TruffleHog
Find leaked credentials.
:mag_right: Now Scanning
...and more
To learn more about TruffleHog and its features and capabilities, visit our product page.
:globe_with_meridians: TruffleHog Enterprise
Are you interested in continuously monitoring Git, Jira, Slack, Confluence, Microsoft Teams, Sharepoint (and more) for credentials? We have an enterprise product that can help! Learn more at https://trufflesecurity.com/trufflehog-enterprise.
We take the revenue from the enterprise product to fund more awesome open source projects that the whole community can benefit from.
What is TruffleHog 🐽
TruffleHog is the most powerful secrets Discovery, Classification, Validation, and Analysis tool. In this context, secret refers to a credential a machine uses to authenticate itself to another machine. This includes API keys, database passwords, private encryption keys, and more.
Discovery 🔍
TruffleHog can look for secrets in many places including Git, chats, wikis, logs, API testing platforms, object stores, filesystems and more.
Classification 📁
TruffleHog classifies over 800 secret types, mapping them back to the specific identity they belong to. Is it an AWS secret? Stripe secret? Cloudflare secret? Postgres password? SSL Private key? Sometimes it's hard to tell looking at it, so TruffleHog classifies everything it finds.
Validation ✅
For every secret TruffleHog can classify, it can also log in to confirm if that secret is live or not. This step is critical to know if there’s an active present danger or not.
Analysis 🔬
For the 20 some of the most commonly leaked out credential types, instead of sending one request to check if the secret can log in, TruffleHog can send many requests to learn everything there is to know about the secret. Who created it? What resources can it access? What permissions does it have on those resources?
Have questions? Feedback? Jump into Slack or Discord and hang out with us.
Join our Slack Community
Join the Secret Scanning Discord
:tv: Demo
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --org=trufflesecurity
:floppy_disk: Installation
Several options are available for you:
MacOS users
brew install trufflehog
Docker:
Ensure Docker engine is running before executing the following commands:
Unix
docker run --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys
Windows Command Prompt
docker run --rm -it -v "%cd:/=\%:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys
Windows PowerShell
docker run --rm -it -v "${PWD}:/pwd" trufflesecurity/trufflehog github --repo https://github.com/trufflesecurity/test_keys
M1 and M2 Mac
docker run --platform linux/arm64 --rm -it -v "$PWD:/pwd" trufflesecurity/trufflehog:latest github --repo https://github.com/trufflesecurity/test_keys
Binary releases
Download and unpack from https://github.com/trufflesecurity/trufflehog/releases
Compile from source
git clone https://github.com/trufflesecurity/trufflehog.git
cd trufflehog; go install
Using installation script
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
Using installation script, verify checksum signature (requires cosign to be installed)
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -v -b /usr/local/bin
Using installation script to install a specific version
curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin <ReleaseTag like v3.56.0>
:closed_lock_with_key: Verifying the artifacts
Checksums are applied to all artifacts, and the resulting checksum file is signed using cosign.
You need the following tool to verify signature:
Verification steps are as follows:
Download the artifact files you want, and the following files from the releases page.
- trufflehog_{version}_checksums.txt
- trufflehog_{version}_checksums.txt.pem
- trufflehog_{version}_checksums.txt.sig
Verify the signature:
cosign verify-blob <path to trufflehog_{version}_checksums.txt> \
--certificate <path to trufflehog_{version}_checksums.txt.pem> \
--signature <path to trufflehog_{version}_checksums.txt.sig> \
--certificate-identity-regexp 'https://github\.com/trufflesecurity/trufflehog/\.github/workflows/.+' \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
Once the signature is confirmed as valid, you can proceed to validate that the SHA256 sums align with the downloaded artifact:
sha256sum --ignore-missing -c trufflehog_{version}_checksums.txt
Replace {version} with the downloaded files version
Alternatively, if you are using the installation script, pass -v option to perform signature verification.
This requires Cosign binary to be installed prior to running the installation script.
:rocket: Quick Start
1: Scan a repo for only verified secrets
Command:
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified
Expected output:
🐷🔑🐷 TruffleHog. Unearth your secrets. 🐷🔑🐷
Found verified result 🐷🔑
Detector Type: AWS
Decoder Type: PLAIN
Raw result: AKIAYVP4CIPPERUVIFXG
Line: 4
Commit: fbc14303ffbf8fb1c2c1914e8dda7d0121633aca
File: keys
Email: counter <[email protected]>
Repository: https://github.com/trufflesecurity/test_keys
Timestamp: 2022-06-16 10:17:40 -0700 PDT
...
