TruffleHog is a product in the Secrets Detection category. It covers Password Cracking and Secret Detection.

What is the pricing for TruffleHog?

TruffleHog is free. Download and setup instructions are at https://github.com/trufflesecurity/trufflehog.

What are alternatives to TruffleHog?

Alternatives to TruffleHog listed on CybersecTools: 1. Apiiro Secrets Security - Detects, validates, and remediates secrets in code and pipelines (Commercial) 2. GitGuardian Non-Human Identity security - Non-human identity security platform for secrets detection and management (Commercial) 3. BitPatrol - AI-powered secret detection tool for real-time credential scanning in code (Commercial) 4. Infisical Radar - Continuous secret scanning and leak detection tool with precommit checks (Commercial) 5. Secrets Security - Detects, prioritizes, and auto-revokes exposed secrets across the SDLC (Free) Compare all TruffleHog alternatives at https://cybersectools.com/alternatives/trufflehog

What deployment and organization size does TruffleHog fit?

TruffleHog is available as on-premises. It is listed for startup, smb, mid-market and enterprise organizations. It is free.

TruffleHog

Find leaked credentials by scanning repositories for high entropy strings.

Application Security Secrets DetectionOn-PremisesStartup · SMB · Mid-Market · EnterpriseFree21,216

Visit website

What is TruffleHog?

TruffleHog is an open-source secrets scanning tool developed by Truffle Security that searches for leaked credentials across a wide range of sources including Git repositories, chat platforms, wikis, logs, API testing platforms, object stores, and filesystems.

The tool operates across four primary functions:

Discovery: Scans multiple source types for exposed secrets such as API keys, database passwords, and private encryption keys.
Classification: Identifies and categorizes over 800 distinct secret types, mapping each finding to the specific service or identity it belongs to (e.g., AWS, Stripe, Cloudflare, PostgreSQL, SSL private keys).
Validation: Actively attempts to authenticate using discovered secrets to determine whether they are live and currently usable, helping prioritize response efforts.
Analysis: For approximately 20 of the most commonly leaked credential types, performs extended analysis to determine who created the secret, what resources it can access, and what permissions it holds.

TruffleHog can be installed via Homebrew, Docker, binary release, or compiled from source. It supports checksum verification using cosign for artifact integrity.

An enterprise version, TruffleHog Enterprise, provides continuous monitoring across Git, Jira, Slack, Confluence, Microsoft Teams, and SharePoint.

The open-source version is available under the AGPL-3.0 license on GitHub and is written in Go.

Password Cracking

Secret Detection

Category: Application Security · Secrets Detection · What is Secrets Detection?
Deployment: On-Premises
Pricing model: Free
Where it fits in your security program (NIST CSF 2.0): Protect: helps you prevent attacks and keep data safe.
Detect: helps you spot attacks and unusual activity.
Website: github.com