Best 3 Secret Scanning Tools Compared

An API key in a commit is not deleted by deleting it. It is in the history, on every clone, and in whatever mirrors and caches saw the repository — and if the repo was public for ten minutes, assume it was scraped.

That asymmetry is why secret scanning exists at two very different points: before the commit, where the fix is deleting a line, and after it, where the fix is rotating the credential and rewriting history. The tools split along the same line, and picking one means knowing which moment you are in.

How to judge a secret scanner

Before or after the commit? A pre-commit check prevents the problem. A history scanner finds what already happened. Both are worth having and they are not substitutes.

How many patterns? Coverage ranges from dozens to many hundreds of credential formats. More patterns means more findings, including more false positives.

Does it verify? Knowing a key is present is useful. Knowing it is still live tells you whether to panic.

Where does the code go? Anything you paste into a scanner is code you are handing over — which is an odd thing to do when the concern is leaked credentials.

The comparison

Facts checked August 2026; tools change. Table covers only the 3 alternatives — our tool gets its own section below.

TruffleHog

The most thorough, and the only one that answers the question that actually matters after a leak. It detects over 800 secret types across git repositories, cloud storage, Docker images and more — and then attempts to log in with each one to confirm whether it is live, classifying findings as verified, unverified or unknown.

That verification step is the difference between a list of 200 possible secrets and a list of three that work. It is free and open source under AGPL-3.0. The breadth cuts both ways: a first run on an old repository can produce a lot to triage, and verified findings are where to start.

Gitleaks

The one to put in your pipeline. It detects passwords, API keys and tokens in git repositories, in plain directories, or from stdin, and runs three ways: as a CLI, as a pre-commit hook via .pre-commit-config.yaml, or as a GitHub Action in CI. Docker deployment is supported too.

Free and open source under the MIT licence, with a default configuration you can extend or replace with custom rules. It reports pattern matches without verifying them, which keeps it fast — and fast is the right trade for something running on every commit, where a two-minute scan would simply get disabled.

Secret Scanner

The zero-install option. Enter a GitHub username to scan all their public repositories, or a repository URL for a single project, across 45 detection categories covering API keys, tokens and passwords. Scanning happens entirely in your browser, with no code or credentials sent to their servers, and it is free and open source with no account needed — though you can supply a personal access token to reach private repositories.

For checking what is already exposed on a public repo, this is the fastest possible route. It is scoped to GitHub, so it will not help with code that has not been pushed yet.

Secret Scanner

Ours scans pasted code or config for the shapes of leaked credentials — API keys, tokens, private keys and connection strings — before you commit it. That timing is the entire design: the cheapest moment to catch a secret is while it is still only in your editor, and a paste-and-check takes seconds when you are unsure about a config file someone sent you.

What it does not do: scan git history, verify whether a key is live, or run in CI. Once something is committed, TruffleHog and Gitleaks are the right tools and ours cannot help. It also runs in your browser, which matters given the input. For repositories you own on GitHub, GitHub’s own secret scanning runs automatically on public repos and is worth enabling regardless of what else you use.

Which one to pick

• A key already committed, and you need to know if it works — TruffleHog’s verification.
• Blocking secrets in CI or pre-commit — Gitleaks.
• Auditing public GitHub repos with no install — Secret Scanner.
• A config file you are about to paste into a repo — the tool below.

How to do it with Secret Scanner

1. Open the Secret Scanner and paste the code or config you are unsure about.
2. Check the flagged shapes — a false positive costs seconds, a missed key costs a rotation.
3. Move anything real into an environment variable or a secrets manager before committing.
4. Add a pre-commit hook afterwards, so the next one is caught without you remembering.

The walkthrough is in how to catch API keys before you commit them. Other security tools are in the tools directory.

You might also need

The GitHub Actions Workflow Builder covers wiring a scanner into CI, so this stops depending on anyone remembering.

If secrets are reaching container images, the Dockerfile Builder helps keep them out of the build context in the first place.

Frequently asked questions

Is there a free secret scanner that doesn’t upload my code?

Ours runs in your browser, and Secret Scanner states scanning happens entirely in the browser too. Gitleaks and TruffleHog run locally as CLI tools, which is the strongest position of all — nothing leaves your machine because there is no server involved.

I committed an API key and deleted it. Am I safe?

No. The key remains in git history and in every clone and fork. Rotate the credential first — that is the only step that genuinely fixes it — then rewrite history if you need to, and assume anything public was scraped within minutes.

Why do scanners report things that are not secrets?

Because they match on shape. A 32-character hex string looks like an API key whether it is one or not. That is the correct trade-off — a scanner tuned to avoid false positives will miss real keys, and missing one is far more expensive than checking one.

Final thought

Rotate first, clean history second. Every minute spent rewriting commits is a minute the credential is still valid, and the rewrite does nothing about the copy someone already took.

Try the free Secret Scanner