Repolode
Submit
trufflesecurity

trufflesecurity/trufflehog

A CLI that finds leaked credentials across Git, cloud storage, chats and other sources, then checks whether each one is still live.

Open-source alternative to:GitGuardian

View on GitHubWebsite
Stars
28,583
Forks
2,650
Open issues
581
Last commit
yesterday

What is it?

TruffleHog discovers secrets such as API keys, database passwords and private keys in many places, including Git repositories, chat and wiki platforms, logs, object stores, filesystems and Docker images. It classifies more than 800 secret types by the service they belong to, so a bare string can be identified as, for example, an AWS or Stripe key.

For most secret types, TruffleHog logs in to the relevant API to confirm whether a credential is live. Results are reported as verified, unverified or unknown, which cuts down on false positives. For about 20 common credential types it can also run deeper analysis to show who created a secret and what permissions it grants.

It runs as a single command-line tool, installable via Homebrew, Docker or a binary release, and can be wired into CI pipelines, GitHub Actions and pre-commit hooks. Output can be plain text, JSON or SARIF.

Key features

  • 01Scans Git, GitHub, GitLab, S3, GCS, Docker images, filesystems, Postman, Jenkins and more
  • 02Classifies over 800 secret types by the service they belong to
  • 03Verifies credentials against the relevant API to show whether they are live
  • 04Deeper analysis of about 20 common credential types reveals permissions and resources
  • 05Outputs plain text, JSON or SARIF, and supports GitHub Actions and pre-commit hooks

Use cases

  • Scanning Git repositories and pull requests for accidentally committed keys before they leak
  • Checking S3 or GCS buckets for credentials stored in configuration or data files
  • Blocking secrets in CI pipelines with the --fail flag
  • Auditing Docker images or Postman workspaces for embedded credentials

Quick start

  1. 1

    Install on macOS with Homebrew

    brew install trufflehog
  2. 2

    Scan a repo for only verified secrets

    trufflehog git https://github.com/trufflesecurity/test_keys --results=verified
  3. 3

    Scan a GitHub org for only verified secrets

    trufflehog github --org=trufflesecurity --results=verified

Things to know

  • Released under AGPL-3.0, a copyleft license that may restrict how you use it in proprietary products.
  • Some advanced features, such as the github-experimental object discovery, are alpha and may change.

Topics

#secret-scanning#credentials#devsecops#security-tools#secret-management#precommit#dynamic-analysis#scanning#secret#secrets

FAQ

What is trufflehog?
A CLI that finds leaked credentials across Git, cloud storage, chats and other sources, then checks whether each one is still live. TruffleHog discovers secrets such as API keys, database passwords and private keys in many places, including Git repositories, chat and wiki platforms, logs, object stores, filesystems and Docker images. It classifies more than 800 secret types by the service they belong to, so a bare string can be identified as, for example, an AWS or Stripe key.
Is trufflehog free to use? What license does it have?
trufflehog is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is trufflehog still maintained?
Actively maintained. The last commit to trufflehog was on Oct 19, 2026.
What can I use trufflehog for?
Scanning Git repositories and pull requests for accidentally committed keys before they leak Checking S3 or GCS buckets for credentials stored in configuration or data files Blocking secrets in CI pipelines with the --fail flag Auditing Docker images or Postman workspaces for embedded credentials
How do I install trufflehog?
Install on macOS with Homebrew: brew install trufflehog Scan a repo for only verified secrets: trufflehog git https://github.com/trufflesecurity/test_keys --results=verified Scan a GitHub org for only verified secrets: trufflehog github --org=trufflesecurity --results=verified
Where can I get trufflehog?
The source code and installation instructions are on GitHub: https://github.com/trufflesecurity/trufflehog

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects