# TruffleHog

> Secrets scanner that finds credentials in Git, filesystems, S3/GCS buckets and Docker images, classifies 800+ types, and verifies whether they are live.

Stars: 28.8k · Language: Go · License: AGPL-3.0 · Categories: Dev Tools

- Repository: https://github.com/trufflesecurity/trufflehog
- Website: https://trufflesecurity.com
- Page: https://www.trmn.sh/tools/trufflehog

## Install

- Homebrew: `brew install trufflehog`
- Install script: `curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin`
- Docker: `docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys`

## Overview

TruffleHog is a secrets scanning tool for finding leaked credentials such as API keys, database passwords, and private encryption keys. It works in four stages: discovery, classification, validation, and analysis. It is a security tool aimed at developers, AppSec teams, and security engineers who audit repositories, infrastructure, and CI pipelines for exposed secrets.

Scanning is done through subcommands for each source. The README documents `git` (remote URLs or local repos via `file://`), `github` (orgs, repos, issue comments, PR comments, with `--exclude-archived`), `s3`, `gcs`, `docker` (remote registry, local daemon, or tarball images), and `filesystem` (individual files or directories). It also mentions scanning chats, wikis, logs, and API testing platforms. Local git repos are cloned to a temp directory before scanning to guard against malicious git configs (CVE-2025-41390). You can change the location with `--clone-path`, or skip the clone with `--trust-local-git-config`.

TruffleHog classifies over 800 secret types and maps each to the identity it belongs to, for example AWS, Stripe, Cloudflare, Postgres, or SSL private keys. For classified secrets, it logs in to check whether the credential is live, and `--results=verified` or `--results=verified,unknown` filters the output by that status. For about 20 commonly leaked credential types, the analysis step sends additional requests to determine who created the secret and what resources and permissions it has.

Output is human-readable by default, with `--json` for JSON and `--sarif` for SARIF. GitHub code scanning can ingest SARIF to show findings on pull request diffs and in the Security tab. SARIF results are buffered in memory until the scan ends. Install options include Homebrew, Docker, release binaries, an install script with optional cosign checksum verification, and building from source with Go. Release artifacts are checksummed, and the checksum file is signed with cosign.

### Installation

```bash
# via Homebrew
brew install trufflehog
```

```bash
# via Install script
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
```

```bash
# via Docker
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys
```

![TruffleHog GitHub scanning demo](https://media.trmn.sh/cached/5452d77a5b1ccadfc8f189589bc014d3cee8bdbb985657d9276e1307a0754a52.svg)

## Alternatives

- [asdf](https://www.trmn.sh/tools/asdf.md): Version manager that handles multiple language runtimes per project through plugins, using a single CLI and a .tool-versions file. (Go, 25.6k stars)
- [k6](https://www.trmn.sh/tools/k6.md): JavaScript-based load testing tool for developers with HTTP, WebSockets, gRPC support and CI integration (Go, 32.1k stars)
- [sops](https://www.trmn.sh/tools/sops.md): Editor for encrypted files supporting YAML, JSON, ENV, INI formats with AWS KMS, GCP KMS, Azure Key Vault, age, and PGP encryption (Go, 23.5k stars)
- [k9s](https://www.trmn.sh/tools/k9s.md): Terminal UI for managing and observing Kubernetes clusters with real-time monitoring and resource navigation (Go, 34.9k stars)
- [VHS](https://www.trmn.sh/tools/vhs.md): Generate terminal GIFs from code scripts for testing and demonstrating CLI tools (Go, 21.2k stars)

## Guides

- [Best CLI Secret Scanners](https://www.trmn.sh/best/secret-scanners): Compare gitleaks, TruffleHog, trivy: workflows, strengths and tradeoffs.

---

Canonical: https://www.trmn.sh/tools/trufflehog