Unearth your secrets

TruffleHog™ is an open-source secret scanning engine that detects and helps resolve exposed secrets across your entire tech stack.

TruffleHog enterprise

TruffleHog open-source

Trusted by dev and security TEAMS at some of the most innovative companies

Millions of leaked secrets

Millions of secrets, including API keys, passwords, and tokens, are frequently leaking from sources like source code, chat systems, support tickets, and more, underscoring the need for robust secret leak detection.

Read our research

TruffleHog digs deep

TruffleHog scans for sensitive credentials beyond the source code to include hidden content, deleted code, and version history from commonly used tools across your company.

TruffleHog enterprise

TruffleHog open-source

Secrets detection

TruffleHog sniffs out secrets everywhere: even the nooks and crannies of your GitHub comments and pull requests. TruffleHog supports the most complete list of integrations to scan across your entire SDLC.

Secrets verification

TruffleHog’s open-source engine scans 800+ credential types, directly verified with key providers for unmatched scan accuracy.

Continuous monitoring

TruffleHog continuously tracks the status of all key types to identify whether remediation has occurred. Set up alerts across the platform of your choosing and include customized messages for developers to rotate and secure keys.

Shift left

With TruffleHog, security teams can make it easier for developers to revoke leaked secrets by providing them with an automatic process.

Over 50K daily runs by developers and security teams

TruffleHog is a widely-used open-source security project with over 50,000 daily runs by developers and security teams. It has over 14 million downloads and 13,000 GitHub stars, making it a go-to tool for leading organizations across the globe.

TruffleHog enterprise

TruffleHog open-source

50K+

Daily runs

6K+

Daily installs

14M+

Downloads

13K+

GitHub stars

Gett rides with TruffleHog to automate secrets detection and remediation

"TruffleHog was the only tool we looked at that could go beyond simply detecting the secret. TruffleHog validates whether or not it was a live key or false positive and isolates where the secrets are in the code. This information is automatically pushed to the developer so they can pinpoint and address the issue."

Andy Pannell, Application Security Lead

Find out how Gett leveraged TruffleHog to identify and address leaked secrets with minimal strain on internal resources.

Read the case study

Gett rides with TruffleHog to automate secrets detection and remediation

Andy Pannell, Application Security Lead

Find out how Gett leveraged TruffleHog to identify and address leaked secrets with minimal strain on internal resources.

Read the case study