Overview

A Canarytoken is a planted decoy that alerts when someone accesses it; the point is to make unexpected interaction visible. You can create tokens through the hosted service without installing software, or run the maker’s open-source server yourself, with Docker recommended for installation.

The multi-layer scope includes credential lures and cloud decoys. Examples span HTTP and DNS tokens, Windows directory tokens, AWS API keys, Kubernetes configurations, and WireGuard tokens, giving teams options for different environments rather than one universal sensor. The maker is headquartered in Cape Town, South Africa.

For more options, see Honeypot Software.

Key features

Email alerts: Add an email address when creating a token to receive an email if it is triggered. This is a straightforward alert path for users who do not need to route notifications elsewhere.
Webhook alerts: Some tokens, including Kubeconfig and Sensitive Command, accept a webhook address. This adds a route for teams that want token alerts delivered to a webhook endpoint.
Identity decoy: The Fake IdP SAML App token includes setup instructions for Microsoft Entra ID and Okta, which makes it relevant to organizations using either identity provider.
Phone decoy: Fake App is a Progressive Web App that alerts when opened and can include device location if location access is allowed. It currently supports Safari and Google Chrome, so other browsers are not a fit for this token.
Windows command monitoring: Sensitive Command watches for execution of a specified command on Windows. It requires importing a registry file with administrator permissions, making it less suitable where users cannot make that change.
Self-hosting: The maker publishes the server as open-source software and recommends Docker installation, offering an alternative to the hosted service for teams prepared to manage their own deployment.

Pricing

The Canarytokens hosted service costs 0.00 USD per free; tokens deployed through canarytokens.org are free. There is no free trial because the hosted option is already free. No seat or token quota is stated, so the known terms do not impose a published cap. Self-hosting is also an option through the open-source server, but the hosted plan is the clearest choice for users who want to create tokens without installing software.

Platforms

The service spans web, Android, iOS, Windows, and self-hosted deployment. Platform support depends on the token: Fake App currently supports Safari and Chrome, while Sensitive Command monitors Windows and needs administrator permissions to import its registry file. The hosted service avoids local installation for token creation; self-hosting shifts deployment responsibility to the operator.

Who it's for

Canarytokens fits individuals and teams who want decoys across multiple layers and an email alert when a token is triggered, especially when they need credential or cloud lures. It is also a useful match for users who want to connect selected tokens to webhooks or set up the Fake IdP SAML App with Microsoft Entra ID or Okta.

It is less suitable when a required browser does not support Fake App, when Windows registry changes cannot be made with administrator permissions, or when a team wants a managed installation but does not want to use the hosted service.

Pros and cons

Pro: The hosted service is free and creates tokens without software installation, lowering the barrier to trying decoys.
Pro: Token examples cover web requests, DNS, Windows directories, cloud credentials, Kubernetes, and WireGuard, supporting varied decoy use cases.
Pro: Email alerts are available at token creation, and some token types also accept webhook addresses.
Con: Browser and permission requirements constrain particular workflows: Fake App is limited to Safari and Chrome, and Sensitive Command needs Windows administrator access.
Con: The Slack API Token is deprecated, and new tokens cannot be created, although existing ones continue to work.

Alternatives

Choose OpenCanary if you want free, open-source self-hosted deployment on Linux or macOS. Beelzebub is another free self-hosted option for Linux and API environments; its open-source core also has a free trial.

Honeyd is free and self-hosted for Linux or Windows. T-Pot is a free open-source self-hosted option for Linux, macOS, or Windows, with hardware and network requirements to account for.

For a free self-hosted Linux option, Cowrie is an open-source SSH and Telnet honeypot. Honeytrap is a free, self-managed option under Apache License 2.0; MedPot is a free open-source repository requiring Go 1.17 or newer; and Heralding is a free GPL-3.0 licensed Linux honeypot.

Verdict

Choose Canarytokens if you want free hosted decoys with email alerts and token types spanning credentials, cloud environments, and other layers. Its breadth and no-install hosted setup are the main reasons to choose it; look elsewhere if your chosen workflow is blocked by its browser or administrator-permission requirements, or if you need a different self-hosted honeypot.

	Canarytokens	KFSensor
Free plan	Yes	No
Free trial	No	Yes
Paid from	Free	$10/mo
Open source	No	No
Platforms	Android, iOS, self-hosted, Web, Windows	Windows
Free plan	Yes	No
Deployment model	cloud	self-hosted
Decoy scope	multi-layer	multi-layer
Credential lures	Yes	—
Cloud decoys	Yes	—

Canarytokens vs KFSensor

Canarytokens

KFSensor