TruffleHog
Open sourceOpen source scanner that searches git history, filesystems, and images for leaked credentials and verifies them live.
- Pricing
- free, custom
- Free tier
- true
- License
- open-source
- Open source
- Yes
Editorial review
TruffleHog has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.
Sign in to save this tool to a private list.
Facts & attributes
Every value carries its evidence state. “—” means unknown — never a silent default (P-02).
Identity · Taxonomy
- Tags(open-source;cloud-native)
- secrets detection, secret verification, NHI, open source, devsecopsVerification pending
Pricing · Licensing
- Free plan(true/false)
- trueVerification pending
- License model(proprietary;open-source;source-available;dual-license)
- open-sourceVerification pending
- Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom)
- free, customVerified
- Source repository(HTTPS URL)
- https://github.com/trufflesecurity/trufflehogVerified
- SPDX license IDs(Apache-2.0;MIT)
- AGPL-3.0Verified
Features · Product · Fit
- Core capabilities(authoring;automation;analytics)
- Scans 800+ secret types, directly verified with key providers, Uncovers exposed non-human identities (NHIs) and their secrets, Secrets discovery, classification, validation, and analysis, Most complete list of integrations to scan across your entire SDLC, Detects secrets everywhere, including GitHub comments and pull requestsVerification pending
Api · Integrations · Ecosystem
- CLI(true/false)
- trueVerification pending
Audience · Use · Case
- Best for(Neutral editorial summary)
- Security teams verifying 800+ secret types and exposed NHIs across the SDLC with an open-source CLI and enterprise platform.Verification pending
- Company-size fit(individual;SMB;mid-market;enterprise)
- individual, enterpriseVerification pending
- Primary use cases(build;monitor;automate)
- Secrets detection and verification, Non-human identity risk prioritization, SDLC-wide secret scanningVerification pending
Vendor · Maintainer
- Vendor type(commercial;foundation;community;government;consortium;individual)
- commercialVerification pending
User reviews
Review policyNo published reviews yet.
Write a review
Sign in to write a review. One review per person per tool; your review enters moderation before publication.