An interactive terminal tool that scans your files for secrets with TruffleHog and helps you redact them.

Features

• One-command scanning — runs TruffleHog for you, no piping required
• Interactive TUI — curses-based selector to pick which secrets to redact
• Diff preview — review a unified diff of all changes before applying
• Safe by default — shows what will change and asks for confirmation
• Zero dependencies — only uses the Python standard library
• Custom placeholders — replace secrets with [REDACTED], asterisks, or any string

Installation

Note: Works on macOS and Linux. Windows is not currently supported (the interactive TUI depends on curses and Unix terminal features).

Requires TruffleHog to be installed and available on your PATH.

Install from PyPI:

pip install trufflehog-redactor

Or run directly without installing:

uvx trufflehog-redactor ./my-project

Or install via pipx:

pipx install trufflehog-redactor

Usage

Point trufflehog-redactor at the directory you want to scan:

trufflehog-redactor ./my-project

This will:

1. Run TruffleHog to detect secrets in the target directory
2. Open an interactive TUI to select which secrets to redact
3. Show a diff preview of the proposed changes
4. Apply the redactions after confirmation

Examples

Scan the current directory interactively:

trufflehog-redactor .

Redact all secrets without prompting:

trufflehog-redactor . --no-confirm

Preview changes without modifying files:

trufflehog-redactor . --dry-run

Use a custom placeholder:

trufflehog-redactor . --placeholder "[REDACTED]"

Pipe mode

You can also pipe TruffleHog JSON output directly if you need more control over TruffleHog flags:

trufflehog filesystem ./my-project --no-fail --no-update --json 2>/dev/null | trufflehog-redactor

This can be useful to run trufflehog via Docker, without installing it locally.

TUI Controls

Testing with example secrets

The test_keys repo from TruffleSecurity contains real-looking example secrets you can use to try out the tool end-to-end:

# Clone the test repo
git clone https://github.com/trufflesecurity/test_keys /tmp/test_keys

trufflehog-redactor /tmp/test_keys

Tip: Start with --dry-run to preview changes safely before applying any redactions.

License

MIT