Websites love to overshare at signup
Try registering on a website with an email address that already has an account. Most sites tell you, helpfully: "This email is already in use." Some password-reset forms do the same thing: "We've sent a link to that address" versus "We couldn't find that account."
Holehe automates that question across about 120 sites. You give it an email address, and it asks each site's signup, login or recovery flow whether the address is known. It reports one of three answers:
[+] email used: the site says it has an account with this address.[-] email not used: the site says it doesn't.[x] rate limited: the site noticed you asking and stopped answering.
Some modules also return a **partial recovery hint**, like a masked phone number (+61 4** *** *12) or a masked backup email. Those hints are often the most useful output, and the most sensitive.
How this differs from Sherlock
Sherlock loads **public profile pages**. Holehe talks to **account systems**, the parts of a site built to manage logins. That makes it more powerful and more delicate. You aren't reading something the person published; you're asking the site's login system to confirm something about them.
That difference is why Holehe gets its own lesson, and why this course teaches it only against addresses you own.
Sherlock checks the shopfront. Holehe asks the front desk. The front desk usually answers, and sometimes it rings the guest.