KeyHog vs Kingfisher
KeyHog
github.comKingfisher
github.comSide by side
| Figure | KeyHog | Kingfisher |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Secrets Scanning Software | 7.7 (#14) | 7.8 (#12) |
| Detection | The repository describes 934 service-specific detectors, decode-through scanning, context-aware evidence and suppression, and optional live provider verification. | The project describes a multithreaded Vectorscan scanning engine and support for Betterleaks TOML and Kingfisher YAML rule formats. |
| License | The code and detector TOMLs are dual-licensed MIT OR Apache-2.0, and the repository permits commercial use, embedding, forks, and hosted services under either license. | The repository states that Kingfisher is licensed under Apache License 2.0. |
| Purpose | KeyHog is an open-source Rust secret scanner that finds and verifies leaked API keys, tokens, passwords, and credentials across code, Git history, containers, cloud storage, browser assets, collaboration content, and running systems. | Kingfisher scans for leaked secrets, checks which credentials are live, maps their blast radius, and supports revocation for supported credentials. |
Plans
In their own words
KeyHog
KeyHog is free, open-source Rust software for finding and verifying exposed API keys, tokens, passwords, and other credentials. It scans source repositories and Git history, archives, Docker images, URLs and HAR captures, collaboration content, VCS inventories, cloud-storage inventories, browser assets, and running systems. The project lists 934 service-specific detectors, decode-before-scanning, contextual evidence and suppression, and optional live provider verification. GPU execution can use CUDA, native Metal, or portable WGPU, with calibration selecting a parity-backed option. Its GitHub Action scans checked-out trees, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact. Documented CI integrations include GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon checks changed repository blobs before commits; Windows uses in-process scanning. KeyHog runs on Linux, macOS, Windows, and self-hosted deployments, and requires Rust 1.89 or newer. Code and detector TOMLs are licensed MIT OR Apache-2.0. The plan costs nothing.
Kingfisher
Kingfisher is a free tool for scanning for leaked secrets, checking whether credentials are live, mapping their blast radius, and supporting revocation for some credentials. It can scan files, directories, Git repositories and history, archives, SQLite databases, Python bytecode, Docker images, cloud storage, and developer platforms. Documented integrations include GitHub, GitLab, Azure Repos, Bitbucket, Gitea, Hugging Face, AWS S3, Google Cloud Storage, Docker, Jira, Confluence, Slack, Microsoft Teams, and Postman. The project describes a multithreaded Vectorscan engine and supports Betterleaks TOML and Kingfisher YAML rules. Reports can be human-readable or exported as TOON, JSON, JSONL, SARIF, BSON, or HTML. A local viewer can combine and deduplicate Kingfisher, SARIF, Gitleaks, and TruffleHog reports. Revocation is opt-in and depends on a supported provider workflow. Live validation and blast-radius mapping make provider API requests, which should only be used when authorized. Kingfisher runs on Linux, macOS, and Windows, and supports self-hosted use.