TruffleHog

A scanner that finds leaked API keys and passwords in Git history, files, cloud storage, and more. It can also check whether a key it finds still works.

View on GitHub(opens in a new tab)Official site(opens in a new tab)
cat trufflehog/meta.ymlChecked on 2026-10-25

Safety

Impact Reaches othersSees other people's traffic or sends traffic to their devices
Admin rights
Not required
Test lab
Not required

Usage

Purpose
Defense
Difficulty
Beginner
Type
Command line
Platforms
Linux / macOS / Windows / Docker

Trust

Repository
trufflesecurity/trufflehog
License
CopyleftAGPL-3.0
GitHub
stars28,6982026-10-25
Maintenance
Actively updatedLast update 2026-10-24
CategoryVulnerability scanningAppSec and DevSecOps
Contents
  1. Introduction
  2. What TruffleHog can scan
  3. How verification works: keys go to the issuer
  4. Try it safely: scan your own test folder
  5. Common uses
  6. How it differs from Gitleaks
  7. Cautions
  8. Read next
  9. Sources

TruffleHog finds API keys and passwords that ended up in code history, files, or cloud storage. It can send each key it finds to the issuing service to check whether the key still works, so learn how that works before you run it.

This review is for developers who keep code on GitHub or similar services. After reading it, you can do the following:

  • Search your own repositories and folders for secrets
  • Turn off key checking (verification) and filter the results
  • Clean up correctly when a secret turns up

What TruffleHog can scan

TruffleHog has a subcommand for each kind of source. The README lists these, among others:

Subcommand What it scans
git Commit history of a Git repository
github / gitlab Repositories and organizations on GitHub or GitLab
filesystem Files and directories
docker Docker images
s3 / gcs Amazon S3 and Google Cloud Storage buckets
stdin Text passed on standard input

There are also huggingface, syslog, circleci, travisci, postman, jenkins, elasticsearch, and multi-scan. According to the README, TruffleHog classifies over 800 secret types.

How verification works: keys go to the issuer

For each key it finds, TruffleHog connects to the API of the service the key belongs to and checks whether the key is valid. The README calls this credential verification. For an AWS key, for example, it calls GetCallerIdentity against the AWS API.

Verification runs by default. Results fall into three groups:

Result Meaning
verified The API confirmed that the key is valid
unverified Found, but not confirmed as valid (the key may be invalid or expired, or verification was turned off)
unknown Verification was attempted but failed because of a network or API error

You can change verification and output with these options:

Option Effect
--no-verification Skips verification. Keys are not sent to outside services
--results=verified Shows only results confirmed as valid
--results=verified,unknown Shows valid results and results that could not be checked

Without --results, TruffleHog shows verified,unverified,unknown. The README also says that for about 20 of the most commonly leaked key types, the analyze subcommand sends many requests to learn what the key can access and with which permissions.

What it does not doTruffleHog finds and checks secrets. It does not delete or revoke them. You revoke and replace the key yourself at the issuing service.

Try it safely: scan your own test folder

Do not use real keys. Use a test folder you create and dummy strings. Start with --no-verification so nothing is sent to outside services.

  1. Install TruffleHog. On macOS, run brew install trufflehog. On Windows and Linux, download the file for your OS from the releases page and unpack it. A Docker image, trufflesecurity/trufflehog, is also available.

  2. Create a practice folder (for example, practice) and write dummy strings into a config-like text file. Do not put real service keys in it.

  3. Run this command:

    trufflehog filesystem practice --no-verification

  4. If nothing is found, TruffleHog prints only its banner line and exits. Depending on their format, dummy strings may not be detected.

The official README uses a practice repository called test_keys in its examples. To practice scanning Git history, clone it and run TruffleHog from the parent folder.

git clone https://github.com/trufflesecurity/test_keys.git
trufflehog git file://test_keys --no-verification

Common uses

Task Example command
Scan the history of your own repository trufflehog git file://. --no-verification
Scan a folder or files trufflehog filesystem path/to/dir
In CI, scan only new commits and fail on findings trufflehog git file://. --since-commit main --branch feature-1 --results=verified,unknown --fail

With --fail, TruffleHog exits with code 183 when it finds results. It exits with 0 when there are no errors and no results, and with 1 when an error occurs. To stop secrets before they are committed, see the official PreCommit.md for pre-commit hook setup. To ignore a specific line, add a trufflehog:ignore comment to it.

How it differs from Gitleaks

Both tools look for secrets. These differences come from the official sources:

TruffleHog Gitleaks
Verification of found keys Yes (on by default) The README does not describe a verification feature
License AGPL-3.0 MIT
Sources Git, files, cloud storage, CI, and many more Git, directories, standard input

If you want everything to stay on your machine, use Gitleaks, or run TruffleHog with --no-verification.

Cautions

  • Scan only repositories that belong to you or your organization. If you verify a key found in someone else’s repository, you connect to a service with someone else’s credentials. Do not do this without permission.
  • If you must scan someone else’s repository, get written permission first and use --no-verification.
  • When you find a secret, removing it from files and history is not enough. Revoke the key at the issuing service and create a new one. Copies may remain in old commits or in clones of the repository.
  • Results show the key itself. Do not run scans while sharing your screen or where others can read the logs.
  • TruffleHog has an update check. Use --no-update to turn it off.

Sources

  1. Official repository READMEgithub.com/trufflesecurity/trufflehog
  2. License (LICENSE)github.com/trufflesecurity/trufflehog/blob/main/LICENSE
  3. Releasesgithub.com/trufflesecurity/trufflehog/releases
  4. Pre-commit hooks guide (PreCommit.md)github.com/trufflesecurity/trufflehog/blob/main/PreCommit.md
  5. Practice repository test_keysgithub.com/trufflesecurity/test_keys
  6. Gitleaks official repository READMEgithub.com/gitleaks/gitleaks

Checked on 2026-10-25

Similar tools

Gitleaks

Impact Local only
gitleaks/gitleaks

A command-line tool that finds passwords, API keys, and tokens that have slipped into Git repositories and files.

Purpose
Defense
Type
Command line
Difficulty
Beginner
License
PermissiveMIT
Category
Vulnerability scanning
Actively updatedstars30,315Last update 2026-10-23
Read the Gitleaks review

Infisical

Impact Local only
infisical/infisical

A secrets management platform that keeps API keys and passwords in one place and hands them to apps and CI at runtime. Use Infisical Cloud or run it yourself.

Purpose
Defense
Type
Self-hosted server
Difficulty
Intermediate
License
Check termsMIT（ee ディレクトリは商用の Enterprise ライセンス）
Category
Defense and hardening / AppSec and DevSecOps
Actively updatedstars29,981Last update 2026-10-25
Read the Infisical review