If a password or API key ever gets committed to a git repo, it's in the history forever unless someone rewrites it — and the longer it sits there, the more likely a bot scanning public GitHub finds it before you do. TruffleHog and Gitleaks are the two most widely used free tools for catching this before (or after) it happens: both scan git history, files and CI pipelines for hardcoded secrets, both run as a CLI, a pre-commit hook or a GitHub Action, and both have tens of thousands of GitHub stars. The real difference is what happens after a match: one of them tries to confirm the secret is actually still valid, the other doesn't.
The short version
| TruffleHog | Gitleaks | |
|---|---|---|
| Detection method | Pattern matching + active verification against the real service | Regex + entropy, no verification |
| Secret types covered | 800+ | Configurable via TOML rules |
| License | AGPL-3.0 (CLI) | MIT |
| Output formats | JSON and a few others | JSON, CSV, JUnit, SARIF |
| Enterprise tier | Yes — Slack/Jira/Confluence/Teams/SharePoint monitoring | No, CLI is the whole product |
| GitHub stars | 27,600+ | 28,900+ |
TruffleHog — confirms the leak is real before you panic
TruffleHog's core idea is that a regex match isn't proof of anything — a string that looks like an AWS key might be a placeholder, a test fixture, or already revoked. So after finding a candidate secret, TruffleHog actively verifies it against the real service (AWS, Stripe, GitHub, and hundreds more) and tells you whether it's still live. It covers 800+ secret types out of the box, scans git history, cloud storage (S3, GCS) and Docker images, and ships as a CLI, Docker image, GitHub Action or pre-commit hook.
Who it's for: teams who are tired of triaging false positives and want to know which alerts are actually urgent.
Pricing: the CLI is free and open source (AGPL-3.0); a paid Enterprise tier adds continuous monitoring across Slack, Jira, Confluence, Teams and SharePoint.
Honest limits: AGPL-3.0 is more restrictive than a permissive license if you'd redistribute it commercially, some verification checks need their own API keys to work, and the cross-platform monitoring features are Enterprise-only.
Gitleaks — lighter, MIT-licensed, and fully rule-driven
Gitleaks takes a simpler approach: fast regex- and entropy-based scanning against a rule set you fully control through a TOML config file, with allowlists to cut down false positives. It doesn't try to verify whether a secret is live — it flags anything that matches a pattern and lets you decide. In exchange, it's simpler to reason about, permissively licensed (MIT), and just as easy to drop into a pre-commit hook or GitHub Actions workflow, with output in JSON, CSV, JUnit or SARIF for feeding straight into other tooling.
Who it's for: teams that want a fast, fully open, no-verification scanner they can tune to their exact secret formats without touching a paid tier.
Pricing: completely free and open source (MIT), no paid tier at all.
Honest limits: the project has stopped adding new capabilities, detection is regex/entropy-based so it's easier to fool with obfuscated secrets, and covering a custom or unusual secret format means writing your own rule.
Pick TruffleHog if…
…you're drowning in false positives from a regex-only scanner and want to know which of the 40 flagged strings are actually exploitable right now — or you want one tool that also watches Slack and Confluence for leaks, on the paid tier.
Pick Gitleaks if…
…you want a lightweight, fully free, MIT-licensed scanner you can tune with your own rules, and you're fine doing the 'is this real?' triage yourself instead of paying for verification.
In practice, plenty of teams run both: Gitleaks as a fast pre-commit gate that blocks anything suspicious before it's even pushed, and TruffleHog periodically against the full history to confirm which of the accumulated flags are secrets that still need rotating.