Can it find passwords as well as keys?

Yes. Enable secret mode with -s and set --min-pass, --max-pass, and --pass-complex so the scan flags passwords that meet your thresholds.

How do I keep noise down?

Raise --entropy, choose a --level matching the key length you expect, pass --exclude-files for irrelevant types, and use --bad-expressions to skip files outright.

What does --level control?

Key length bands: 0 for short keys (20-40B) such as AWS Access Key IDs, 1 (default) for typical secrets (40-70B), 2 for long material like SSH private keys, and 3 for any length in 20-1800B (noisier).

When should I use -a and --grep-words?

Set -a to run rules from rules.yaml. Add --grep-words (space-separated, wildcards allowed) when you also want literal word hits during that advanced pass.

What does -r do to the input folder?

With -r, files that contain no secret (or nothing interesting when -a is set) are removed from the analyzed tree, leaving only files that produced findings.

Updated Jul 15, 2026

Static Code Analysis

Hunt hardcoded keys and passwords across large file dumps

Analyze big volumes of data in search of hardcoded secrets like keys and passwords.

Find hardcoded keys in a data dump Tune entropy by expected key length Hunt for hardcoded passwords

overview

What dumpsterdiver does

dumpsterdiver searches large volumes of files for hardcoded secrets: AWS access keys, Azure shared keys, SSH private keys, and plain passwords. It scores strings by entropy tuned to the key length you expect, so high-randomness blobs that look like credentials surface even when no fixed pattern matches.

Beyond entropy, advanced analysis applies rules from rules.yaml, grep words narrow the hunt, and exclude lists or bad expressions skip uninteresting paths. Password mode adds length and complexity thresholds so weak noise stays out of the report.

On Trickest, dumpsterdiver is a Static Code Analysis node that takes a folder of files and writes a folder and a file of findings. Point it at a cloned repository, a data dump, or an archive to surface leaked credentials before they are abused.

source github.com/securing/dumpsterdiver

use cases

Where dumpsterdiver fits

Find hardcoded keys in a data dump

Run dumpsterdiver over a folder of files so AWS, Azure, and SSH keys hidden in source, configs, or logs surface through entropy analysis.

Tune entropy by expected key length

Set the search level for short, typical, or long keys so the scan matches the kind of secret you expect and keeps false positives down.

Hunt for hardcoded passwords

Enable secret mode and set length and complexity thresholds so the scan flags real passwords without drowning in weak matches.

Apply custom rules to large datasets

Use advanced analysis with rules.yaml to report only files meeting a condition, like a CSV containing many email addresses.

reference

dumpsterdiver inputs and flags

14 inputs

Name	Type	Flag	Description
path-to-files	FOLDER	-p	Path to the folder containing files to be analyzed.
secret	BOOLEAN	-s	Additionally analyze all files for hardcoded passwords.
advanced-analysis	BOOLEAN	-a	Analyze files using rules specified in rules.yaml.
search-level	STRING	--level	Search level for key length: 0 short, 1 typical (default), 2 long, 3 any.
enge-of-high-entropy	STRING	--entropy	Edge of high entropy (default 4.3).
grep-words	STRING	--grep-words	Grep words to look for, space-separated; requires -a.
files-to-exclude	STRING	--exclude-files	File names or extensions to skip during analysis.
remove	BOOLEAN	-r	Remove files that contain nothing interesting.

Showing key inputs. dumpsterdiver exposes 14 inputs in total.

Full flag reference (14 inputs)

Name	Type	Flag	Description
remove	BOOLEAN	-r	When this flag is set, then files which don't contain any secret (or anything interesting if -a flag is set) will be removed.
secret	BOOLEAN	-s	When this flag is set, then all files will be additionally analyzed in search of hardcoded passwords.
grep-words	STRING	--grep-words	Specifies the grep words to look for. Multiple words should be separated by space. Wildcards are supported. Requires adding -a flag to the syntax.
search-level	STRING	--level	Search level for key length. Options: --level 0 - short keys (20-40B), e.g. AWS Access Key ID. --level 1 (default) - typical keys (40-70B), e.g. AWS Secret Access Key or Azure Shared Key. --level 2 - long keys (1000-1800B), e.g. SSH private key. --level 3 - any key (20-1800B). Be careful with this setting, because it may generate lots of false positives.
path-to-files	FOLDER	-p	Path to the folder containing files to be analyzed
max-key-length	STRING	--max-key	Specifies the maximum key length to be analyzed (default is 80).
min-key-length	STRING	--min-key	Specifies the minimum key length to be analyzed (default is 20).
bad-expressions	STRING	--bad-expressions	Specifies bad expressions. If the DumpsterDiver find such expression in a file, then this file won't be analyzed. Multiple bad expressions should be separated by space.
files-to-exclude	STRING	--exclude-files	Specifies file names or extensions which shouldn't be analyzed. File extension should contain . character (e.g. .pdf). Multiple file names and extensions should be separated by space.
advanced-analysis	BOOLEAN	-a	when this flag is set, then all files will be additionally analyzed using rules specified in rules.yaml file.
max-password-length	STRING	--max-pass	Specifies the maximum password length to be analyzed (default is 12). Requires adding -s flag to the syntax.
min-password-length	STRING	--min-pass	Specifies the minimum password length to be analyzed (default is 8). Requires adding -s flag to the syntax.
password-complexity	STRING	--pass-complex	Specifies the edge of password complexity between 1 (trivial passwords) to 9 (very complex passwords) (default is 8). Requires adding -s flag to the syntax.
enge-of-high-entropy	STRING	--entropy	Specifies the edge of high entropy (default is 4.3).

