Skip to content
SPECIFICTION
Get listed

TruffleHog

trufflesecurity.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit trufflesecurity.com
Spec score 7.5 #17 of 24 in Secrets Scanning Software

What it is

TruffleHog scans code repositories and other sources for exposed secrets, passwords, and sensitive keys. It checks version history across branches and can find credentials in comments and Docker images, among other locations. For detected credentials, it checks the relevant protocol or API to determine whether they are live, helping reduce false positives. Its Analyze feature identifies the resources and permissions associated with API keys and other secrets without requiring access to a provider’s user interface. Pre-commit and pre-receive hooks can scan changes before they are committed. Alerts can point to credential-rotation actions and security guidance. Integrations include GitHub, GitLab, Bitbucket, Gerrit, Docker, Jenkins, Slack, Teams, Jira, Confluence, Google Drive, S3, and SharePoint, among others. Notifications can go to Slack, Jira, Splunk, webhooks, email, or stdout. The open-source plan costs nothing and includes 800+ secret detectors.

Spec sheet

Purpose
TruffleHog scans code repositories and other sources to find exposed secrets, passwords, and sensitive keys.Read 30 Sep 2026 · trufflesecurity.com
Integrations
The integrations page lists GitHub, GitLab, Bitbucket, Gerrit, Docker, Jenkins, Slack, Teams, Jira, Confluence, Google Drive, S3, and SharePoint, among others.Read 30 Sep 2026 · trufflesecurity.com
Support
The Enterprise plan lists deployment and onboarding support plus ongoing priority technical support.Read 30 Sep 2026 · trufflesecurity.com
Founded
2021Read 23 Sep 2026 · trufflesecurity.com
Company
Truffle Security Co. identifies itself as the company behind TruffleHog, and its website footer says “Since 2021.”Read 30 Sep 2026 · trufflesecurity.com
Analysis
TruffleHog Analyze identifies the resources and permissions associated with API keys and other secrets without requiring access to a provider’s UI.Read 30 Sep 2026 · trufflesecurity.com
Deployment options
The product can run on the company’s isolated servers or on-premises, where scanners can reach internal sources and source credentials can remain in the customer’s infrastructure.Read 30 Sep 2026 · trufflesecurity.com
Deployment security
The company says each customer installation has a private environment and isolated database encrypted at rest, and deployments receive randomly generated infrastructure credentials.Read 30 Sep 2026 · trufflesecurity.com
Detection
It scans version history across branches and can find secrets in comments, Docker images, and other locations beyond repositories.Read 30 Sep 2026 · trufflesecurity.com
Notifications
When a secret is discovered, TruffleHog can send a Slack message, create a Jira ticket, or use Splunk, webhooks, email, and stdout.Read 30 Sep 2026 · trufflesecurity.com
Open-source license
The project’s GitHub repository identifies its license as AGPL-3.0.Read 30 Sep 2026 · github.com
Operating systems
The project documents Homebrew installation for macOS, Windows Docker examples, and binary releases; its installer supports Darwin, Linux, and Windows on amd64 and arm64.Read 30 Sep 2026 · github.com
Prevention and remediation
Pre-commit and pre-receive hooks can scan before commits, and alerts can link to credential rotation and security guides.Read 30 Sep 2026 · trufflesecurity.com
Secret handling
The company says scanning occurs in memory and it stores only finding location metadata and redacted credential information, not the secrets themselves.Read 30 Sep 2026 · trufflesecurity.com
Verification
For detected credentials, TruffleHog uses their protocol or API to verify whether they are live and reduce false positives.Read 30 Sep 2026 · trufflesecurity.com

Plans and prices

Open-source Free GitHub, S3, directory, GCS, and Docker scanning · 800+ secret detectors · GitHub Actions, pre-commit, and pre-receive hooks · custom regex and secret verification · automatic updates Read 30 Sep 2026 · trufflesecurity.com
Enterprise Priced on request 20+ integrations · on-premises or cloud scanning · continuous monitoring · Analyze for SaaS and Cloud add-ons · Forager add-on · SSO · role-based access control · onboarding and priority technical support Read 30 Sep 2026 · trufflesecurity.com

Every TruffleHog plan and price →

Strong points and limits

Strong points

  • Checks whether detected credentials are live.
  • Scans through pre-commit and pre-receive hooks.
  • Open-source plan includes 800+ secret detectors.
  • Can run on-premises or on isolated company servers.

Limits

  • Open-source scanning is identified as AGPL-3.0 licensed.

Who it suits

TruffleHog suits teams that need to find and verify exposed credentials across code and connected sources. Its hooks and notifications also suit teams building secret scans into development and alert workflows.

Verdict

TruffleHog combines secret detection with credential verification, analysis, and notification options. The open-source plan is free; teams considering Enterprise will need to account for its unlisted price.

Where Specifiction places it

Alternatives to TruffleHogAll alternatives →