TruffleHog

TruffleHog is a command-line secret scanner written in Go. It searches Git repositories, chat tools, wikis, object stores, filesystems, Docker images, and other sources for leaked credentials, then classifies what it finds and tests whether each secret is still valid. It's built for developers, security teams, and DevSecOps engineers who need to know not just that a key was committed somewhere, but whether that key can still be used to log in.

Unlike scanners that just pattern-match against regexes and report every hit, TruffleHog tries to distinguish noise from real risk. It classifies over 800 secret types (AWS, Stripe, Cloudflare, Postgres, SSL private keys, and more) and, where possible, makes a live request to confirm the credential still works. For a subset of commonly leaked credential types, it goes further and reports what the credential can access.

Key features

• Broad source coverage: scans Git history, GitHub orgs/repos (including issues and PRs), GitLab, S3 and GCS buckets, Docker images, filesystems, Postman workspaces, Jenkins, Elasticsearch, Hugging Face repos, and stdin.
• Verification: for most detected secret types, TruffleHog attempts to log in with the credential to confirm it's live, not just pattern-matched.
• Classification: over 800 detectors map raw strings back to the specific service and identity they belong to.
• Deep analysis: for a set of the most commonly leaked credential types, TruffleHog can enumerate what resources and permissions a valid credential has access to.
• Multiple output formats: plain text, JSON, and SARIF (for GitHub code scanning integration with PR-level annotations).
• CI-friendly flags: --since-commit, --branch, and --fail let you scope scans to a PR diff and fail the build on verified findings.
• Historical and hidden commit discovery: an experimental mode enumerates deleted and cross-fork commits on GitHub repos and scans them too.
• Signed releases: binaries ship with checksums signed via cosign for supply-chain verification.

Ideal use cases

TruffleHog fits well in CI pipelines that need to block merges when a verified secret shows up in a diff, in pre-commit hooks to catch leaks before they're pushed, and in one-off audits of a GitHub org, S3 bucket, or Docker image before a security review. It's also useful for incident response: pointing it at a repo's full history (including deleted commits, via the experimental object-discovery mode) to figure out what's been exposed over time.

It's less useful if you need continuous, cross-platform monitoring across Git, Jira, Slack, Confluence, Teams, and Sharepoint with a managed dashboard; that's what the paid Enterprise product is for. It's also not a general static analysis or SAST tool, it's narrowly focused on credential discovery and validation, so pair it with other tooling if you need broader code security scanning. Scanning very large repositories for hidden/deleted commits can take 20 minutes to a few hours, so it's not a fit for tight, frequent CI loops without scoping the scan.

Installation

Install via Homebrew on macOS:

brew install trufflehog

Or run it with Docker without installing anything locally:

docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys

On Apple Silicon, add the platform flag:

docker run --platform linux/arm64 --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest git https://github.com/trufflesecurity/test_keys

To build from source (requires Go):

git clone https://github.com/trufflesecurity/trufflehog.git
cd trufflehog; go install

Or use the install script, optionally verifying the signature with cosign:

curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin

Binary releases are also available directly from the GitHub Releases page. Once installed, a basic scan looks like:

trufflehog git https://github.com/trufflesecurity/test_keys --results=verified