2: Scan a GitHub Org for only verified secrets
trufflehog github --org=trufflesecurity --results=verified
3: Scan a GitHub Org excluding archived repositories
trufflehog github --org=trufflesecurity --exclude-archived
4: Scan a GitHub Repo for only verified secrets and get JSON output
Command:
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified --json
Expected output:
{"SourceMetadata":{"Data":{"Git":{"commit":"fbc14303ffbf8fb1c2c1914e8dda7d0121633aca","file":"keys","email":"counter \[email protected]\u003e","repository":"https://github.com/trufflesecurity/test_keys","timestamp":"2022-06-16 10:17:40 -0700 PDT","line":4}}},"SourceID":0,"SourceType":16,"SourceName":"trufflehog - git","DetectorType":2,"DetectorName":"AWS","DecoderName":"PLAIN","Verified":true,"Raw":"AKIAYVP4CIPPERUVIFXG","Redacted":"AKIAYVP4CIPPERUVIFXG","ExtraData":{"account":"595918472158","arn":"arn:aws:iam::595918472158:user/canarytokens.com@@mirux23ppyky6hx3l6vclmhnj","user_id":"AIDAYVP4CIPPJ5M54LRCY"},"StructuredData":null}
...
TruffleHog can also output SARIF with --sarif instead of --json. GitHub code scanning understands SARIF natively, so uploading it surfaces findings inline on pull request diffs and in the repository's Security tab, and tracks findings as new/fixed across scans instead of reporting the same one every run — see the TruffleHog Github Action section below for how to upload it. Note that, unlike the other output formats, SARIF results are buffered in memory for the full scan and written out at the end, since SARIF requires a single JSON document rather than a stream — fine for typical scans, but scans producing a very large number of results will use proportionally more memory.
5: Scan a GitHub Repo + its Issues and Pull Requests
trufflehog github --repo=https://github.com/trufflesecurity/test_keys --issue-comments --pr-comments
6: Scan an S3 bucket for high-confidence results (verified + unknown)
trufflehog s3 --bucket=<bucket name> --results=verified,unknown
7: Scan S3 buckets using IAM Roles
trufflehog s3 --role-arn=<iam role arn>
8: Scan a Github Repo using SSH authentication in Docker
docker run --rm -v "$HOME/.ssh:/root/.ssh:ro" trufflesecurity/trufflehog:latest git ssh://github.com/trufflesecurity/test_keys
9: Scan individual files or directories
trufflehog filesystem path/to/file1.txt path/to/file2.txt path/to/dir
10: Scan a local git repo
Clone the git repo. For example test keys repo.
git clone [email protected]:trufflesecurity/test_keys.git
Run trufflehog from the parent directory (outside the git repo).
trufflehog git file://test_keys --results=verified,unknown
To guard against malicious git configs in local scanning (see CVE-2025-41390), TruffleHog clones local git repositories to a temporary directory prior to scanning. This follows Git's security best practices. If you want to specify a custom path to clone the repository to (instead of tmp), you can use the --clone-path flag. If you'd like to skip the local cloning process and scan the repository directly (only do this for trusted repos), you can use the --trust-local-git-config flag.
11: Scan GCS buckets for only verified secrets
trufflehog gcs --project-id=<project-ID> --cloud-environment --results=verified
12: Scan a Docker image for only verified secrets
Use the --image flag multiple times to scan multiple images.
# to scan from a remote registry
trufflehog docker --image trufflesecurity/secrets --results=verified
# to scan from the local docker daemon
trufflehog docker --image docker://new_image:tag --results=verified
# to scan from an image saved as a tarball
trufflehog docker --image file://path_to_image.tar --results=verified
13: Scan in CI
Set the --since-commit flag to your default branch that people merge into (ex: "main"). Set the --branch flag to your PR's branch name (ex: "feature-1"). Depending on the CI/CD platform you use, this value can be pulled in dynamically (ex: CIRCLE_BRANCH in Circle CI and TRAVIS_PULL_REQUEST_BRANCH in Travis CI). If the repo is cloned and the target branch is already checked out during the CI/CD workflow, then --branch HEAD should be sufficient. The --fail flag will return an 183 error code if valid credentials are found.
trufflehog git file://. --since-commit main --branch feature-1 --results=verified,unknown --fail
14: Scan a Postman workspace
Use the --workspace-id, --collection-id, --environment flags multiple times to scan multiple targets.
trufflehog postman --token=<postman api token> --workspace-id=<workspace id>
15: Scan a Jenkins server
trufflehog jenkins --url https://jenkins.example.com --username admin --password admin
16: Scan an Elasticsearch server
Scan a Local Cluster
There are two ways to authenticate to a local cluster with TruffleHog: (1) username and password, (2) service token.
Connect to a local cluster with username and password
trufflehog elasticsearch --nodes 192.168.14.3 192.168.14.4 --username truffle --password hog
Connect to a local cluster with a service token
trufflehog elasticsearch --nodes 192.168.14.3 192.168.14.4 --service-token ‘AAEWVaWM...Rva2VuaSDZ’
Scan an Elastic Cloud Cluster
To scan a cluster on Elastic Cloud, you’ll need a Cloud ID and API key.
trufflehog elasticsearch \
--cloud-id 'search-prod:dXMtY2Vx...YjM1ODNlOWFiZGRlNjI0NA==' \
--api-key 'MlVtVjBZ...ZSYlduYnF1djh3NG5FQQ=='
17. Scan a GitHub Repository for Cross Fork Object References and Deleted Commits
The following command will enumerate deleted and hidden commits on a GitHub repository and then scan them for secrets. This is an alpha release feature.
trufflehog github-experimental --repo https://github.com/<USER>/<REPO>.git --object-discovery
In addition to the normal TruffleHog output, the --object-discovery flag creates two files in a new $HOME/.trufflehog directory: valid_hidden.txt and invalid.txt. These are used to track state during commit enumeration, as well as to provide users with a complete list of all hidden and deleted commits (valid_hidden.txt). If you'd like to automatically remove these files after scanning, please add the flag --delete-cached-data.
