KeyHog

Free plan LinuxMacSelf-hostedWindows

What KeyHog is

KeyHog is a free, open-source secret scanner for Linux, macOS, Windows, and self-hosted environments. It searches for exposed API keys, tokens, passwords, and other credentials across repositories, Git history, archives, Docker images, URLs, HAR captures, collaboration content, cloud storage inventories, and running systems. The project describes 934 service-specific detectors, along with scanning that decodes content and uses contextual evidence and suppression. Optional live verification sends credential-derived requests to provider endpoints, though verification is not available for every detector.

KeyHog offers CUDA, native Metal, and portable WGPU GPU execution, with calibration to choose a backend that has passed parity checks. Its GitHub Action scans a checked-out tree, fails on high or critical findings, uploads SARIF to Code Scanning, and keeps a workflow artifact. The project also documents CI use with GitLab, CircleCI, Jenkins, Buildkite, and shell jobs. A Unix daemon can check changed repository blobs before commit; Windows uses in-process scanning. KeyHog requires Rust 1.89 or newer. Its code and detector TOMLs are dual-licensed MIT or Apache-2.0, permitting commercial use, embedding, forks, and hosted services under either license.

Who it suits

KeyHog suits developers and security teams who need to scan code, Git history, containers, cloud inventories, or collaboration sources for exposed credentials. Its CI and pre-commit options also fit teams that want scanning in their development workflow.

What it does well

Scans across repositories, archives, containers, URLs, and cloud inventories.
934 service-specific detectors cover many credential types.
Optional live verification checks credentials against provider endpoints.
CI options include GitHub Actions and several other documented systems.
Code and detector TOMLs permit commercial use under either license.

What to know first

Requires Rust 1.89 or newer.
Plain directory scans skip native binaries unless --binary and a binary-feature build are used.
Live verification is not supported by every detector.
Verification sends credential-derived requests to provider endpoints.

Limits

A plain directory scan does not inspect native binaries; that requires --binary and a build with the binary feature. Live verification is unavailable for some detectors and sends credential-derived requests to provider endpoints.

Plans

Plan	Billed and limits	Price
KeyHog	Open-source · MIT OR Apache-2.0 · install via crates.io	Free

As github.com lists them, read 9 Oct 2026. The maker's own page has the final word.

Getting started

Open the KeyHog project website on GitHub.
Install KeyHog via crates.io.
Use it on Linux, macOS, or Windows, or self-host it.
For native binary scanning, pass --binary and use a build with the binary feature.
Connect scanning to a documented CI system or use the local guard where supported.

Verdict

Choose KeyHog if you need a free, open-source scanner with broad source coverage and CI or pre-commit options. Account for the Rust requirement and the extra binary-scan settings when scanning native binaries; live verification also sends credential-derived requests to providers.

Questions

How much does KeyHog cost?

The listed KeyHog plan is free. It is open source under MIT OR Apache-2.0.

Which platforms does it support?

Linux, macOS, and Windows are listed, as well as self-hosting.

Does it work with CI/CD and pre-commit checks?

Yes. CI/CD, pull-request scanning, push protection, custom detection rules, and pre-commit scanning are listed. The project documents GitHub Actions and use with GitLab, CircleCI, Jenkins, Buildkite, and shell jobs.

Does it scan native binaries?

A plain directory scan does not. Native binary scanning requires the --binary option and a build with the binary feature.

Does live verification check every detector?

No. The repository states that some detectors do not support verification. Verification sends credential-derived requests to provider endpoints.

Who maintains KeyHog, and how can security issues be reported?

The project is at santhreal/keyhog on GitHub. The maintainer asks users to report security issues through GitHub private vulnerability reporting or [email protected].

Facts from KeyHog's own pages

CI integration: The GitHub Action scans a checked-out tree, fails on high or critical findings, uploads SARIF to Code Scanning, and retains a workflow artifact. · github.com, 9 Oct 2026
Detection: The repository describes 934 service-specific detectors, decode-through scanning, context-aware evidence and suppression, and optional live provider verification. · github.com, 9 Oct 2026
GPU backends: KeyHog supports CUDA, native Metal, and portable WGPU execution, with calibration that routes to a parity-proven backend. · github.com, 9 Oct 2026
License: The code and detector TOMLs are dual-licensed MIT OR Apache-2.0, and the repository permits commercial use, embedding, forks, and hosted services under either license. · github.com, 9 Oct 2026
Local guard: KeyHog can run a Unix daemon to check changed repository blobs for pre-commit secret detection; on Windows the documented alternative is in-process scanning. · github.com, 9 Oct 2026
Other CI: The project documents CI use with GitLab, CircleCI, Jenkins, Buildkite, and generic shell jobs. · github.com, 9 Oct 2026
Purpose: KeyHog is an open-source Rust secret scanner that finds and verifies leaked API keys, tokens, passwords, and credentials across code, Git history, containers, cloud storage, browser assets, collaboration content, and running systems. · github.com, 9 Oct 2026
Scan limit: A plain directory scan does not inspect native binaries; users must pass `--binary` and use a build with the binary feature. · github.com, 9 Oct 2026
Scanning sources: Documented sources include repositories and Git history, archives, Docker images, URLs and HAR captures, GitHub collaboration content, GitHub/GitLab/Bitbucket inventories, and S3/GCS/Azure Blob inventories. · github.com, 9 Oct 2026
Security behavior: Endpoint fetching is bounded and SSRF-screened, while private cloud endpoints and credential forwarding require explicit trust flags. · github.com, 9 Oct 2026
Security reporting: The maintainer asks users to report security issues through GitHub private vulnerability reporting or email [email protected]. · github.com, 9 Oct 2026
System requirement: KeyHog requires Rust 1.89 or newer. · github.com, 9 Oct 2026
Telemetry: The documented performance report omits source content, credential values, raw paths, raw URLs, and raw configuration values. · github.com, 9 Oct 2026
Verification limit: Live verification sends credential-derived requests to provider endpoints, and the repository states that not every detector supports verification. · github.com, 9 Oct 2026

Where KeyHog stands on Freedom251

Secrets Scanning Software#12 of 24