Is Holehe safe? Security, privacy and legality

Is Holehe safe to use?

Yes. Holehe's security model is deliberately minimal:

• No password attacks, no brute force, no credential stuffing
• Never logs in to an account, never bypasses MFA
• Never scrapes private content (DMs, private profiles, hidden files)
• Only public signals: sign-up form and password-recovery responses

In other words, Holehe observes the same thing a casual visitor would see by typing your address into a registration form, just across 200+ sites at once.

Does Holehe expose my data?

No. When you use holehe-osint.com, the requests to each site are routed through our servers, not your browser. That means the target sites never see your IP or browser fingerprint. Your holehe-osint.com account and its history stay private and are never exposed to third parties.

Is Holehe legal?

Holehe only reads public signals, which is generally lawful, but lawfulness always depends on two things: your jurisdiction and the purpose of your investigation.

• Typically accepted uses: authorised pentesting, threat intelligence, investigative journalism, fraud triage, checking your own accounts.
• Uses to avoid: harassment, stalking, building unauthorised dossiers on individuals.
• GDPR / CCPA: as soon as you process personal data, verify your legal basis (legitimate interest, public-interest task, etc.) and document the processing.

Will the scanned person know?

No. Holehe is silent. No email is sent to the target, no "suspicious sign-in attempt" alert is triggered, and the operation does not appear in any security log visible to the target. The requests it emits mimic a casual visitor browsing a public sign-up form.

Is the GitHub source code safe to install?

The Holehe project is open source. Everything is auditable: you can read the code, check the dependencies and understand exactly what it does before installing.

A few sanity rules:

• Stick to the official PyPI release or the official GitHub repo
• Avoid forks promising "200+ extra modules" or pre-built binaries
• Install inside an isolated virtualenv to limit permissions
• If you do not want to run third-party code at all, use the browser version

Holehe vs phishing and breach databases

Important: Holehe is nota phishing tool and not a service that gives you access to leaked password databases. It will never hand you a password for an email, the contents of an account, or the contents of a leak. If you want to know whether an email appeared in a known breach, use HaveIBeenPwned. Holehe answers a different question: "where is this address registered?".

Run a Holehe scan safely →

Frequently asked questions

Is Holehe safe to use?

Yes. Holehe never logs in, never guesses passwords, never bypasses MFA, and never scrapes private content. It only reads publicly exposed sign-up and password-recovery responses from each site, the same signals a normal user sees when typing an email into a registration form.

Is Holehe legal?

Reading public sign-up signals is generally lawful, but lawfulness depends on your jurisdiction and on the purpose of your investigation. Authorised pentesting, threat intelligence, journalism, fraud triage and checking your own accounts are typical accepted uses. Stalking, harassment or unauthorised dossier-building are not.

Will the person being scanned be notified?

No. Holehe runs silent. It does not send any email to the target, does not trigger a sign-in alert, and does not appear in the target’s security log. The queries it sends mimic ordinary visits to a public sign-up form.

Is the Holehe source code on GitHub safe to install?

The original Holehe repository is open source, you can audit every line. Stick to the official PyPI release or the official GitHub repo, never random forks promising "extra modules". The browser version on holehe-osint.com runs the same logic server-side so you do not need to trust unknown binaries.

Does Holehe store the emails I scan?

On holehe-osint.com, scans are tied to your account history so you can review them later. We never sell or share that data, and you can delete your history at any time. The CLI version keeps no history at all, it just prints to your terminal.