Secret scanning tools look for API keys, passwords and tokens that were committed to code, container images or chat before an attacker finds them.
This guide ranks thirteen options on setup effort, what the bill becomes at team scale, whether a leaked credential can be tested and exported, and whether you can run the tool without a commercial partner.
Vendors can pay for more visibility on this website, for example a higher place in a ranking or more room on a page. Commercial relationships can also affect which products we feature and how prominently. Every vendor link is marked the same, whatever the arrangement behind it. How that works.
In short
What secret scanning tools software does
Secret scanning software searches repositories, commit history and other stores for hardcoded credentials, then blocks the commit, raises an alert or checks whether the leaked credential still works.
In this order: setup effort, what it really costs, how your data comes back out, whether you can leave, and who each secret scanning tool is built for. One rule sits on top of those tests: places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Our how we work page explains the choice of these five and why we give no mark out of ten.
MIT-licensed command-line scanner for git repositories, files and directories
Ranked #1 of 13 in Best Secret Scanning Tools in 2026.
Open sourcePublished pricingElsewhere
Setup is light: Homebrew, a Docker image from Docker Hub or the GitHub Container Registry, a source build with make build, or a prebuilt binary. Gitleaks scans git repositories, plain files and directories, and a pre-commit hook is configured in .pre-commit-config.yaml.
The GitHub Action needs no key for personal-account repositories, while organisation-owned ones request one through a Google Form. Being feature complete, it will get patches rather than new detectors; look at Betterleaks for active development.
What stands out
MIT licence
Pre-commit hook
GitHub Action
Where it costs you
Its README declares it feature complete, so future releases are security patches only.
Organisation-owned repositories must request a licence key before they can use the GitHub Action.
Right for
Developers who want a no-cost command-line scanner with hooks and Docker images
Wrong for
Teams wanting new features or a managed dashboard
Not stated by the vendorOpen source under the MIT licence; the GitHub Action asks organisation repositories for a free licence key
Open-source credential finder that verifies leaks against the issuing service
Ranked #2 of 13 in Best Secret Scanning Tools in 2026.
Open sourceSelf-hostablePricing on requestElsewhere
The open-source edition lists GitHub, S3, directory, GCS and Docker scanning, GitHub Actions, pre-commit and pre-receive hooks, custom regex and automatic updates. Detectors, put at over 700 in the README, check each hit against the service's API.
The Enterprise plan adds more than 20 integrations, continuous monitoring, SAML 2.0 or OAuth 2.0 sign-in and role-based access control. TruffleHog Analyze and Forager are add-ons whose prices are not shown, so a budget needs a sales call.
What stands out
AGPL-3.0
Active verification
Enterprise SSO
Where it costs you
Enterprise and add-on prices are not shown, so budgeting needs a sales conversation.
The AGPL-3.0 licence needs a legal read before the code goes inside a product you ship.
Right for
Security teams wanting verified, live-credential findings from an open-source scanner
Wrong for
Buyers who need published enterprise prices up front
Not stated by the vendorOpen source under AGPL-3.0; the Enterprise plan is quoted on request and add-ons carry no listed price
Developer-secret detection with a Starter plan for up to 25 developers
Ranked #3 of 13 in Best Secret Scanning Tools in 2026.
Free tierSelf-hostablePublished pricingEurope
Starter is the entry point: no card, up to 25 developers, 10K API calls a month and 500 historical scan detections. Growth adds US and EU data hosting plus SAML 2.0 SSO with SCIM, while Business raises scanning to 12 GB and adds remediation playbooks.
Enterprise lifts the allowance to 60 GB, with unlimited teams, custom detectors, a 12-month audit log and self-hosted deployment. Endpoint Protection and NHI Governance are priced separately.
What stands out
Starter plan
US and EU hosting
Self-hosted option
Where it costs you
Paid plans show no currency or billing period, so the real price is unknown until sales replies.
Custom detectors and self-hosted deployment appear only on the Enterprise plan.
Right for
Growing engineering teams that want a no-cost start and a route to enterprise
Wrong for
Buyers who need a self-hosted tool without an enterprise contract
FranceFree Starter plan for up to 25 developers; Business, Growth and Enterprise by contact sales
MIT-licensed scanner that checks whether leaked credentials still work
Ranked #4 of 13 in Best Secret Scanning Tools in 2026.
