Canarytokens

Canarytokens are decoys placed in networks, computers, or cloud environments to alert users when they are accessed. The hosted service lets users create tokens without installing software, and an email address can be provided to receive an alert when a token is triggered. Some token types can also send alerts to a supplied webhook address. Documented examples include HTTP, DNS, Windows directory, AWS API key, Kubernetes configuration, and WireGuard tokens. The Fake IdP SAML App token includes setup instructions for Microsoft Entra ID and Okta. The Fake App token is a Progressive Web App that alerts when opened and may include device location if location access is allowed; it supports Safari and Google Chrome. On Windows, Sensitive Command watches for execution of a specified command and requires importing its registry file with admin permissions. The hosted service is free. The maker also publishes the server as open-source software and recommends Docker for self-hosting.

Canarytokens offers a free hosted way to create decoys and receive access alerts, with multiple token types and alert options. Consider the browser and Windows requirements for specific tokens, and note that the Slack API Token is deprecated.

Canarytokens suits people who want alerts when decoy tokens in systems or cloud environments are accessed. Its hosted setup needs no software installation, while self-hosting is an option for users prepared to install the server with Docker.

Canarytokens gives defenders a way to plant decoys across different systems and receive alerts when someone accesses them. It is a strong fit for people who want lightweight access detection without installing software for hosted use, though token-specific setup requirements make it less uniform than a single monitoring agent.

Overview

Instead of blocking suspicious activity, Canarytokens makes unexpected interaction visible: a decoy token placed in a network, computer, or cloud environment can alert when accessed. Its multi-layer scope includes credential lures and cloud decoys, with examples spanning HTTP and DNS, Windows directories, AWS API keys, Kubernetes configurations, and WireGuard.

The hosted service creates tokens without a software installation, while the maker also publishes an open-source server for self-hosting and recommends Docker. That choice gives technically capable teams a route to run their own deployment, but it also means self-hosting is a separate operational commitment.

Key features

• Email and webhook alerts: Add an email address when creating a token to receive an alert on access. Some tokens, including Kubeconfig and Sensitive Command, also accept a webhook address, which suits workflows that route notifications beyond an inbox.
• Identity decoy: The Fake IdP SAML App token includes setup instructions for Microsoft Entra ID and Okta, making it relevant to organizations using either identity provider.
• Phone-oriented decoy: Fake App is a Progressive Web App that alerts when opened and can include device location if location access is allowed. Its Safari and Google Chrome support limits its usefulness on other browsers.
• Windows command monitoring: Sensitive Command watches for execution of a specified command on Windows. Importing its registry file requires admin permissions, so it is better suited to managed Windows environments than casual deployment.
• Deprecated Slack token: The Slack API Token can no longer be created, though existing tokens continue to work. It is not an option for a new integration.

Pricing

The hosted service is free: Canarytokens deployed through canarytokens.org cost nothing. There is no free trial because the hosted offering is already free, and no paid tier is described. This makes it a low-cost way to begin deploying decoys, but the published pricing does not establish any seat or token quota.

Self-hosting uses the maker's open-source server, with Docker recommended.

Platforms

Canarytokens lists Android, iOS, web, Windows, and self-hosted availability. The specific token matters more than the broad platform list: Fake App supports Safari and Chrome, while Sensitive Command monitors Windows and requires an administrator to import its registry file.

Who it's for

Canarytokens suits security-conscious individuals and teams who want access alerts from decoys across cloud, network, computer, and credential contexts, particularly if email notifications and a free hosted deployment meet their needs. Organizations using Microsoft Entra ID or Okta may also find the Fake IdP SAML App token relevant.

It is a weaker fit for anyone expecting every token to work across the same browsers or systems, or for a new Slack API token integration. Windows command monitoring also calls for admin access, and self-hosting requires operating the published server.

Pros and cons

• Pros: Free hosted deployment lowers the barrier to trying decoys; token examples cover several environments, including cloud credentials and Kubernetes; email and selected webhook alerts give more than one notification path; self-hosting is possible with an open-source server.
• Cons: Browser support for Fake App is limited to Safari and Chrome; Sensitive Command requires Windows admin permissions; Slack API tokens are deprecated and cannot be newly created; self-hosted use requires running the server.

Alternatives

For more choices, browse Honeypot Software.

• OpenCanary is a free, open-source self-hosted option for Linux and macOS; choose it if you want a honeypot deployment on those platforms rather than Canarytokens' hosted service.
• Beelzebub offers a free core framework for self-hosted Linux and API use, with a free trial; it may suit readers looking for that framework format.
• Cowrie is a free, BSD-licensed open-source SSH and Telnet honeypot for Linux self-hosting; choose it for that protocol-specific focus.
• Endlessh is a free Linux self-hosted SSH tarpit, a standalone C program with a default maximum of 4096 clients; choose it for that narrower SSH tarpit role.
• Dionaea is a free, GPLv2+ open-source Linux honeypot; consider it if that self-hosted option fits your deployment.
• Heralding is a free, GPL-3.0 licensed open-source honeypot for Linux self-hosting; choose it if that platform and licensing description fit your needs.
• T-Pot is a free, open-source self-hosted option for Linux, macOS, and Windows, with hardware and network requirements; consider it if those platform choices suit your environment.
• Conpot is a free Linux self-hosted alternative.

Verdict

Choose Canarytokens if you want a free hosted way to deploy varied decoys and receive access alerts without first installing a service. Its breadth and self-hosting option are useful strengths, but browser and Windows requirements vary by token, and deprecated Slack API tokens rule it out for new Slack-token setups.