TruffleHog
TruffleHog: Deep secret detection and credential verification for development and security teams. Ranked #2 of 24 in Secrets Scanning Software by our editors (9.2/10); pricing: Free plan; best for open-source teams needing deep verification.
At a glance
- Editor score9.2 / 10
- PricingFree plan
- Best forOpen-source teams needing deep verification
- Free planYes
- CI/CD scanningYes
- Founded2021
- Facts checked22 Sep 2026
Where it wins
- Classifies more than 800 secret types and verifies active credentials
- Scans history, branches, pull requests, files, containers, and connected sources
- Supports CI/CD, pre-commit, pre-receive, remediation, and credential tracking
Where it doesn't
- Enterprise capabilities require a contact-sales process
- Deployment is focused on Linux and self-hosted environments
- Permission analysis applies to supported credentials rather than every finding
Our verdict on TruffleHog
TruffleHog is an open-source secrets-scanning tool for developers and security teams. It searches repositories, version history, files, containers, and connected sources for credentials such as API keys, passwords, and tokens. Its core audience is teams that need more than pattern matching: TruffleHog classifies detected secret types, checks whether credentials are active, and analyzes associated permissions for supported credentials.
Verification is the standout capability. TruffleHog can programmatically determine whether detected credentials are active, then analyze permissions and related resources for supported credentials. The scanner covers more than 800 secret types and can examine repository history, multiple branches, GitHub pull requests, and pull-request comments. Custom regular-expression detectors and verification webhooks extend coverage for organization-specific patterns. Preventive controls include GitHub Actions scanning, pre-commit hooks, and pre-receive hooks, while remediation and credential-status tracking help teams follow findings over time.
The open-source edition is free and includes GitHub, S3, directory, GCS, and Docker scanning, plus automatic updates and the core hooks and detector features. TruffleHog Enterprise adds 20+ integrations, on-premises and cloud scanning, continuous monitoring, alerting, analytics, single sign-on, and role-based access control. Supported ecosystem connections include GitHub, GitLab, Bitbucket, Azure Repos, Jenkins, Buildkite, Gerrit, Slack, Jira, Confluence, Microsoft Teams, Google Drive, and SharePoint. Teams wanting deep verification and open-source flexibility should consider TruffleHog; organizations seeking a different deployment model or a narrower scanning workflow may prefer an alternative.
Your product? Our editors can test TruffleHog in depth and publish a review, labelled as paid · from $149/mo →
TruffleHog pricing
All 2 TruffleHog plans and prices →
TruffleHog fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Supported VCS | GitHub, GitLab, Git, Bitbucket, Gerrit, Azure Repos |
| CI/CD scanning | Yes |
| Pre-commit scanning | Yes |
| Pull-request scanning | Yes |
| Push protection | Yes |
| Custom detection rules | Yes |
| Repository limit | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Windows, macOS, Linux |
| Compliance & security | SSO/SAML |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 22+ integrations: GitHub, GitLab, Git, Bitbucket, Gerrit, Azure Repos … See all → |
| Pricing | Free plan (source) |
| Website | trufflesecurity.com |
| Facts checked | 22 Sep 2026 |
TruffleHog integrations
TruffleHog lists 22+ integrations on its own site — the 20 named here are the ones its pages call out.
- GitHub
- GitLab
- Git
- Bitbucket
- Gerrit
- Azure Repos
- Jenkins
- Buildkite
- Travis CI
- CircleCI
- Slack
- Microsoft Teams
- Jira
- Vector
- Confluence
- Google Drive
- S3
- SharePoint
- Splunk
- Webhook
See all TruffleHog integrations →
Alternatives to TruffleHog
- GitGuardianBroad secrets scanning with developer workflow controls, remediation, and enterprise deployment options.9.3
- KingfisherA broad, free scanner for exposed credentials across code, cloud, containers, and developer platforms.9.1
- ggshieldA broad, developer-focused scanner with a free workspace plan and extensive CI coverage.9.0
See all TruffleHog alternatives →
TruffleHog vs the competition
- TruffleHog vs GitGuardian
- TruffleHog vs Kingfisher
- TruffleHog vs ggshield
- TruffleHog vs Datadog Secret Scanning
- TruffleHog vs Vooda AI
- TruffleHog vs Arnica Secrets Security
Compare TruffleHog with any tool side by side →
Also Ranked In
TruffleHog is ranked in 2 of our directories.
Used TruffleHog? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used TruffleHog for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
TruffleHog is listed in our Secrets Scanning Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/trufflehog/"><img src="https://www.itechguides.com/best/badge/trufflehog.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update