Gitleaks vs KeyHog
Gitleaks
github.comKeyHog
github.comSide by side
| Figure | Gitleaks | KeyHog |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Secrets Scanning Software | 7.8 (#11) | 7.7 (#14) |
| License | The repository is distributed under the MIT License, which permits use, copying, modification, distribution, sublicensing, and sale subject to its terms. | The code and detector TOMLs are dual-licensed MIT OR Apache-2.0, and the repository permits commercial use, embedding, forks, and hosted services under either license. |
| Purpose | Gitleaks detects secrets such as passwords, API keys, and tokens in Git repositories, files, and stdin. | KeyHog is an open-source Rust secret scanner that finds and verifies leaked API keys, tokens, passwords, and credentials across code, Git history, containers, cloud storage, browser assets, collaboration content, and running systems. |
| Security reporting | The security policy asks users to report vulnerabilities privately through GitHub rather than opening a public issue. | The maintainer asks users to report security issues through GitHub private vulnerability reporting or email [email protected]. |
Plans
In their own words
Gitleaks
Gitleaks is free, MIT-licensed software that detects secrets such as passwords, API keys, and tokens in Git repositories, files, and standard input. It runs on Linux, macOS, Windows, and self-hosted systems. Scans can target repositories, directories, individual files, or streamed data. Custom rules can use Go regular expressions, entropy checks, path matching, keywords, and allowlists. A previous report can serve as a baseline so later scans show only new findings. Output is available in JSON, CSV, JUnit, SARIF, or template formats. The project documents pre-commit hook and GitHub Action use, plus CI/CD, pull-request, and supported VCS workflows for GitHub, GitLab, Azure DevOps, Gitea, and Bitbucket. Installation options include Homebrew, Docker, Go, and prebuilt release binaries. A redaction option masks secrets in logs and standard output, with a default redaction value of 100%. The project describes itself as feature complete, with future releases limited to security patches, and its security policy supports only the latest version.
KeyHog
KeyHog is free, open-source Rust software for finding and verifying exposed API keys, tokens, passwords, and other credentials. It scans source repositories and Git history, archives, Docker images, URLs and HAR captures, collaboration content, VCS inventories, cloud-storage inventories, browser assets, and running systems. The project lists 934 service-specific detectors, decode-before-scanning, contextual evidence and suppression, and optional live provider verification. GPU execution can use CUDA, native Metal, or portable WGPU, with calibration selecting a parity-backed option. Its GitHub Action scans checked-out trees, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact. Documented CI integrations include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon checks changed repository blobs before commits; Windows uses in-process scanning. KeyHog runs on Linux, macOS, Windows, and self-hosted deployments, and requires Rust 1.89 or newer. Code and detector TOMLs are licensed MIT OR Apache-2.0. The plan costs nothing.