TruffleHog finds and verifies leaked secrets in code and cloud. Free open-source scanner plus a paid enterprise platform from Truffle Security.
TruffleHog is a secret-scanning tool that detects leaked credentials, such as API keys, tokens, and passwords, across source code repositories, cloud storage, Docker images, and collaboration tools. It is built and commercialized by Truffle Security Co., a San Francisco-based security company founded in 2021, though the open-source scanning engine itself originated earlier, in 2016, as one of the first tools to scan full git history rather than just the latest commit for exposed secrets.
The project has two layers: a free, open-source command-line scanner used widely across the developer community, and a paid Enterprise platform built on the same detection engine that adds centralized management, continuous monitoring, and integrations aimed at security teams operating at scale.
Truffle Security has raised more than 40 million dollars in venture funding, including a 25 million dollar Series B round in November 2025, with earlier backing from investors such as Intel Capital and Andreessen Horowitz, reflecting growing enterprise demand for secrets and non-human identity security.
TruffleHog's core differentiator is live credential verification: rather than only pattern-matching strings that look like secrets, it actively checks whether a discovered key or token is still valid against the corresponding provider's API. This dramatically cuts down on false positives, which is one of the most common complaints about traditional regex-based secret scanners.
The open-source scanner supports more than 800 built-in secret detectors and can scan GitHub and GitLab repositories, Amazon S3 and Google Cloud Storage buckets, Docker images, and local filesystems. Pre-commit and pre-receive git hooks, along with GitHub Actions integration, let teams stop secrets from ever being committed rather than only discovering them after the fact.
The paid Enterprise tier extends this foundation with a centralized dashboard for tracking and remediating findings across an organization, continuous monitoring, alerting and reporting, SAML or OAuth single sign-on, role-based access control, and specialized add-ons like TruffleHog Analyze, which maps the permissions and blast radius of a leaked credential, and Forager, which monitors public datasets for exposed secrets.
The open-source version of TruffleHog is completely free and available on GitHub, including full access to its 800-plus secret detectors, verification engine, and hook-based prevention tooling; there is no artificial cap on scanning volume for the open-source CLI.
The Enterprise tier is not publicly priced and requires contacting Truffle Security's sales team for a quote. Enterprise pricing typically reflects factors such as the number of repositories, cloud accounts, and integrations an organization needs monitored, along with which add-on modules (Analyze, Forager) are included.
TruffleHog is a secret-scanning tool that finds and verifies leaked credentials such as API keys and tokens across code, cloud storage, and Docker images.
The open-source version of TruffleHog is free and available on GitHub; a paid Enterprise tier with additional features is also available.
The open-source version provides scanning and verification via the CLI, while Enterprise adds a centralized dashboard, continuous monitoring, integrations, SSO, and RBAC.
Yes, TruffleHog's verification engine checks discovered secrets against the relevant provider's API to confirm whether they are still valid.
TruffleHog can scan GitHub and GitLab repositories, Amazon S3 and Google Cloud Storage buckets, Docker images, and local file directories.
TruffleHog is developed and commercialized by Truffle Security Co., a security company founded in 2021 and headquartered in San Francisco.
TruffleHog's built-in live secret verification is a key differentiator versus tools like Gitleaks, which primarily rely on pattern matching without confirming validity.
Yes, Docker image scanning is one of the supported source types in both the open-source and Enterprise versions.