Epieos vs Holehe: Which Email OSINT Tool Should You Use?

Epieos vs Holehe is not a contest between rivals. The two tools answer different questions about an email address. Epieos pivots an address into the Google or Microsoft account behind it, recovering a display name and profile photo when that link exists; Holehe tests signup and password-reset flows to list the sites where an address is registered. Use Epieos when you want identity attribution, Holehe when you want footprint breadth, and a hosted platform when you need breach history, cross-source correlation, or monitoring in one place.

Both tools are legitimate and widely used. What follows is what each one actually does, where each one wins, and how they fit a real investigation, including the point where most of us stop relying on them alone.

What Epieos does

Epieos is a free, hosted web tool built around one genuinely clever pivot: recovering the name and profile photo of a Google account associated with an arbitrary email address. Historically, Google endpoints leaked this information for any address that had ever been linked to a Gmail or Google account, even a non-Gmail address used as a recovery or login alias. You paste in an email, and Epieos attempts that recovery plus a set of other lookups.

What you typically get back from an Epieos query:

• Google account details: display name and avatar, when the address is tied to a Google account. This is the signature feature and the reason most people open the site.
• Microsoft account signals: whether the address is attached to a Microsoft login.
• Breach appearances: known data breaches the address shows up in, depending on the site's current sources.
• Paste-site mentions: public pastebin-style dumps referencing the address, when its sources cover them.
• Phone number lookup: a secondary module with similar account-recovery pivots.
• Maps/reviews pivots: surfacing reviews or contributions left under the recovered Google identity, which can turn an anonymous mailbox into a physical location.

Treat Epieos as a pivot generator. Its best hits hand you a new identifier (a person's name, a photo, a city) that you carry into the next search. It is not trying to enumerate every site an email touches. It is trying to crack the door open to a real identity, fast, from a browser tab.

Because it's hosted, there is nothing to install. That is why it is the first tool many people reach for. It is also why you are sending someone else's email address (and often your own query context) through a third-party web service, which matters for operational security and for client work with strict data-handling rules.

What Holehe does

Holehe is an open-source command-line utility from megadose's OSINT toolset. The mechanism is different in kind, not just degree. Instead of querying databases, Holehe visits the registration pages of roughly 120 popular websites and uses the "email already registered" response (surfaced through password-reset flows and signup validation, without ever guessing passwords) as a yes/no oracle. If Instagram's reset flow behaves differently for a registered address versus an unregistered one, Holehe detects that difference and records it.

Running it looks like:

holehe [email protected]

Output lands in your terminal: each checked service with a found, not-found, or rate-limited status. Holehe ships as a standard Python package, so automation is a matter of scripting the CLI or importing the module and post-processing what comes back. What that buys you in practice:

• Registration truth, live. Holehe isn't checking a cached database. It asks each website right now. If the target created an account yesterday, Holehe can find it today.
• No credentials touched. The reset-flow technique never attempts a login. It reads only whether an address exists at a service, which keeps it on the lawful side of the line.
• CLI-native. Scriptable, pipeable, easy to run inside automation or a larger pipeline.
• Free and auditable. Open source means you can read exactly what it does before you run it.

Those strengths come with a matching set of limits. Holehe covers a fixed list of sites, mostly large consumer platforms, so it will miss anything niche, regional, or professional. Rate limiting is a constant battle; several services throttle after a handful of queries, and results degrade if you hammer the same targets repeatedly. And critically, Holehe answers "is this email registered here?" It never tells you who owns the address or what the account contains. Breadth, not depth.

Head-to-head comparison

On a real engagement we run both, usually within the first ten minutes of working a new email address: Epieos for the human pivot, Holehe for the platform list. They complement each other. The useful question is which one you need right now, not which one "wins."

Where Epieos wins

1. Attribution speed. When the Google pivot hits, you have a face and a name in seconds: a display name to push into username search and a profile photo to reverse-search.
2. Zero setup. Browser tab, done. For a quick single-email triage during a call or a live session, that matters more than coverage numbers.
3. Secondary pivots. Maps reviews tied to the recovered Google identity are an underrated geolocation vector. Reviewers leave locations, timestamps, and photos that build a pattern of life without touching anything private.
4. Non-Gmail addresses too. The pivot frequently works on custom-domain addresses that were merely linked to a Google account, which surprises people the first time they see it.

The gaps are real: coverage is curated rather than exhaustive, the free tier has usage limits, there is no documented API for automation-heavy workflows, and pushing third-party emails through a hosted service can conflict with data-handling rules on some professional engagements.

Where Holehe wins

1. Breadth with freshness. Because every check is live against the target site, Holehe catches accounts created days ago that no breach dump or database has recorded yet.
2. Automation fit. A plain CLI and open-source Python internals make it trivial to fold into scripts, cron jobs, or a larger enrichment pipeline. Run it across an inbox of addresses overnight and collect the results.
3. Cost. Free and self-hosted. For bulk work, nothing beats running it locally on your own infrastructure and IP space (expect aggressive throttling without rotating source IPs).
4. Auditability. Open source code you can review before pointing it at anyone's address, which is increasingly a requirement for teams with compliance obligations.

