TruffleHog

Name: TruffleHog
Author: Truffle Security

Open-source secret scanning that verifies whether the credential is still live.

Security TestingFree tierOpen sourceSelf-hostable

What it is

TruffleHog scans git history, filesystems, S3 buckets, Docker images and CI logs for credentials, and — its key feature — actively verifies detected secrets against the relevant provider API to confirm whether they still work. That reduces a wall of findings to the handful that matter.

Best for

Teams that want free, high-signal secret scanning in the pipeline today.

Where it is strong

Live verification cuts false positives to near zero for supported providers.
Free and easy to add as a pre-commit hook or CI step.
Scans far beyond git — buckets, images, logs.

Where it falls short

No dashboard or workflow in the free CLI.
Verification requires outbound network calls, which some environments block.
Full-history scans on large repositories are slow.

Pricing

Free tier available

Free tier

Free tier: Open-source CLI is free and fully functional including verification.

What drives the bill: Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Check current pricing on Truffle Security’s site

Figures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.

Works with

GitHub ActionsGitLab CIDockerpre-commitJenkins

What people who use TruffleHog say

No reviews of TruffleHog yet. If you have used it in anger, yours would be the first.

Alternatives to TruffleHog

If TruffleHog is not the right fit, these solve the same problem differently.

GitGuardian

Security Testing

Secrets detection across your repositories, history and developer machines.

Free tierSelf-host

Snyk