What Is TruffleHog? Leaked Secret Scanning, Setup, Is It Free, Verification and License
You run TruffleHog against a Git repository, a folder or cloud storage, and it finds forgotten API keys, passwords and tokens. It is an open-source security tool from Truffle Security; free and AGPL-3.0 licensed, no account needed, but it requires command-line skills. Checking whether a found secret is still valid by logging in to the related service is on by default (turn it off with --no-verification). The Enterprise version is paid and its price isn't published. Only scan your own repositories or ones you have permission to scan.
- What it does
- Finds forgotten API keys and passwords in repositories
- Free
- Yes; open source, AGPL-3.0
- Enterprise
- No price (Contact us)
- No-code
- No; command line
- Verification
- Tests the key live; can be turned off
What does TruffleHog do? What is verification?
An API key, password or token accidentally committed to a Git repository is a common cause of software leaks. TruffleHog scans the repository for these secrets (other sources work too, such as a GitHub organization, the file system, S3, GCS or a Docker image).
TruffleHog tests each secret it finds by logging in to the related service to see whether it is still valid; the result is verified (valid), unverified or unknown. It is on by default, --no-verification turns it off, and --results=verified shows only verified ones. This means the found key is sent to the related service.
!A word of caution: run the tool only on repositories and accounts you own or have written permission for; verifying a key that belongs to someone else may count as unauthorized access. The official README has no separate legal notice.
Who it helps: software teams, security leads and developers who want to make sure their own repositories are clean. The number of detectors varies across pages between 700+ and 800+; no exact count is given.
How do you install TruffleHog?
› brew install trufflehog› docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keysDownload the binary for your operating system from the GitHub Releases page, or build from source with go install. The README also provides an install script. For the Windows binary name and the required Go version, see the Releases page and the README.
If scanning a GitHub organization is slow, add a personal access token with --token. If the program prints only its banner and exits, no leaks were found. For automatic checks on pull requests and commits, GitHub Actions, pre-commit and pre-receive hooks are available in the open-source version.
Is TruffleHog free? License and Enterprise
- GitHub, S3, GCS, directory, Docker scanning
- GitHub Actions, pre-commit, pre-receive
- Custom regex
- Continuous monitoring dashboard
- 20+ integrations, continuous monitoring, dashboard
- SSO, RBAC, priority support
The license has been AGPL-3.0 since v3.0 (GPL 2.0 before that); contributions require a CLA. How AGPL affects commercial use, and whether a separate commercial license exists, is not clear in the official sources; if you embed it in your product rather than using it in-house, get legal advice. The Enterprise price isn't listed, and there is no Turkish lira pricing.
Does TruffleHog send my data anywhere?
The scan runs on your own computer or in CI; no account is needed. Results stay with you.
With verification on, the found key is sent to the related service (README). If you don't want that, use --no-verification.
TruffleHog is not an AI model, so training data is not a concern. For telemetry status and privacy and KVKK (Turkey's Personal Data Protection Law) terms, check Truffle Security's official pages; scan only sources you are permitted to scan.
Frequently asked questions
What is TruffleHog and what does it do?
An open-source security tool that finds forgotten API keys, passwords and tokens in Git repositories and the cloud.
Is TruffleHog free?
Yes, the open-source version is free and AGPL-3.0 licensed. The Enterprise version is paid and its price isn't published.
Does TruffleHog verify the keys it finds?
Yes, by default: it tests the secret by logging in to the related service and reports verified, unverified or unknown. Turn it off with --no-verification.
How do you install TruffleHog?
On macOS with brew install trufflehog, with Docker using the trufflesecurity/trufflehog image, or as a binary from GitHub Releases.
Can TruffleHog be used in CI?
Yes, GitHub Actions, pre-commit and pre-receive hooks are available in the open-source version.
Is it a problem to use TruffleHog on repositories without permission?
Verifying a key means attempting to log in to someone else's service; use it only on your own sources or ones you have permission for.
Related guides
Sources
Not clear in the official sources: Enterprise price · how AGPL affects commercial use and whether a separate commercial license exists · whether telemetry is sent to Truffle Security · Turkish support · Windows binary name and required Go version · privacy and terms pages. Each is covered in its section along with what you can do.