Open sourcePricing on requestElsewhere
The homepage pitches detection and filtering that go beyond regex and entropy, with findings analysed in context to cut false positives. Named targets are git repositories, CI artifacts, trackers, datasets and logs.
It is meant to sit inside developer workflows, CI pipelines, security products and AI agents. Support for development comes from Aikido Security, which sells its own platform. With no installation steps on the page, a trial begins with finding the project documentation.
What stands out
MIT licence
Credential validity
Built for AI agents
Where it costs you
The homepage lists no installation steps or detector count, so evaluation takes extra digging.
Development is supported by Aikido Security, so its direction may follow that company's priorities.
Right for
Teams wanting a small MIT-licensed scanner that validates credentials inside CI
Wrong for
Buyers who need documented installation and a published detector list
Not stated by the vendorMIT-licensed and open source; the site shows neither plans nor prices
Rust scanner that validates live secrets and maps their blast radius
Ranked #5 of 13 in Best Secret Scanning Tools in 2026.
Open sourcePublished pricingElsewhere
Targets include local files, Git history, GitHub, GitLab, Azure Repos, S3, GCS, Azure Blob, Docker images, Slack and Jira, the longest source list among the open-source scanners here. Alerts can go to Slack, Microsoft Teams, Discord, Mattermost, Google Chat or a JSON webhook.
Output formats run from human-readable text to JSON, JSONL, SARIF, BSON and HTML. CI and pre-commit deployment are documented. Built-in rules number in the hundreds, though the README states no exact figure.
What stands out
Apache 2.0
Live validation
Blast-radius mapping
Where it costs you
Blast-radius mapping and revocation work only for supported credential types and providers.
The README gives no exact count of built-in rules, so coverage has to be tested on your own stack.
Right for
Teams wanting leak validation and response steps without buying a platform
Wrong for
Teams needing a hosted dashboard or a vendor support contract
Not stated by the vendorOpen source under Apache License 2.0, described by MongoDB as free to use
Yelp's Apache-2.0 scanner built around a pre-commit hook
Ranked #6 of 13 in Best Secret Scanning Tools in 2026.
Open sourcePricing on requestElsewhere
The recommended route is a pre-commit hook declared in .pre-commit-config.yaml, though staged or tracked files can also be piped into detect-secrets-hook. Installation uses pip or Homebrew, and a Python API lets scripts call the scanner directly.
Roughly 28 detectors ship, including AWS, GitHub, Slack and Stripe key detectors, and teams can add custom plugins and filters. The repository shows Yelp as owner but no pricing, support plans or country, so upkeep falls to the adopter.
What stands out
Apache-2.0
Pre-commit hook
Python API
Where it costs you
Only about 28 detectors ship, so unusual credential formats need custom plugins.
The page lists no hosted service or dashboard, so alerts and triage must be built around it.
Right for
Python-minded teams wanting a hook-first scanner they can extend with plugins
Wrong for
Organisations that expect vendor support or a triage interface
Not stated by the vendorOpen source under Apache-2.0; distributed without plans or prices
BSD-licensed scanner for secrets in structured text and static code
Ranked #7 of 13 in Best Secret Scanning Tools in 2026.
Open sourcePricing on requestElsewhere
Whispers reads JSON, YAML, XML and other structured text as well as static code, borrowing Semgrep's list of supported languages. Command-line filters narrow a scan by rule ID, rule group, severity, file glob or regex exclusion, and YAML configuration holds custom rules, includes and excludes.
Results print to the screen or a JSON file. Prebuilt Linux, macOS and Windows binaries, a Python module and a Docker image all exist, but only an exit-code option is documented for automation.
What stands out
BSD 3-Clause
CWE-798
YAML rules
Where it costs you
The repository sits under an individual GitHub account, with no organisation named on the page.
Only an exit-code option is documented for CI, with no named pipeline integration.
Right for
Auditors scanning configuration files and code with custom YAML rules
Wrong for
Teams wanting ready-made pre-commit or CI integrations out of the box
Not stated by the vendorOpen source under the BSD 3-Clause licence; no prices or plans shown
MIT-licensed Deepfence scanner for container images and filesystems
Ranked #8 of 13 in Best Secret Scanning Tools in 2026.
