Canarytokens
- 1Runs onAndroid, iOS, self-hosted, Web, Windows
- 2CostsFree plan
- 3Deployment modelcloud
- 4Decoy scopemulti-layer
- 5Credential luresYes
- 6Cloud decoysYes
Overview
Canarytokens are decoy tokens placed in networks, computers, and cloud environments to alert users when accessed. The hosted service lets users create tokens without installing software; they can provide an email address to receive an alert when a token is triggered. Some token types also accept a webhook address. Documented examples include HTTP, DNS, Windows directory, AWS API key, Kubernetes configuration, and WireGuard tokens. The Fake IdP SAML App token has setup instructions for Microsoft Entra ID and Okta. Fake App is a Progressive Web App that alerts when opened and can include device location if location access is allowed; it currently supports Safari and Google Chrome. Sensitive Command monitors execution of a specified command on Windows and requires importing its registry file with administrator permissions. The Slack API Token is deprecated, and new tokens cannot be created, though existing ones continue to work. Use of the hosted service through canarytokens.org costs 0.00 USD per free. The maker also publishes the server as open-source software and recommends Docker for self-hosting.
Who it is for
Canarytokens suits people who want alerts when decoy credentials or other tokens are accessed in their network, computer, or cloud environment. It also offers options for Windows monitoring and self-hosting.
What is good
- Hosted token creation requires no software installation
- Email alerts are available when tokens trigger
- Some token types accept webhook addresses
- Open-source server can be self-hosted with Docker
What to know first
- Fake App supports only Safari and Google Chrome
- Sensitive Command requires Windows registry import with admin permissions
- New Slack API Tokens cannot be created
Verdict
Canarytokens describes its hosted setup, token types, alert options, and platform-specific limits. The hosted service is free, while some token workflows have browser or administrator-permission requirements.
Canarytokens plans and pricing
All plansCompared on honeypot software
- Free plan
- Yescanarytokens.org
- Deployment model
- cloudcanarytokens.org
- Decoy scope
- multi-layercanarytokens.org
- Credential lures
- Yescanarytokens.org
- Cloud decoys
- Yescanarytokens.org
Facts
- Purpose
- Canarytokens are decoy tokens placed in networks, computers, and cloud environments to alert when accessed.docs.canarytokens.org · 28 Sept 2026
- Setup
- The hosted service lets users create tokens without installing software.docs.canarytokens.org · 28 Sept 2026
- Alerts
- Users can provide an email address when creating a token and receive an email when it is triggered.docs.canarytokens.org · 28 Sept 2026
- Token types
- Documented examples include HTTP, DNS, Windows directory, AWS API key, Kubernetes configuration, and WireGuard tokens.docs.canarytokens.org · 28 Sept 2026
- Webhook alerts
- Some tokens, including Kubeconfig and Sensitive Command, accept a webhook address for alerts.docs.canarytokens.org · 28 Sept 2026
- Identity integrations
- The Fake IdP SAML App token includes setup instructions for Microsoft Entra ID and Okta.docs.canarytokens.org · 28 Sept 2026
- Phone use
- The Fake App token is a Progressive Web App that alerts when opened and can include the device location if location access is allowed.docs.canarytokens.org · 28 Sept 2026
- Browser support limit
- The Fake App token currently supports Safari and Google Chrome.docs.canarytokens.org · 28 Sept 2026
- Windows monitoring
- The Sensitive Command token monitors execution of a specified command on Windows and requires importing its registry file with admin permissions.docs.canarytokens.org · 28 Sept 2026
- Self-hosting
- The maker publishes the Canarytokens server as open-source software and recommends installing it with Docker.github.com · 28 Sept 2026
- Legacy token limit
- The Slack API Token is deprecated, and new ones can no longer be created; existing tokens continue to work.github.com · 28 Sept 2026
Company
- Headquarters
- Cape Town, South Africacanarytokens.org · 28 Sept 2026
Best Canarytokens alternatives
See all 17
Where it ranks on Specifiction
- Best Honeypot Software in 2026#3 of 18
Is Canarytokens yours?
Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.
Sources
- docs.canarytokens.org/guide/· checked 28 Sept 2026
- docs.canarytokens.org· checked 28 Sept 2026
- docs.canarytokens.org/guide/getting-started· checked 28 Sept 2026
- docs.canarytokens.org/guide/examples.html· checked 28 Sept 2026
- docs.canarytokens.org/guide/kubeconfig-token.html· checked 28 Sept 2026
- docs.canarytokens.org/guide/idp-app-token· checked 28 Sept 2026
- docs.canarytokens.org/guide/fake-app-token· checked 28 Sept 2026
- docs.canarytokens.org/guide/sensitive-cmd-token· checked 28 Sept 2026
- github.com/thinkst/canarytokens· checked 28 Sept 2026
- canarytokens.org· checked 28 Sept 2026