---
name: TruffleHog
slug: trufflehog
url: https://github.com/trufflesecurity/trufflehog
category: Secrets
bestFor: "Search a git history or a directory for credentials, then check whether a classified secret can still log in."
freeTier: yes
price: "Free for open source"
checks:
  - secrets
freeTierNote: "The pricing page labels the open-source column FREE and the Enterprise column Contact us. That page does not list a dollar price. The repository README says that since v3.0 TruffleHog is released under AGPL 3. The same README says TruffleHog classifies over 800 secret types and can log in to confirm whether a classified secret is live."
verifiedOn: "2026-10-14"
sources:
  - https://github.com/trufflesecurity/trufflehog
  - https://trufflesecurity.com/pricing
unknowns:
  - "A dollar price for TruffleHog Enterprise. The pricing page says Contact us and does not list one."
  - "Which feature rows on the pricing page belong only to the open-source column. The page was read as labels, not as a reconstructed table."
---

TruffleHog looks for credentials in places such as Git and filesystems, then classifies what it finds. For a secret it can classify, the README says it can log in to confirm whether that secret is still live. That is a check of the credential, not a crawl of your deployed site.

Use the open-source scanner when you can run it on a machine you control. The pricing page marks that column free. Enterprise is a separate contact-us product, and this page does not invent a price for it. Since v3.0 the README says the license is AGPL 3.

Rotate anything it confirms. Deleting the file in a later commit does not remove the secret from git history.