Looking for a Holehe alternative usually means one of three things. You want a web UI instead of a terminal. You keep hitting rate limits and silent false negatives. Or registered/not-registered is no longer enough of an answer. The tools I actually reach for are Blackbird (same style of account checks, bigger site list), Epieos (browser-based email search), h8mail (breach corpora), Maigret (username pivots), SpiderFoot (automation), and Revealer's email lookup, which checks 800+ platforms plus breach data in one query. Coverage, output, and cost are the three axes that matter. The rest of this guide is the comparison I wish I'd had the first time Holehe started lying to me.
What Holehe actually does
Holehe answers one narrow question per website: does this email address have an account there? It works by driving each platform's password-recovery flow. Install and run:
pip install holehe
holehe [email protected]
The tool walks its module list (roughly 120 sites as of writing; the README on GitHub is the source of truth), submits the address to each reset endpoint, and classifies the response. A "we sent a reset link" outcome means the account exists. An explicit "no account found" means it probably doesn't. A few provider-specific modules return extra context, such as whether the address is a Google account. Most modules also report a third state: rate-limited or inconclusive.
The strengths are real. It's free and open source, the code is auditable, results print in seconds for a single address, and you can import holehe as a Python library instead of shelling out. For a quick presence sweep on one address it's still a reasonable first move. The useful question is not "is Holehe bad." It's "what do I grab when it runs out."
Where Holehe breaks down
Four limits show up in actual casework, not just on paper:
- Coverage ceiling and false negatives. Every module is hand-written against a specific reset flow. When a site redesigns its recovery page or adds an anti-bot check, the module doesn't fail loudly. It returns a wrong or inconclusive answer. Coverage drifts downward between releases, and you only notice after you've already written the hit into a report.
- Rate limiting. Password-reset endpoints are abuse-sensitive by design. Run holehe at volume from one IP and platforms throttle or challenge you, so results degrade exactly when you have many addresses to check.
- CLI-shaped output. One terminal dump is fine for you. It's awkward for a case file, a client deliverable, or a teammate who doesn't live in a shell. There's no API service, no saved history, no scheduled re-checks.
- One dimension of data. "Registered on this platform" is a lead, not a picture. Holehe doesn't tell you where the address leaked, what usernames it's tied to, or which public mentions exist.
One process note: reset-flow probes are invisible to the account holder but recorded by the platform. Keep volume low, space runs out, and log what you did and when. That log is your audit trail if the work is ever questioned.
What to look for in a replacement
Before you pick from the list below, name the Holehe failure you're actually solving. Breadth is more platforms per query, plus someone keeping the checks current as sites change. Interface is CLI for scripting, a web UI for shareable output, or an API for pipelines. Enrichment is breach and stealer-log exposure, username pivots, related identifiers. Export and audit means JSON, CSV, or report output with timestamps you can attach to a case. Licensing and cost is open source vs. freemium vs. paid, and what your engagement allows.
If you skip that decision you'll end up installing Blackbird because someone on a forum said "it's like Holehe but bigger," then wonder why you still have no breach picture.
1. Blackbird: the closest open-source successor
Blackbird is the tool most people recommend when holehe's list feels stale. It's a Python CLI that takes either an email or a username (-e / -u) and checks account existence across a large, community-maintained site list, then exports results as CSV, JSON, HTML, or XLSX. The export step alone fixes one of Holehe's annoyances: you get a file you can attach to a case instead of terminal scrollback. Newer releases have grown beyond pure registration checks (including breach-adjacent lookups), so verify current features in the README. It's free and open source, and the same rate-limit caveats apply, since it's the same class of probing.
I treat Blackbird as Holehe with a bigger list and a better export story. I do not treat it as a substitute for a breach check.
2. Epieos: browser-based email search
Epieos does the same job from a browser. Paste an email (or a phone number) and you get a report of linked accounts and provider-level details, historically including Google account information where the address is a Google account. Providers keep tightening what their endpoints expose, so coverage shifts over time. Treat Epieos output as a lead list to verify, not a certificate. Manual lookups are free, with a paid API for automation (check their site for current plans and pricing). This is the right pick when the person reading the output isn't the person running the query.
If your teammate will not open a terminal, stop arguing and use Epieos. The investigation is the product, not the shell session.
3. h8mail: breach-first lookups
h8mail approaches the address from the other side. Instead of asking live sites whether an account exists, it asks breach corpora what's already known about the address: appearances in dumps and, in some datasets, exposed credential material. It queries remote breach APIs (several require your own API keys), can ingest local leak files you already hold, and processes target lists from CSV. It's a complement to Holehe more than a replacement. Holehe tells you where the account lives now; h8mail tells you where the address has leaked. The tool is free and open source; some data providers charge for API access.
People swap these two in their heads and then miss half the picture. Registration now and leakage then are different facts. Run both when the case cares about either.
4. Maigret: username pivots at scale
Maigret takes the identifier Holehe doesn't: the username. Most email investigations pivot. An address like jsmith1987@... suggests handles, and Maigret checks those handles across a site corpus far larger than any email tool's list, producing HTML or PDF reports and extracting IDs and links from the pages it finds. Pair it with Sherlock for the same job with a simpler footprint, and with GHunt when the address is a Google account and you need Google-scope detail. If you'd rather not juggle handle guesses yourself, Revealer's username search covers the pivot inside the same query as the original email.