Pricing on requestElsewhere
Point it at a container image or a filesystem and it checks contents against roughly 140 secret types. Setup means building with the bootstrap script and docker build, or pulling the prebuilt image. A JSON output option exists for image scans.
The project sits in the deepfence GitHub organisation under the MIT licence. Nothing in the README covers repositories, pre-commit use or alerts, so teams will pair it with another scanner for source code.
What stands out
MIT licence
Container images
About 140 types
Where it costs you
The README describes image and filesystem scans only, leaving source repositories uncovered.
Running it mainly through Docker means every build host needs Docker available.
Right for
Platform teams auditing container images and hosts for baked-in credentials
Wrong for
Developers wanting commit-time checks on their own source code
Not stated by the vendorMIT-licensed project run through Docker; the README lists no plans
AWS Labs hooks that stop passwords reaching a git repository
Ranked #9 of 13 in Best Secret Scanning Tools in 2026.
Open sourcePricing on requestElsewhere
Enabling it in a repository installs pre-commit, commit-msg and prepare-commit-msg hooks through git secrets --install. The --register-aws option adds AWS access key IDs, Amazon Bedrock API keys and secret access keys, and can load known credentials from ~/.aws/credentials.
Secret providers added with --add-provider or --aws-provider let known secrets be matched exactly. Linux and macOS use make, Windows uses install.ps1, and Homebrew works too. Every repository needs its own opt-in, which is easy to forget at scale.
What stands out
Apache-2.0
Git hooks
AWS patterns
Where it costs you
Hooks must be installed repository by repository, so coverage depends on every developer opting in.
The built-in registration named on the page covers AWS patterns, so other providers need patterns you add.
Right for
Developers on AWS who want a simple, local commit-time guard
Wrong for
Organisations needing central rollout across many separate repositories
Not stated by the vendorOpen source under Apache-2.0; installed from source, PowerShell or Homebrew
Security platform with secrets detection included on the Developer plan
Ranked #10 of 13 in Best Secret Scanning Tools in 2026.
Free tierPublished pricingEurope
The Developer plan costs nothing, includes two users and asks for no credit card, and it names secrets detection across IDE, CI and Git, secret liveness detection and pre-commit blocking.
Basic is listed at 300 a month, Pro and Advanced at 600, each as a total for 10 users, with the currency unstated. Startups under $1.5M in funding with fewer than 10 people can get up to 30% off. Aikido Max, for unlimited AI credits, is quote only.
What stands out
Developer plan
Pre-commit blocking
Startup discount
Where it costs you
Paid-plan prices appear without a currency, so a budget cannot be fixed from the page.
Secrets detection is one capability of a wider product, so a team wanting only a scanner buys more than it needs.
Right for
Small teams wanting secrets detection plus other checks from one vendor
Wrong for
Buyers wanting a standalone scanner without a bundled platform
BelgiumFree Developer plan for two users; fixed monthly totals for tiers from 10 users; Enterprise quoted on request
Application security platform with secrets and NHI detection in one plan
Ranked #11 of 13 in Best Secret Scanning Tools in 2026.
Pricing on requestElsewhere
Plans listed are ADLC Security, Code Security, Software Supply Chain Security, Posture Management, Cycode Complete and Cycode AI, and none carries a price. Cost follows active developer count and AI usage, and only Cycode AI shows usage tiers.
Secrets & NHIs sits inside Software Supply Chain Security, so the secrets feature is bought as part of that plan. Login domains split between app.cycode.com for the US and app.eu.cycode.com for the EU. No parent company is stated.
What stands out
Secrets & NHIs
Contact sales
EU login domain
Where it costs you
No plan shows a price, so cost can only be learned by talking to sales.
Secrets detection is bundled into the Software Supply Chain Security plan rather than sold alone.
Built-in repository scanning that runs automatically on public repositories
Ranked #12 of 13 in Best Secret Scanning Tools in 2026.
Published pricingElsewhere
Default detection covers hardcoded credentials such as API keys, passwords and tokens, while generic patterns catch private keys and connection strings and organisations can add custom regular expressions.
Secret Protection is 19 USD per active committer per month; Code Security at 30 USD focuses on vulnerabilities instead, and Advanced Security is an enterprise add-on covering both with no price shown. Private repositories need GitHub Team or Enterprise Cloud first, so the plan itself is part of the real cost.
