# trufflesecurity/trufflehog

Find, verify, and analyze leaked credentials

Repository: https://github.com/trufflesecurity/trufflehog
Canonical: https://ross.abutalabs.com/products/trufflehog
Homepage: https://trufflesecurity.com
Language: Go
License: AGPL-3.0
License Family: copyleft
Topics: secret, trufflehog, credentials, security, devsecops, dynamic-analysis, security-tools, secrets, verification, secret-management, precommit, scanning
Last push: 2026-08-26T19:59:14+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 87, longevity 100
- inputs: {"age_days": 3532, "days_push": 7, "days_rel": 9, "gap_med": 4.0, "n_releases_24m": 119}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 27599, forks 2551 (observed 2026-08-28T04:11:47.842591+00:00)

## What it is
TruffleHog is an open-source secrets scanning tool that discovers, classifies, validates, and analyzes leaked credentials across Git repositories, object stores, filesystems, chats, and other sources. It detects over 800 credential types and verifies whether found secrets are live by attempting authentication with the providers.

## Use cases
- scan a git repository for leaked api keys and passwords
- verify whether detected credentials are still active
- block secrets from being committed with pre-commit hooks
- scan docker images and s3 buckets for exposed secrets
- find leaked aws keys in github history
- run secret scanning in ci pipelines
- analyze permissions of leaked cloud credentials

## When to choose
- you need to detect and verify leaked credentials in code, history, or cloud storage
- you want secret scanning integrated into pre-commit hooks or CI/CD pipelines
- you need broad coverage of 800+ credential types with live validation to cut false positives

## When to avoid
- you need continuous monitoring with dashboards, alerting, and SSO, which requires the enterprise product
- you need a general-purpose static analysis or SAST tool rather than credential detection
- your project cannot use AGPL-3.0 licensed software

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, secrets-management, developer-tools, ci-cd
- domain: security, developer-tools, version-control
- platform: windows, cli, cross-platform
- tags: secret-scanning, credential-detection, devsecops, pre-commit, git-scanning, secret-verification, devops, linux, macos, docker

## Member repositories
- trufflesecurity/trufflehog (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:47.842591+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:54:30.952276+00:00, confidence not recorded.
  - readme: https://github.com/trufflesecurity/trufflehog (fetched 2026-08-28T04:11:47.842591+00:00, sha d8e4ea7cd804)
  - homepage: https://trufflesecurity.com (fetched 2026-08-29T07:51:33.196768+00:00, sha b1797a16584d)
  - site_page: https://trufflesecurity.com/about (fetched 2026-08-29T07:51:33.203247+00:00, sha e5dfa1a89950)
  - site_page: https://docs.trufflesecurity.com/ (fetched 2026-08-29T07:51:33.206705+00:00, sha bbc49315a7fd)
  - site_page: https://trufflesecurity.com/integrations (fetched 2026-08-29T07:51:33.199555+00:00, sha d5d8f78d944f)
  - site_page: https://trufflesecurity.com/pricing (fetched 2026-08-29T07:51:33.201490+00:00, sha e7fa35cec5fd)
  - site_page: https://trufflesecurity.com/faq (fetched 2026-08-29T07:51:33.205034+00:00, sha ee98fa87924f)
- Data as of 2026-08-30T08:39:29.467469+00:00.