truffleHog

What it is and what it does

TruffleHog is a secrets discovery and validation tool that searches through Git repositories and other sources for leaked credentials. It classifies over 800 secret types—including API keys, database passwords, encryption keys, and service-specific credentials—and maps them back to their origin (AWS, Stripe, Cloudflare, Postgres, etc.). For many common credential types, it can validate whether a discovered secret is still active by attempting authentication, distinguishing between historical leaks and present dangers.

The tool is designed for security teams and developers who need to audit code history, scan organizational repositories, or integrate credential detection into CI/CD pipelines. It outputs findings in multiple formats (plain text, JSON, SARIF) and supports scanning across Git, Jira, Slack, Confluence, and other platforms through its enterprise variant. The open-source version focuses on discovery, classification, and validation of secrets found in Git history and local filesystems.

Use it for:

• Audit a Git repository's full history to find accidentally committed API keys or database passwords before they cause a breach.
• Scan a GitHub organization's repositories to identify and validate leaked credentials across multiple projects.
• Integrate secret detection into CI/CD pipelines to block commits containing unvalidated high-entropy strings.
• Classify and analyze discovered secrets to understand which services or accounts are at risk and what permissions they hold.
• Generate SARIF output for GitHub Security tab to track credential findings alongside other code scanning results.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Scans Git repositories and other sources for leaked credentials, classifying and validating over 800 secret types to identify active security risks.

Yes, with conditions. Install if you need to audit Git history for leaked credentials and can work around the unclear GNU license terms. The tool is actively maintained on GitHub with strong community adoption, has no runtime dependencies, and detects a broad range of secret types with validation capability. However, verify the GNU license variant's compatibility with your project before committing, and note that the PyPI package has not been updated since 2021-02-05—you may want to use the Docker image or binary releases for the latest features.

Install

trufflehog on PyPI

pip install trufflehog

uv add trufflehog

poetry add trufflehog

Installing truffleHog

Before you install

Low install friction with no runtime dependencies. Repository is active with recent commits and substantial community engagement (27463 stars), though the PyPI package itself has not received updates since 2021-02-05.

License in practice

Licensed under GNU with unclear SPDX classification. Before adopting, verify which GNU variant applies (GPL, LGPL, AGPL) and whether its copyleft terms align with your project's licensing strategy.

Quickstart

pip install trufflehog
trufflehog git https://github.com/example/repo --results=verified

Requires Git to be installed and accessible; scanning remote repositories requires network access and appropriate credentials for private repos.

Verify before relying

• Whether the PyPI package version 2.2.1 reflects current functionality or if the active GitHub repository has diverged significantly
• Specific GNU license variant and its compatibility with commercial or proprietary projects
• Current Python version support, as the package metadata does not specify minimum or maximum Python versions

Package facts

Evidence: truffleHog-2.2.1-py2.py3-none-any.whl

Tags

More Security packages

Further reading