TruffleHog

Visit Website

Introduction

TruffleHog, from Truffle Security, describes itself as a secrets discovery, classification, validation and analysis tool. Here a secret means a credential a machine uses to authenticate to another machine, such as an API key, database password or private key. The open-source project is AGPL-3.0 with about 29,000 GitHub stars.

Discovery covers many places: Git, chats, wikis, logs, API testing platforms, object stores, filesystems and more. Classification maps findings to over 800 secret types, so you know whether something is an AWS key, a Stripe secret or a Postgres password.

Validation is the standout feature: for secrets it can classify, TruffleHog can try to log in to confirm whether the secret is live. For about 20 of the most commonly leaked credential types, analysis goes further to learn who created the key and what it can access.

Truffle Security also sells TruffleHog Enterprise for continuous monitoring of Git, Jira, Slack, Confluence, Microsoft Teams, SharePoint and more; the README says that revenue funds the open-source work.

Features

1. Many sources: Git repositories and history, GitHub/GitLab orgs, filesystems, S3 and other sources.
2. 800+ detectors: Classifies secrets by provider and type.
3. Live verification: Checks whether a found credential still works.
4. Credential analysis: Deep analysis for common credential types to show permissions and resources.
5. Custom regex detectors: Add your own patterns.
6. Filtering: Entropy and regex filters to reduce false positives.
7. CI and pre-commit: Run in pipelines or before commits.
8. JSON output: Machine-readable results for triage tooling.

Pros

1. Verification cuts noise: Focus on live, dangerous secrets first.
2. Broad coverage: Many detectors and sources.
3. Open source: Free CLI.
4. Actively maintained: Commits in November 2026.
5. Enterprise path: Continuous monitoring available commercially.

Cons

1. AGPL licence: Check obligations before embedding or modifying.
2. Verification sends requests: Live checks contact providers, which some policies may restrict.
3. Scanning history is slow: Large repositories with long history take time.
4. Enterprise features paid: Continuous monitoring of chat and wiki tools is commercial.
5. Rotation is on you: It finds secrets; revoking and rotating them is a separate process.

Usage and Links (Example)

Scan a Git repository and show only verified secrets:

trufflehog git https://github.com/trufflesecurity/test_keys --results=verified

Scan a local filesystem path:

trufflehog filesystem ./src

Tips: run it in CI on pull requests to stop new leaks, run a full-history scan once to find old ones, and have a rotation runbook ready before you start, because verified findings need immediate action.

Resources:

• TruffleHog product page
• GitHub repository

Pricing

The TruffleHog CLI is free and open source (AGPL-3.0). TruffleHog Enterprise is a paid product; see Truffle Security for pricing.

Recommended for?

1. Security teams auditing repositories and history for live credentials.
2. DevSecOps adding a secrets gate to CI.
3. Incident responders checking whether leaked keys are active.
4. Not a fit if AGPL terms conflict with how you plan to use it.

Conclusion

TruffleHog stands out for verifying whether leaked secrets are live, which turns a noisy scan into an action list.

Use it in CI and for history audits, and pair it with a fast rotation process.