example

Run dumpsterdiver

dumpsterdiver · command

# scan a folder for keys and passwords at typical key lengthdumpsterdiver -p ./data -s --level 1 --entropy 4.3 --exclude-files .pdf .png

sample output

Analyzing ./data ...[+] High entropy string (level 1)    File: ./data/config/deploy.env:14    Entropy: 4.72  Length: 40[+] High entropy string (level 1)    File: ./data/scripts/backup.sh:31    Entropy: 4.51  Length: 44[+] Password candidate (-s)    File: ./data/app/settings.py:88    Complexity: 8[*] 3 findings across 2 files

guidance

Choosing dumpsterdiver

Use DumpsterDiver to sweep large or mixed data for hardcoded secrets when you do not know the exact key format ahead of time, since entropy plus rules cast a wide net. For regex-matched API keys with exploitation hints, dora is more targeted. For Python-specific source analysis, use bandit.

dora

Regex-based API key discovery with exploitation methods. DumpsterDiver leans on entropy and custom rules for broader coverage.

bandit

Security static analysis for Python source. DumpsterDiver is language-agnostic secret hunting across raw files.

faq

dumpsterdiver questions

By entropy analysis tuned to expected key length, plus optional custom rules and grep words, so high-randomness strings that look like credentials surface even without a fixed pattern.

Run dumpsterdiver yourself

A folder of files feeds DumpsterDiver, which runs entropy and rule analysis over them and writes the discovered secrets as a queryable output.

Run dumpsterdiver in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

path-to-files

FOLDER

-p

Path to the folder containing files to be analyzed.

secret

BOOLEAN

-s

Additionally analyze all files for hardcoded passwords.

advanced-analysis

BOOLEAN

-a

Analyze files using rules specified in rules.yaml.

search-level

STRING

--level

Search level for key length: 0 short, 1 typical (default), 2 long, 3 any.

enge-of-high-entropy

STRING

--entropy

Edge of high entropy (default 4.3).

grep-words

STRING

--grep-words

Grep words to look for, space-separated; requires -a.

files-to-exclude

STRING

--exclude-files

File names or extensions to skip during analysis.

remove

BOOLEAN

-r

Remove files that contain nothing interesting.

Name

Type

Flag

Description

remove

BOOLEAN

-r

When this flag is set, then files which don't contain any secret (or anything interesting if -a flag is set) will be removed.

secret

BOOLEAN

-s

When this flag is set, then all files will be additionally analyzed in search of hardcoded passwords.

grep-words

STRING

--grep-words

Specifies the grep words to look for. Multiple words should be separated by space. Wildcards are supported. Requires adding -a flag to the syntax.

search-level

STRING

--level

Search level for key length. Options: --level 0 - short keys (20-40B), e.g. AWS Access Key ID. --level 1 (default) - typical keys (40-70B), e.g. AWS Secret Access Key or Azure Shared Key. --level 2 - long keys (1000-1800B), e.g. SSH private key. --level 3 - any key (20-1800B). Be careful with this setting, because it may generate lots of false positives.

path-to-files

FOLDER

-p

Path to the folder containing files to be analyzed

max-key-length

STRING

--max-key

Specifies the maximum key length to be analyzed (default is 80).

min-key-length

STRING

--min-key

Specifies the minimum key length to be analyzed (default is 20).

bad-expressions

STRING

--bad-expressions

Specifies bad expressions. If the DumpsterDiver find such expression in a file, then this file won't be analyzed. Multiple bad expressions should be separated by space.

files-to-exclude

STRING

--exclude-files

Specifies file names or extensions which shouldn't be analyzed. File extension should contain . character (e.g. .pdf). Multiple file names and extensions should be separated by space.

advanced-analysis

BOOLEAN

-a

when this flag is set, then all files will be additionally analyzed using rules specified in rules.yaml file.

max-password-length

STRING

--max-pass

Specifies the maximum password length to be analyzed (default is 12). Requires adding -s flag to the syntax.

min-password-length

STRING

--min-pass

Specifies the minimum password length to be analyzed (default is 8). Requires adding -s flag to the syntax.

password-complexity

STRING

--pass-complex

Specifies the edge of password complexity between 1 (trivial passwords) to 9 (very complex passwords) (default is 8). Requires adding -s flag to the syntax.

enge-of-high-entropy

STRING

--entropy

Specifies the edge of high entropy (default is 4.3).

Analyzing ./data ...[+] High entropy string (level 1) File: ./data/config/deploy.env:14 Entropy: 4.72 Length: 40[+] High entropy string (level 1) File: ./data/scripts/backup.sh:31 Entropy: 4.51 Length: 44[+] Password candidate (-s) File: ./data/app/settings.py:88 Complexity: 8[*] 3 findings across 2 files

Hunt hardcoded keys and passwords across large file dumps

What dumpsterdiver does

Where dumpsterdiver fits

Find hardcoded keys in a data dump

Tune entropy by expected key length

Hunt for hardcoded passwords

Apply custom rules to large datasets

dumpsterdiver inputs and flags

Run dumpsterdiver

Choosing dumpsterdiver

dora

bandit

dumpsterdiver questions

More Static Code Analysis tools

bandit

dawnscanner

dvcsripper-git

git-log4j

gitleaks

gosec

Run dumpsterdiver yourself

Hunt hardcoded keys and passwords across large file dumps

What dumpsterdiver does

Where dumpsterdiver fits

Find hardcoded keys in a data dump

Tune entropy by expected key length

Hunt for hardcoded passwords

Apply custom rules to large datasets

dumpsterdiver inputs and flags

Run dumpsterdiver

Choosing dumpsterdiver

dora

bandit

dumpsterdiver questions

More Static Code Analysis tools

bandit

dawnscanner

dvcsripper-git

git-log4j

gitleaks

gosec

Run dumpsterdiver yourself