TruffleHog
Open-source secret scanning that verifies whether the credential is still live.
What it is
TruffleHog scans git history, filesystems, S3 buckets, Docker images and CI logs for credentials, and — its key feature — actively verifies detected secrets against the relevant provider API to confirm whether they still work. That reduces a wall of findings to the handful that matter.
Best for
Where it is strong
- Live verification cuts false positives to near zero for supported providers.
- Free and easy to add as a pre-commit hook or CI step.
- Scans far beyond git — buckets, images, logs.
Where it falls short
- No dashboard or workflow in the free CLI.
- Verification requires outbound network calls, which some environments block.
- Full-history scans on large repositories are slow.
Pricing
Free tier available
Free tierFree tier: Open-source CLI is free and fully functional including verification.
What drives the bill: Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.
Check current pricing on Truffle Security’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use TruffleHog say
No reviews of TruffleHog yet. If you have used it in anger, yours would be the first.
Alternatives to TruffleHog
If TruffleHog is not the right fit, these solve the same problem differently.
