Overview

Instead of blocking suspicious activity, Canarytokens makes unexpected interaction visible: a decoy token placed in a network, computer, or cloud environment can alert when accessed. Its multi-layer scope includes credential lures and cloud decoys, with examples spanning HTTP and DNS, Windows directories, AWS API keys, Kubernetes configurations, and WireGuard.

The hosted service creates tokens without a software installation, while the maker also publishes an open-source server for self-hosting and recommends Docker. That choice gives technically capable teams a route to run their own deployment, but it also means self-hosting is a separate operational commitment.

Key features

Email and webhook alerts: Add an email address when creating a token to receive an alert on access. Some tokens, including Kubeconfig and Sensitive Command, also accept a webhook address, which suits workflows that route notifications beyond an inbox.
Identity decoy: The Fake IdP SAML App token includes setup instructions for Microsoft Entra ID and Okta, making it relevant to organizations using either identity provider.
Phone-oriented decoy: Fake App is a Progressive Web App that alerts when opened and can include device location if location access is allowed. Its Safari and Google Chrome support limits its usefulness on other browsers.
Windows command monitoring: Sensitive Command watches for execution of a specified command on Windows. Importing its registry file requires admin permissions, so it is better suited to managed Windows environments than casual deployment.
Deprecated Slack token: The Slack API Token can no longer be created, though existing tokens continue to work. It is not an option for a new integration.

Pricing

The hosted service is free: Canarytokens deployed through canarytokens.org cost 0.00 USD per free. There is no free trial because the hosted offering is already free, and no paid tier is described. This makes it a low-cost way to begin deploying decoys, but the published pricing does not establish any seat or token quota.

Self-hosting uses the maker's open-source server, with Docker recommended.

Platforms

Canarytokens lists Android, iOS, web, Windows, and self-hosted availability. The specific token matters more than the broad platform list: Fake App supports Safari and Chrome, while Sensitive Command monitors Windows and requires an administrator to import its registry file.

Who it's for

Canarytokens suits security-conscious individuals and teams who want access alerts from decoys across cloud, network, computer, and credential contexts, particularly if email notifications and a free hosted deployment meet their needs. Organizations using Microsoft Entra ID or Okta may also find the Fake IdP SAML App token relevant.

It is a weaker fit for anyone expecting every token to work across the same browsers or systems, or for a new Slack API token integration. Windows command monitoring also calls for admin access, and self-hosting requires operating the published server.

Pros and cons

Pros: Free hosted deployment lowers the barrier to trying decoys; token examples cover several environments, including cloud credentials and Kubernetes; email and selected webhook alerts give more than one notification path; self-hosting is possible with an open-source server.
Cons: Browser support for Fake App is limited to Safari and Chrome; Sensitive Command requires Windows admin permissions; Slack API tokens are deprecated and cannot be newly created; self-hosted use requires running the server.

Alternatives

For more choices, browse Honeypot Software.

OpenCanary is a free, open-source self-hosted option for Linux and macOS; choose it if you want a honeypot deployment on those platforms rather than Canarytokens' hosted service.
Beelzebub offers a free core framework for self-hosted Linux and API use, with a free trial; it may suit readers looking for that framework format.
Cowrie is a free, BSD-licensed open-source SSH and Telnet honeypot for Linux self-hosting; choose it for that protocol-specific focus.
Endlessh is a free Linux self-hosted SSH tarpit, a standalone C program with a default maximum of 4096 clients; choose it for that narrower SSH tarpit role.
Dionaea is a free, GPLv2+ open-source Linux honeypot; consider it if that self-hosted option fits your deployment.
Heralding is a free, GPL-3.0 licensed open-source honeypot for Linux self-hosting; choose it if that platform and licensing description fit your needs.
T-Pot is a free, open-source self-hosted option for Linux, macOS, and Windows, with hardware and network requirements; consider it if those platform choices suit your environment.
Conpot is a free Linux self-hosted alternative.

Verdict

Choose Canarytokens if you want a free hosted way to deploy varied decoys and receive access alerts without first installing a service. Its breadth and self-hosting option are useful strengths, but browser and Windows requirements vary by token, and deprecated Slack API tokens rule it out for new Slack-token setups.

	Canarytokens	Endlessh
Free plan	Yes	Yes
Free trial	No	No
Paid from	Free	Free
Open source	No	No
Platforms	Android, iOS, self-hosted, Web, Windows	Linux, self-hosted
Free plan	Yes	—
Deployment model	cloud	self-hosted
Decoy scope	multi-layer	network
Credential lures	Yes	No
Cloud decoys	Yes	—

Canarytokens vs Endlessh

Canarytokens

Endlessh