What stands out
Per-committer pricing
Custom regex
Public repos covered
Where it costs you
Per-committer pricing grows with every active contributor on private repositories.
Private and internal repositories need GitHub Team or Enterprise Cloud before Secret Protection applies.
Right for
Organisations already hosting their code on GitHub and wanting native alerts
Wrong for
Teams whose repositories live mainly outside GitHub's own hosting
Not stated by the vendorIncluded on public repositories; private organisation repositories pay a published monthly rate per active committer
Data-loss detection platform, priced per user per year by sales
Ranked #13 of 13 in Best Secret Scanning Tools in 2026.
Pricing on requestElsewhere
Foundation Edition includes data detection and response, exfiltration prevention features, a dedicated customer success manager, priority support with a 1-hour SLA and two endpoint devices per user.
Premier adds AI agent security, covering up to 3 apps in Tier 1 and all supported apps in Tier 2. Every plan carries 150 GB of data-at-rest scanning, and add-on packs run from 1 TB to 20 TB. No prices appear, and the quote depends on users and data volume.
What stands out
Per-user pricing
150 GB scanning
Proof of value
Where it costs you
Nothing on the pages names repository scanning or pre-commit blocking, so developer-secret coverage is unproven.
Prices and add-on amounts are not shown, and quotes depend on user count and data volume.
Right for
Organisations protecting data in SaaS apps and endpoints more than source code
Wrong for
Developers who need hooks, command-line scanning or open-source code
Not stated by the vendorQuoted per user per year, driven by user count and data volume; proof of value instead of self-serve trial
Secret scanning software searches repositories, commit history and other stores for hardcoded credentials, then blocks the commit, raises an alert or checks whether the leaked credential still works. The differences that matter are rarely in the feature list, so this is the order we would work through them.
01
Start with pricing transparency
Only 5 of the 13 print a price; 8 quote per organisation. Comparable without a sales call: Gitleaks, GitGuardian, Kingfisher, Aikido, GitHub Secret Scanning.
02
Ask which country the contract runs through
The 13 companies behind this list are established in 3 countries, by region Elsewhere 11, Europe 2. Disclosure obligations attach to the company, so they travel with the vendor even when the servers stay at home.
03
Consider whether you want the source
Open source here means Gitleaks, TruffleHog, Betterleaks, Kingfisher, detect-secrets, Whispers, git-secrets. The price of self-hosting is the time your team spends maintaining it.
Gitleaks, TruffleHog and Betterleaks show how open-source secret scanners age
Free scanners are the default starting point, but they differ in who keeps them alive. The Gitleaks README says the tool is feature complete, that releases will be security patches only, and that it adds that the maintainer is moving attention to Betterleaks. Betterleaks is MIT licensed, with development supported by Aikido Security, yet its homepage gives no installation steps.
TruffleHog is the other active name, released under AGPL-3.0, with an Enterprise plan behind the open-source scanner. Read each project's own statement about maintenance before standardising on it, because a hook rolled out to hundreds of repositories is expensive to swap later. Also note that Gitleaks asks organisation-owned repositories for a licence key before its GitHub Action runs, an effort cost that shows up only after the first pilot.
Read the README for a maintenance or feature-complete notice
Compare the licence: MIT, Apache-2.0, BSD or AGPL-3.0
Find out which company funds or supports development
Verified findings: TruffleHog, Kingfisher and Betterleaks go beyond pattern matching
A scanner that only matches patterns produces a pile of keys nobody can rank. TruffleHog says its detectors support active verification against the relevant service's API, Betterleaks says it checks whether an exposed credential is still valid, and Kingfisher separates active from inactive credentials, then maps blast radius and offers opt-in revocation for supported providers.
detect-secrets lists about 28 detectors and SecretScanner about 140 secret types, which tells you the size of the rule set rather than the quality of triage. Ask each candidate how it decides that a finding is worth a person's time, and test that on a repository where you already know the real leaks. Kingfisher reaches Git history, buckets, images, Slack and Jira, so verification is only useful where the scanner can actually reach your data.