What you give up: no identity attribution, no breach context, a fixed site list skewed toward consumer platforms, and rate-limit noise that makes raw output messier than the clean yes/no picture suggests.

When neither tool is enough

Epieos and Holehe share three blind spots that show up on almost every serious engagement:

• No historical depth. Holehe sees the present; Epieos sees curated present-day pivots. Neither reconstructs an address's history: old forum accounts, deleted profiles, years of breach exposure. For that you need breach data, and ideally access to infostealer logs, where credential-dump entries tie addresses to usernames, passwords, and the services they logged into.
• No correlation engine. Both tools return lists. Neither connects email → username → phone → address → employer into a graph. Doing that by hand works for one email and falls over at twenty.
• No persistence. An email address is a moving target. Registration checks snapshot today; if the target creates new accounts next month, you find out only if something is watching. Continuous breach monitoring exists precisely because point-in-time tools don't cover it.

Hosted platforms fill those gaps. Revealer, for example, runs one search by email, username, phone, name, or address across 800+ platforms, public records, and known breach datasets, then lets AI Deep Search follow identifiers recursively across sources the way a manual investigator would, but at machine speed. Where Holehe says "registered on Spotify: true" and stops, a platform search continues into who else shares that username, what breaches contain that address, and which other identifiers cluster around the same person.

Use Epieos and Holehe for what they're excellent at. Reach for a platform like Revealer's email lookup when you need breach context, cross-source correlation, monitoring, or API access, or simply when you need the full picture in one reportable artifact instead of five terminal windows. A free tier makes it cheap to compare against your existing stack; paid plans start around $12.99/month as of writing, with card and crypto accepted.

A practical workflow that uses all three

Here's the sequence we'd actually run on a new email address, [email protected]:

1. Epieos first. Check for a Google/Microsoft pivot. If you recover a name or photo, note it; it anchors everything downstream.
2. Holehe second. Enumerate current registrations across its ~120-site list. Capture the output to a file so the results are diffable later.
3. Platform sweep third. Run the address through Revealer to pull breach appearances, stealer-log entries, and correlated identifiers across the long tail neither tool reaches.
4. Pivot outward. Take every recovered username into a username search across platforms, and any recovered phone number into a reverse phone lookup.
5. Set monitoring. If the engagement continues, watch the address for new breach appearances instead of re-running everything manually.

Total time for steps 1–2: minutes. Total time for step 3 done manually: hours, with worse recall. That gap is why both free tools stay in the kit alongside a platform that does the heavy lifting.

Staying on the right side of the line

All of the above describes lawful investigative work: threat intelligence, fraud investigation, authorized due diligence, research on accounts you have a legitimate interest in. Reset-flow registration checks don't guess passwords, account pivots only read publicly exposed data, and breach datasets are aggregated from public incidents. The outputs still identify real people, so handle them accordingly. Know your jurisdiction's rules, document why you ran each query, and never use these techniques to harass, stalk, or impersonate.

Public-records search and OSINT are not the same thing as an FCRA background check. None of these tools produce FCRA-compliant consumer reports. If your purpose is employment screening, tenant screening, or credit decisions, you are legally required to use a consumer reporting agency under the Fair Credit Reporting Act, not an OSINT tool of any kind. (Disclosure: Revealer is not a consumer reporting agency and may not be used for FCRA-regulated purposes.)

Frequently asked questions

Is Epieos free? Yes, with usage limits on the free tier. Heavy users may need to wait between queries or upgrade depending on the site's current offering; check epieos.com for details as of writing.

Is Holehe legal to use? Holehe doesn't attempt logins or guess passwords; it reads whether an email is registered via public reset/signup flows. That said, automated checks may violate individual sites' terms of service, and laws vary by jurisdiction. Use it for authorized investigations only, at low volume.

Does Holehe still work in 2026? Broadly yes, though individual sites change their flows constantly, so the effective site count fluctuates. Rate limiting is the bigger practical obstacle than breakage. Expect partial results on any given scan.

Can Epieos find the owner of any email address? No. The Google pivot only fires when the address is linked to a Google account, and Microsoft lookups depend on similar conditions. Many addresses return nothing attributable, which is exactly when you fall back to breach data and broader sweeps.

Which is better for finding breach data? Neither, seriously. Epieos surfaces some breach appearances, and Holehe none. Dedicated breach lookup tooling goes much deeper; see Revealer's data breach lookup for a hosted option covering breach corpora plus stealer logs.

Do I need both tools, or just a platform? Keep both. They're free, fast, and great for first-pass triage. Add a hosted platform when you need correlation, history, monitoring, or API-scale throughput. The two approaches complement rather than replace each other.