A presence hit on Instagram or GitHub is often more useful than a reset-flow "yes" on a site nobody in the case uses. Don't skip the handle work because the original identifier was an email.
5. SpiderFoot: automation and correlation
SpiderFoot is not a checker. It's an OSINT automation framework. Feed it an email as a starting entity and it fans out across its module set (a couple hundred sources as of writing, spanning breach lookups, infrastructure data, and more), then correlates the results into a project you can revisit. It has a web UI for case work and a CLI for pipelines, ships as open source, and has a paid cloud tier. The trade-off is weight. Setup and tuning take longer than any single-purpose tool, so it earns its place when investigations are recurring and repeatability matters. For a one-off address check it's overkill.
I have watched people spend an afternoon wiring SpiderFoot for a single address they could have pasted into a web lookup in thirty seconds. Save it for the cases that come back next month.
6. Revealer Email Lookup: breadth plus exposure in one query
Revealer's email lookup exists for the moment a Holehe-style answer isn't enough. One search by email checks 800+ platforms together with known breach datasets and stealer logs: the "where does this address exist" question and the "where has it leaked" question in a single pass. When registration hits need to go deeper, AI Deep Search follows identifiers recursively across sources instead of stopping at the first hit, and the same starting point leads into the username search for pivots and the data breach lookup and stealer logs pages for exposure detail. There's an API for pipeline integration (docs) and breach monitoring for addresses you need to watch over time. A free tier gets you started; paid self-serve plans run from $12.99/month with card and crypto accepted (pricing). The full inventory is on the OSINT tools page.
If you already live in a terminal and only need 120 sites, Holehe or Blackbird will feel faster. The gap shows up when you need the platform list and the leak picture without stitching three CLIs together.
How the six compare
| Tool | Type | Primary question | Coverage | Output | Cost |
|---|---|---|---|---|---|
| Holehe (baseline) | CLI | Is this email registered on X? | ~120 sites (README, as of writing) | Terminal | Free, open source |
| Blackbird | CLI | Does this email or username have accounts? | Large community list | CSV, JSON, HTML, XLSX | Free, open source |
| Epieos | Web + API | What is linked to this email? | Varies by provider | Web report, API | Freemium (check site) |
| h8mail | CLI | Where has this address leaked? | Your dumps + connected APIs | Terminal, CSV | Free tool; some APIs cost |
| Maigret | CLI | Where does this username exist? | Very large site list | HTML, PDF, JSON | Free, open source |
| SpiderFoot | App | Correlated OSINT on one entity | A couple hundred modules (as of writing) | Web UI, reports | Open source + paid cloud |
| Revealer | Web + API | Platform presence + breach exposure | 800+ platforms, breach data, stealer logs | Web report, API | Free tier; from $12.99/mo |
A practical workflow that chains them
Real cases rarely end with one tool. A sequence that holds up:
- Breadth first. Start with Revealer's email lookup or Epieos. One query, one report, captured with a timestamp.
- Confirm what matters. If two or three specific platforms decide the case, run Holehe or Blackbird against just those, spaced out, from infrastructure you're authorized to use.
- Layer exposure. Run h8mail against your breach sources, or pull the address through the breach and stealer-log lookups. "Registered now" and "leaked where" are different questions; answer both.
- Pivot. Derive candidate usernames from the address and run Maigret, or let AI Deep Search follow the identifiers recursively for you.
- Automate only what repeats. If the same checks recur across engagements, wrap them in SpiderFoot or the Revealer API. Otherwise you're maintaining infrastructure for no return.
Document each step. Six months later, the deliverable is the log, not your memory of the run.
Legal and ethical guardrails
These tools are lawful in the contexts investigators actually work: your own accounts, engagements with documented authorization from the client, and research on assets you're permitted to test. They are not for stalking, harassment, or doxxing, and credential material from breach sources must never be used to log into anything. Possession is not authorization. Revealer is not a consumer reporting agency, and none of these tools may be used for employment, tenant, or credit screening (FCRA).
Frequently asked questions
Is Holehe still maintained? The repository sees intermittent commits and module fixes from a small community. Check the GitHub commit history and open issues before relying on it for a live case. Stale modules are the main source of false negatives.
Does Holehe show passwords? No. It observes password-reset responses to infer whether an account exists; it never retrieves credentials. Password material lives in breach corpora: h8mail, Have I Been Pwned, or the data breach lookup.
Is it legal to run these checks? Holehe never logs into an account. It reads reset-flow responses. Legality still depends on jurisdiction and purpose. Standard practice: use these tools on your own identifiers or inside a documented, authorized engagement, never for harassment. This is not legal advice.
What's the best free Holehe alternative? For a terminal workflow, Blackbird. For a browser, Epieos's free tier. Revealer's free tier covers the breadth-plus-breach case in a single query.
Which alternatives have an API? Revealer (see the API docs), Epieos on paid plans, and the CLI tools (h8mail, Blackbird, Maigret) can be wrapped in your own scripts. SpiderFoot is built for programmatic use.
Can any of these search by phone number? Revealer's reverse phone lookup does, and Epieos has offered phone lookups as well. Holehe itself is email-only.