---
id: trufflehog3
version: "3.0.10"
license: GNU
license_treatment: unclear
maintenance: aging
---

# trufflehog3 — Find secrets in your codebase

License: unclear · Maintenance: aging · Downloads: 89.6K/mo

## What it is and what it does

Trufflehog3 is a secret scanner that searches Git repositories and source code for exposed credentials, API keys, and other sensitive data. It uses pattern-based detection to identify secrets in commit history, current files, or both, and can output results in multiple formats including JSON and interactive HTML reports.

The package is built on GitPython, Jinja2, and PyYAML, allowing it to clone remote repositories, parse configuration files, and generate formatted reports. It supports custom detection rules via YAML configuration, inline exclusion comments to suppress false positives, multiprocessing for faster scans, and incremental scanning against baseline reports to track new issues only.

Use it for:

- Scan a Git repository's commit history to find accidentally committed secrets before they reach production.
- Generate an HTML report of secrets found in a codebase for security review and remediation tracking.
- Run incremental scans against a baseline to identify only new credential exposures in ongoing CI/CD pipelines.
- Exclude known false positives using inline nosecret comments or custom rule configuration.
- Scan a local directory without Git history to quickly check current source code for hardcoded credentials.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Scans Git repositories and source code for secrets, API keys, and other sensitive data using pattern matching, with support for custom rules and incremental scanning.

Yes, if you need secret detection in Git repositories and can accept the aging maintenance status. The package is stable and has no known vulnerabilities, but the last release was over a year ago and there is no recent development activity. Suitable for one-off scans or CI/CD integration where active updates are not critical; reconsider if you require ongoing security rule updates or active maintainer support.

## Install

pip install trufflehog3
uv add trufflehog3
poetry add trufflehog3

## Installing trufflehog3

Before you install: Low install friction with four common runtime dependencies (attrs, GitPython, Jinja2, PyYAML). Maintenance status is aging—last release was 2024-05-24 and the repository shows no recent activity, though it remains unarchived.

License in practice: License is marked as GNU but SPDX classification is unclear, creating ambiguity about which GPL variant applies and what obligations it imposes on derivative works or bundled distributions.

Quickstart:

pip install trufflehog3

trufflehog3 --depth 10 https://github.com/user/repo

trufflehog3 --no-history --format json --output report.json

Requires Python >=3.7; Git must be installed and accessible for repository scanning.

Verify before relying:

- Whether the unclear GNU license (raw: 'GNU', SPDX: null) is GPLv2, GPLv3, or another variant—affects compliance obligations.
- Current maintenance status and whether the aging codebase receives security updates or bug fixes.
- Whether multiprocessing support and incremental scan features work reliably in production environments.

## Package facts

- License: GNU (unclear)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 89.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

secret detection in code, find api keys in git history, credential scanner for repositories, sensitive data leak detection, git secret scanner, code secret finder, credential exposure detection, secret-scanning, git-security, credential-detection

[View on SkillFed](https://skillfed.io/packages/trufflehog3) · [View on PyPI](https://pypi.org/project/trufflehog3/)