Note: Enumerating all valid commits on a repository using this method takes between 20 minutes and a few hours, depending on the size of your repository. We added a progress bar to keep you updated on how long the enumeration will take. The actual secret scanning runs extremely fast.
For more information on Cross Fork Object References, please read our blog post.
18. Scan Hugging Face
Scan a Hugging Face Model, Dataset, Space or Bucket
trufflehog huggingface \
--model <model_id> \
--dataset <dataset_id> \
--space <space_id> \
--bucket <bucket_id>
Scan all Models, Datasets, Spaces and Buckets belonging to a Hugging Face Organization or User
trufflehog huggingface --org <orgname> --user <username>
(Optionally) When scanning an organization or user, you can skip an entire class of resources with --skip-all-models, --skip-all-datasets, --skip-all-spaces, --skip-all-buckets OR a particular resource with --ignore-models <model_id>, --ignore-datasets <dataset_id>, --ignore-spaces <space_id>, --ignore-buckets <bucket_id>.
trufflehog huggingface --model <model_id> --include-discussions --include-prs
aws s3 cp s3://example/gzipped/data.gz - | gunzip -c | trufflehog stdin
:question: FAQ
- All I see is
🐷🔑🐷 TruffleHog. Unearth your secrets. 🐷🔑🐷 and the program exits, what gives?
- That means no secrets were detected
- Why is the scan taking a long time when I scan a GitHub org
- Unauthenticated GitHub scans have rate limits. To improve your rate limits, include the
--token flag with a personal access token
- It says a private key was verified, what does that mean?
- A verified result means TruffleHog confirmed the credential is valid by testing it against the service's API. For private keys, we've confirmed the key can be used live for SSH or SSL authentication. Check out our Driftwood blog post to learn more Blog post
- Is there an easy way to ignore specific secrets?
- If the scanned source supports line numbers, then you can add a
trufflehog:ignore comment on the line containing the secret to ignore that secrets.
:newspaper: What's new in v3?
TruffleHog v3 is a complete rewrite in Go with many new powerful features.
- We've added over 700 credential detectors that support active verification against their respective APIs.
- We've also added native support for scanning GitHub, GitLab, Docker, filesystems, S3, GCS, Circle CI and Travis CI.
- Instantly verify private keys against millions of github users and billions of TLS certificates using our Driftwood technology.
- Scan binaries, documents, and other file formats
- Available as a GitHub Action and a pre-commit hook
What is credential verification?
For every potential credential that is detected, we've painstakingly implemented programmatic verification against the API that we think it belongs to. Verification eliminates false positives and provides three result statuses:
- verified: Credential confirmed as valid and active by API testing
- unverified: Credential detected but not confirmed valid (may be invalid, expired, or verification disabled)
- unknown: Verification attempted but failed due to errors, such as a network or API failure
For example, the AWS credential detector performs a GetCallerIdentity API call against the AWS API to verify if an AWS credential is active.
:memo: Usage
TruffleHog has a sub-command for each source of data that you may want to scan:
- git
- github
- gitlab
- huggingface
- docker
- s3
- filesystem (files and directories)
- syslog
- circleci
- travisci
- gcs (Google Cloud Storage)
- postman
- jenkins
- elasticsearch
- stdin
- multi-scan
Each subcommand can have options that you can see with the --help flag provided to the sub command:
$ trufflehog git --help
usage: TruffleHog [<flags>] <command> [<args> ...]
TruffleHog is a tool for finding credentials.
Flags:
-h, --[no-]help Show context-sensitive help (also try --help-long and --help-man).
--log-level=0 Logging verbosity on a scale of 0 (info) to 5 (trace). Can be
disabled with "-1".
--[no-]profile Enables profiling and sets a pprof and fgprof server on :18066.
-j, --[no-]json Output in JSON format.
--[no-]json-legacy Use the pre-v3.0 JSON format. Only works with git, gitlab,
and github sources.
--[no-]github-actions Output in GitHub Actions format.
--[no-]sarif Output in SARIF format for upload to GitHub code scanning (e.g.
via github/codeql-action/upload-sarif).
--concurrency=12 Number of concurrent workers.
--[no-]no-verification Don't verify the results.
--results=RESULTS Specifies which type(s) of results to output: verified (confirmed
valid by API), unknown (verification failed due to error),
unverified (detected but not verified), filtered_unverified
(unverified but would have been filtered out). Defaults to
verified,unverified,unknown.
--[no-]no-color Disable colorized output
--[no-]allow-verification-overlap
Allow verification of similar credentials across detectors
TruffleHog is a CLI tool that discovers, classifies, validates, and analyzes leaked secrets like API keys, database passwords, and private keys across many sources (Git, GitHub, S3, Docker, Slack, filesystems, and more).