ggshield vs KeyHog

ggshield is GitGuardian’s command-line tool for finding hardcoded secrets before code is pushed. It can scan local files and repositories, run before commits or in CI pipelines, and act as a pre-receive hook for self-managed version control. It also scans Docker image layers, build arguments, and Dockerfiles. GitGuardian’s documentation describes detection for more than 600 secret types. The open-source CLI uses a closed-source secrets detection library behind GitGuardian’s public API. It runs on macOS, Linux, and Windows, with API and self-hosted options. Standard installation needs Git and a supported, non-end-of-life Python version; standalone packages are an exception. Scans require an API key for a GitGuardian workspace, and the login command can provision and store a personal access token. Files over 1 MB are ignored, and API calls accept up to 20 documents each. The free Starter plan is free, billed Always; it includes up to 25 developers, 10K API calls per month, up to 500 historical scan detections, and unlimited real-time scanning.

KeyHog is free, open-source Rust software for finding and verifying exposed API keys, tokens, passwords, and other credentials. It scans source repositories and Git history, archives, Docker images, URLs and HAR captures, collaboration content, VCS inventories, cloud-storage inventories, browser assets, and running systems. The project lists 934 service-specific detectors, decode-before-scanning, contextual evidence and suppression, and optional live provider verification. GPU execution can use CUDA, native Metal, or portable WGPU, with calibration selecting a parity-backed option. Its GitHub Action scans checked-out trees, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact. Documented CI integrations include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon checks changed repository blobs before commits; Windows uses in-process scanning. KeyHog runs on Linux, macOS, Windows, and self-hosted deployments, and requires Rust 1.89 or newer. Code and detector TOMLs are licensed MIT OR Apache-2.0. The plan costs nothing.