Truffle Security (TruffleHog)
Finds leaked credentials and checks whether they still work
Overview
Truffle Security, a San Francisco company, builds TruffleHog, a widely used AGPL-3.0 secrets scanner. TruffleHog classifies 800+ credential types and tests them against the issuing services to flag live ones across git, GitHub, GitLab, S3, Docker and more. TruffleHog Enterprise (contact sales) adds Slack, Jira and Confluence coverage and continuous monitoring.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 12 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- GitHub, S3, directory, GCS and Docker scanning
- 800+ secret detectors with verification
- GitHub Actions, pre-commit and pre-receive hooks
- Custom regex detectors
- 20+ integrations including Slack, Jira and Confluence
- On-premises or cloud scanning
- Continuous monitoring, dashboard and alerting
- SAML or OAuth SSO and role-based access
- Onboarding and priority support
Use cases
What you can produce with Truffle Security (TruffleHog)
- Scans of git history, GitHub and GitLab for 800+ credential types
- Live verification of each found credential against its issuing service
- Free CLI scans of S3, GCS, Docker, filesystems, CI systems, Postman and Hugging Face
- CI and commit gates that fail on live secrets
- Continuous Slack, Jira, Confluence, Teams and Google Drive monitoring (Enterprise)
- Analyze mapping of a leaked key to its identity and permissions
- Remediation tracking with revocation re-tests (Enterprise)
TruffleHog's edge is verification: rather than pattern-matching alone, it tests found credentials against the issuing service, so teams can focus on secrets that are actually live. The free AGPL-3.0 CLI covers git history, cloud storage, containers, CI systems and Hugging Face, and drops into CI and pre-commit hooks.
Chat and ticketing-tool scanning, continuous monitoring, revocation tracking, SSO and RBAC are Enterprise-only, and Enterprise has no public price. Verification means calling third-party APIs, which air-gapped teams must plan around.
What we found
TruffleHog is older than the company that sells it. The open-source repository dates from December 2016, while Truffle Security Co., the San Francisco company co-founded by chief executive Dylan Ayrey and chief technology officer Dustin Decker, dates its business to 2021 and now builds a commercial platform around the scanner. The open-source edition is AGPL-3.0, updated often, with version 3.99.2 out on 8 October 2026, and free.
What sets TruffleHog apart is verification. It classifies more than 800 credential types and, for most of them, tries the credential against the issuing service, so each result is labelled verified, unverified or unknown and teams can filter to secrets that are actually live. For about 20 common key types its Analyze feature goes further and reports what the key can reach. The open-source CLI scans git history, GitHub, GitLab, Docker images, S3, Google Cloud Storage, local filesystems, CircleCI, Travis CI, Postman, Jenkins, Elasticsearch and Hugging Face, and runs as a GitHub Action or a pre-commit or pre-receive hook that can fail a build on live credentials.
Scanning Slack, Jira, Confluence, Microsoft Teams, SharePoint, Google Drive and Bitbucket is an Enterprise feature, not part of the free tool, which earlier versions of this page blurred. TruffleHog Enterprise adds continuous monitoring, a dashboard, owner alerts, re-testing to confirm a key has been revoked, on-premises or cloud scanning, single sign-on and role-based access. Analyze for SaaS and cloud, and the Forager public-data monitor, are paid add-ons. No price is published.
Verification has a trade-off: the scanner has to contact third-party APIs, which air-gapped teams need to plan for. In November 2025 Truffle raised a $25 million Series B led by Intel Capital and a16z, which SecurityWeek said took total funding past $40 million. Published case studies include Klaviyo and TextNow.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
About this listing
This entry was compiled from publicly available data including Truffle Security (TruffleHog)'s official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Truffle Security (TruffleHog) unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Truffle Security (TruffleHog) directly →
Spotted something out of date? Suggest an update →
Related reading
Alternatives to Truffle Security (TruffleHog)
More in Security & Safety
