iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The right free, open-source secret scanner depends on where your credentials might leak and how you want to catch them. Gitleaks focuses on Git and files, TruffleHog scans a wider range of sources and can check supported credentials with their providers, Yelp detect-secrets uses a baseline to manage findings in an existing repository, and Trivy includes secret detection in a broader security scanner. None is established here as the fastest or most accurate; try your shortlist on representative repositories and compare coverage, false positives, runtime, workflow fit, and license terms.
Which secret scanner fits your workflow?
| Tool | Best fit | Distinctive workflow | License and maintenance |
|---|---|---|---|
| Gitleaks | Git repositories, files, and local checks | Command-line scans and a documented pre-commit hook | MIT; upstream says it is feature complete and future releases will be security patches only |
| TruffleHog | Auditing varied repositories, services, and storage sources | Broad source coverage; can attempt provider checks for supported credential types | AGPL-3.0 for v3 |
| Yelp detect-secrets | Introducing checks to an established codebase | Review a baseline of existing findings, then check for new ones in staged or tracked files | Apache-2.0 |
| Trivy | Teams seeking secrets and other security checks in one scanner | Scans secrets alongside vulnerabilities, dependencies, infrastructure misconfigurations, and licenses | Apache-2.0 |
Gitleaks: Git-focused scanning with a maintenance caveat
Gitleaks detects passwords, API keys, and tokens in Git repositories, files, and standard input. Its project documents installation options including Homebrew, Docker, Go, and platform binaries, as well as a pre-commit hook and GitHub Action. That makes it a practical candidate when the main goal is to catch accidental commits close to the developer workflow.
There is an important maintenance qualification: the Gitleaks README says, “Gitleaks is feature complete. I’m not merging new features into Gitleaks. Future releases will be security patches only.” Teams adopting it should weigh that direction against their need for new capabilities and ongoing feature development.
Free tools Windows power users keep installed
One-click scans. No signup required.
TruffleHog: broader source coverage and supported credential checks
TruffleHog documents scanning Git, chat and wiki platforms, logs, API testing platforms, object stores, filesystems, and other sources. It can classify detected credential types and attempt a provider login to determine whether a supported secret is live. That is useful for triaging exposures, but it is not a universal test for every arbitrary string: validation applies only to credential types it supports, and checks should be run with appropriate authorization.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The project documents JSON and SARIF output, scans for repositories and organization sources, and options involving S3, filesystems, and Docker images. Those capabilities make it a candidate for security teams investigating more than source code alone. TruffleHog v3 uses AGPL-3.0, so review the license in light of your deployment and redistribution plans.
Yelp detect-secrets: manage old findings while preventing new ones
For a repository with existing secrets or noisy historic findings, detect-secrets offers a baseline workflow. Scan the current repository, review and label findings, then use its hook to flag newly introduced secrets in staged or tracked files. The baseline helps teams avoid repeatedly reviewing the same known findings during incremental checks.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This workflow is designed for baseline review and incremental prevention; it is not equivalent to auditing the full Git history. The project also documents configurable plugins, including provider-specific and entropy-based detectors, plus Python integration. Its license is Apache-2.0.
Trivy: secret detection as part of a broader scanner
Trivy includes sensitive-information and secret scanning alongside checks for vulnerabilities, software dependencies, infrastructure misconfigurations, and licenses. Its documented targets include filesystems, remote Git repositories, container images, virtual machine images, and Kubernetes. Teams already using it may value consolidating these checks rather than adding a dedicated tool.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Trivy’s breadth is the differentiator; the project materials cited here do not establish that its secret detection outperforms scanners focused on secrets. Its license is Apache-2.0.
How to choose and deploy a scanner
Match scan scope to likely exposure points
Start by listing where secrets could reside: local files, current Git trees, repository history, hosted source-control organizations, cloud object storage, containers, collaboration platforms, or API testing tools. These targets are not interchangeable. Confirm that the scanner documents support for the sources you need, rather than assuming that a repository scan covers every place credentials may have been copied.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose when checks should run
- Before a commit: Gitleaks documents a pre-commit hook; detect-secrets documents a hook for staged-file checks.
- In CI: Gitleaks documents a GitHub Action, while TruffleHog documents GitHub Actions and SARIF pathways.
- For broader audits: TruffleHog documents scanning multiple source types, and Trivy supports several repository, filesystem, image, and infrastructure targets.
Local checks can catch mistakes early, while CI or scheduled audits can cover work that bypasses a developer’s local setup. The appropriate combination depends on your repositories and operational needs.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePlan for findings and false positives
A detected pattern is a lead to investigate, not proof by itself that a credential is active. TruffleHog’s provider checks can help establish validity for supported types; other findings still need review. For existing repositories, detect-secrets makes baseline review explicit, while Gitleaks documents baselines and ignore configuration. Test the noise level against your own code before making a scanner a blocking gate; no universal false-positive rate is established for these tools.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Review terms and project direction
License compatibility depends on how software is deployed, modified, and redistributed. Check the current project terms before adoption, especially for TruffleHog v3’s AGPL-3.0. Also account for Gitleaks’ stated feature-complete status if you expect new features rather than security-patch releases.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Prevent API keys from reaching Git
- Keep credentials out of tracked files. Use your application’s approved secret-injection or environment configuration approach rather than embedding keys in source code.
- Run a local check before committing. Configure a documented pre-commit workflow, such as the one Gitleaks provides, or use detect-secrets’ staged-file hook.
- Add a repository or CI scan. A local hook can be bypassed or absent on another contributor’s machine; a shared check provides another opportunity to catch a leak.
- Review every finding. Determine whether it is a real credential, a test value, or a false positive; tune documented baseline or ignore workflows carefully so genuine secrets remain detectable.
- If a real credential was exposed, treat it as compromised. Revoke or rotate it through the issuing provider and investigate its use. Removing the string from the latest commit alone does not establish that it was never exposed elsewhere.
How GitHub’s built-in option fits
GitHub documents secret scanning as automatically available at no charge for public repositories. For organization-owned private and internal repositories, GitHub Secret Protection is required on eligible GitHub Team or Enterprise Cloud plans. See GitHub’s secret-scanning eligibility and setup documentation. This is a platform-specific complement or alternative, not one of the four cross-platform open-source scanners above.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute
