TruffleHog
Search a git history or a directory for credentials, then check whether a classified secret can still log in.
Last updated
- Price
- Free for open source
- Free tier
- Yes
- Checks
- Secrets
- Last verified
- Oct 14, 2026
What the public pages say
TruffleHog looks for credentials in places such as Git and filesystems, then classifies what it finds. For a secret it can classify, the README says it can log in to confirm whether that secret is still live. That is a check of the credential, not a crawl of your deployed site.
Use the open-source scanner when you can run it on a machine you control. The pricing page marks that column free. Enterprise is a separate contact-us product, and this page does not invent a price for it. Since v3.0 the README says the license is AGPL 3.
Rotate anything it confirms. Deleting the file in a later commit does not remove the secret from git history.
Free tier
The pricing page labels the open-source column FREE and the Enterprise column Contact us. That page does not list a dollar price. The repository README says that since v3.0 TruffleHog is released under AGPL 3. The same README says TruffleHog classifies over 800 secret types and can log in to confirm whether a classified secret is live.
Left off the vendor's site
- A dollar price for TruffleHog Enterprise. The pricing page says Contact us and does not list one.
- Which feature rows on the pricing page belong only to the open-source column. The page was read as labels, not as a reconstructed table.
Sources
Listed on ShipSecurely
Put this on TruffleHog's site. The image links back to this page.
<a href="https://shipsecurely.dev/tools/trufflehog"><img src="https://shipsecurely.dev/badge.svg" width="196" height="32" alt="Listed on ShipSecurely"></a>
Markdown version · Canonical page: https://shipsecurely.dev/tools/trufflehog