TruffleHog
Some data may be outdated — see provenance labels.
Find, verify, and analyze leaked credentials observed · 2026-10-01
Health v2 · maintenance only
93/100
- Activity 97
- Release rhythm 84
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-10-21. Adoption (stars, forks) is never an input.
- gap_med: 4.5
- age_days: 3580
- days_rel: 26
- days_push: 20
- n_releases_24m: 115
Adoption not part of the score
28212 stars · 2611 forks observed · 2026-10-01
What it is AI-extracted, prompt v1, taxonomy v1, 2026-10-05, confidence 0.97
TruffleHog is an open‑source command‑line tool that discovers, classifies, verifies, and analyses leaked credentials across code repositories, chats, and other data sources. It supports over 800 secret types and can validate whether a secret is active by attempting to authenticate with the provider.
Use cases
- scan git repositories for exposed API keys and passwords
- detect secrets in CI/CD pipelines before code is merged
- audit cloud storage buckets for leaked access tokens
- verify whether discovered credentials are still valid
- analyze the permissions associated with a leaked secret
- monitor chat logs and wikis for accidental credential exposure
- integrate secret scanning into pre‑commit or pre‑receive hooks
When to choose
- You need a free, open‑source solution for comprehensive secret detection.
- You want verification of secrets to prioritize remediation.
- Your workflow runs on Linux, macOS, or Windows and can invoke a CLI tool.
- You require support for a wide range of secret types (800+).
When to avoid
- You need continuous, real‑time monitoring across SaaS platforms without self‑hosting.
- You require a managed dashboard, role‑based access control, or SSO integration (features of the enterprise offering).
- Your environment cannot run Go binaries or you need a GUI‑based scanner.
Facets
cli-tool · maturity active
cli parser security windows cross-platform cli secret-scanning credential-detection verification analysis open-source go devsecops linux macos
7 sources
- readme: https://github.com/trufflesecurity/trufflehog · fetched 2026-10-01 · d8e4ea7cd804
- homepage: https://trufflesecurity.com · fetched 2026-09-21 · 35ab09bce1dc
- site_page: https://trufflesecurity.com/about · fetched 2026-09-21 · a15b7ffe4230
- site_page: https://docs.trufflesecurity.com/ · fetched 2026-09-21 · 6449aa236a89
- site_page: https://trufflesecurity.com/integrations · fetched 2026-09-21 · 64202a6548e5
- site_page: https://trufflesecurity.com/pricing · fetched 2026-09-21 · 426c8577ece4
- site_page: https://trufflesecurity.com/faq · fetched 2026-09-21 · c08228c79c80
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| trufflesecurity/trufflehog | main | 93 |
| trufflesecurity/trufflehog-burp-suite-extension | plugin | 23 |
| trufflesecurity/how-to-rotate | docs | 70 |
For agents
markdown · JSON · MCP: product_card(name="trufflesecurity/trufflehog")
Data as of 2026-10-19T08:05:51.212177+00:00 · Report a problem