one for shopping, one for social media and one for finance. Many mail providers and alias services support this.
- Keep a private address for banking and recovery that you never post publicly.
- Turn on two-factor authentication everywhere, preferably with an app or security key, so knowing your email is not enough.
- Use a password manager and a unique password per site.
- Delete accounts you no longer use instead of leaving them open.
- Check whether your address appears in known breaches and change passwords where it does.
Holehe vs WhatsMyName Apps
| Feature | Holehe | WhatsMyName Apps |
|---|---|---|
| Input | Email address | Username (email tools coming soon) |
| Method | Forgotten-password and sign-up responses | Public profile pages at a username |
| Email account enumeration | Yes | Not offered |
| Setup | Python package | Nothing to install. It runs in the browser |
| Privacy of the query | Runs on your machine | The username goes to our server only to run the check. It is not stored or logged |
Based on Holehe's own documentation as of 2026-10-13. Tools change; the project page is the final word.
Pros and cons of Holehe
Pros
- Useful for checking your own email footprint and closing old accounts.
- Open source, so researchers can see exactly how each check works.
Cons
- Can be misused to profile people without consent.
- Results depend on how each site answers password-reset requests, which changes often.
- Repository activity has slowed; the last commit we saw was in 2024.
Who Holehe is for
Learning about Holehe is useful for anyone who wants to understand how much an email address gives away, and for security teams testing whether their own sign-up and reset pages leak account existence.
WhatsMyName Apps does not offer email or phone account enumeration. Our email and phone tools are marked coming soon. You can still check your own digital footprint by username.
Frequently asked questions
What does Holehe do?
It checks whether an email address is registered on a list of websites by reading how their password-reset or sign-up pages respond. Its README says the address owner is not alerted.
Does WhatsMyName Apps offer a Holehe-style email search?
No. We do not offer email account enumeration. Our email tools are marked coming soon and are not live.
How can I stop my email being mapped like this?
Use separate aliases for different kinds of accounts, keep a private recovery address, turn on two-factor authentication, use unique passwords and close accounts you no longer use.
How can a website prevent email enumeration?
Show the same message whether or not an address is registered (for example "if an account exists, we sent a link"), rate-limit reset and sign-up requests, and add bot protection.
Related tools and guides
- Epieos: Email and phone reverse lookup
- PhoneInfoga: Phone number information gathering
- theHarvester: Domain reconnaissance
- OSINT Framework: Directory of OSINT tools
- All OSINT tools compared
- OSINT username search · Reverse username lookup · Platform username checkers
- Username OSINT for beginners
Names and trademarks belong to their owners. WhatsMyName Apps is independent and not affiliated with or endorsed by Holehe or its authors.