TruffleHog
A credential-scanning tool that searches Git repos, cloud storage and other sources for leaked secrets, then actively verifies each one against the real service so you know instantly which leaks are live.
🔗 Visit TruffleHog
Description
Most secret scanners just tell you a string in your code LOOKS like an API key — leaving you to manually check whether it still works, which wastes time on expired or fake matches. TruffleHog does that extra step for you: after finding a potential secret, it actively tries to use it against the real service (AWS, GitHub, Stripe, and 800+ others) and tells you definitively whether it's a live, exploitable credential or a dead one.
TruffleHog scans Git repositories, filesystems, Docker images, cloud storage (S3, GCS) and more, detecting over 800 secret types with active credential verification to eliminate false positives — including checking private keys against millions of known GitHub users and billions of TLS certificates. It's available as a CLI, Docker image, GitHub Action, pre-commit hook, or importable library. Free and open source under AGPL-3.0 (v3 is a full rewrite in Go), with 27.6k GitHub stars; a paid Enterprise tier adds continuous monitoring across Jira, Slack, Confluence, Teams and SharePoint.
💬 Our review
The short version: TruffleHog doesn't just flag suspicious strings like most secret scanners — it actually tests whether the leaked credential still works, so your security team can triage 'this is definitely exploitable' before 'this might be nothing.'
Against gitleaks, its closest open-source competitor, TruffleHog's verification step is the real differentiator: gitleaks tells you a regex matched, TruffleHog tells you whether that match can actually authenticate against the live service, which massively cuts down on wasted investigation time. The AGPL-3.0 license is worth knowing about if you plan to build TruffleHog into a distributed commercial product, since AGPL has stricter copyleft terms than gitleaks' MIT license. For teams that need to scan beyond git — Slack messages, Confluence pages, SharePoint — the paid Enterprise tier extends coverage, but the free CLI alone already covers the most common case (scanning repos and CI pipelines) at zero cost. For any team serious about catching leaked credentials before attackers do, the verification step alone justifies picking TruffleHog over a regex-only scanner.
💰 Pricing
📊 Global score
🤖 AI-enriched data
CLI open source et gratuit (AGPL-3.0) ; offre Enterprise payante pour la surveillance continue multi-plateformes (Jira, Slack, Confluence, Teams, SharePoint)
Pros
Vérification active des secrets contre le vrai service (pas juste une détection regex)
Couvre 800+ types de secrets
Disponible en CLI, Docker, GitHub Action, pre-commit hook
Scan Git, stockage cloud (S3/GCS), images Docker
27 600+ étoiles GitHub
Cons
Licence AGPL-3.0 plus restrictive pour un usage commercial redistribué
Nécessite des clés API pour vérifier certains secrets
Fonctionnalités multi-plateformes (Slack, Jira...) réservées à l'offre Enterprise payante