Run a repository with known leaks and count live versus dead hits
Check which providers support verification or revocation
Compare rule counts against the credential types you actually use
Where the scan runs: git-secrets, detect-secrets and GitHub Secret Scanning guard different points
Commit-time and server-side scanning solve different problems. git-secrets installs pre-commit, commit-msg and prepare-commit-msg hooks, but only in repositories where each developer has run git secrets --install. detect-secrets is recommended as a pre-commit hook declared in a shared configuration file. GitHub Secret Scanning runs on the server side, automatically on public repositories, while private organisation repositories need Secret Protection per active committer on GitHub Team or Enterprise Cloud.
SecretScanner works on container images and filesystems instead of source. Map the stages where a secret can appear, from laptop to image registry, before deciding which tools you need to stack. A common gap is relying on one hook while leaving registries and shared drives unscanned, because no single scanner here covers every stage; Whispers, for instance, concentrates on structured text and static code.
List every stage where a credential can appear, laptop to image
Check whether hooks can be enforced or depend on each developer
Confirm private repositories are included at the price you were quoted
Platform or single scanner: GitGuardian, Aikido, Cycode and Nightfall bundle secrets differently
Commercial products wrap secret detection inside larger purchases, and the entry terms differ sharply. GitGuardian offers a Starter plan for up to 25 developers with 1 GB of repository scanning, then tiers sold only through sales. Aikido includes secrets detection and pre-commit blocking on its two-user Developer plan. Cycode names Secrets & NHIs inside its Software Supply Chain Security plan, with every price on request.
Nightfall prices per user per year on data volume and describes data detection rather than repository scanning. Work out which limits you will hit first, whether that is developers, gigabytes or users, and ask each vendor for the price at that size. Paid plans at Aikido and GitGuardian show no currency, so confirm it in writing before comparing totals.
Estimate developers, repository gigabytes and users before asking for quotes
Confirm secrets detection is included in the plan you are priced
Ask where custom detectors and self-hosting start
What goes wrong most often when buying secret scanning tools software
Treating a Gitleaks install as maintained software without reading its feature-complete notice and the shift towards Betterleaks.
Counting detectors and ignoring verification, so a TruffleHog or Kingfisher style live check is never compared with raw pattern hits.
Assuming GitHub Secret Scanning covers private repositories at no cost, when Secret Protection is charged per active committer.
Buying a platform such as Cycode or Nightfall for secret scanning when the plan page does not name repository scanning as a standalone feature.
07
Frequently asked questions
8 answers
What is the best secret scanning tools in 2026?
Gitleaks takes first place among the 13 we reviewed. Gitleaks is maintained by Truffle Security and installs through Homebrew, Docker images or prebuilt binaries, so a first scan of a repository takes minutes. A pre-commit hook and an official GitHub Action cover the usual workflows.
The catch is its future: the README calls it feature complete, with security patches only, and says it adds that the maintainer is moving attention to Betterleaks. Organisation repositories also need a licence key for the Action.
Which secret scanning tools publish their pricing?
5 out of 13 state a price model on their own site:
Gitleaks: Open source under the MIT licence; the GitHub Action asks organisation repositories for a free licence key.
GitGuardian: Free Starter plan for up to 25 developers; Business, Growth and Enterprise by contact sales.
Kingfisher: Open source under Apache License 2.0, described by MongoDB as free to use.
Aikido: Free Developer plan for two users; fixed monthly totals for tiers from 10 users; Enterprise quoted on request.
GitHub Secret Scanning: Included on public repositories; private organisation repositories pay a published monthly rate per active committer.
The remaining 8 sell by quote.
Is there a free secret scanning tool?
GitGuardian, Aikido offer a free tier or a free self-hosted edition.
Where are these secret scanning tool vendors established?
In 3 countries across 2 regions: Elsewhere 11, Europe 2.
Which secret scanning tools can you host yourself?
TruffleHog, GitGuardian. The other 11 are hosted by the vendor only.
What should you use instead of Gitleaks?
The next in line are TruffleHog, aimed at Security teams wanting verified, live-credential findings from an open-source scanner, and GitGuardian, aimed at Growing engineering teams that want a no-cost start and a route to enterprise.
Who should not buy Gitleaks?
Teams wanting new features or a managed dashboard. Its README declares it feature complete, so future releases are security patches only..
If your secret scanning tools product belongs among these 13, tell us what it does and who it is for. Inclusion is an editorial call; what a listing is and is not is set out under software advice.
