Canarytokens

Overview

Canarytokens are decoys you place in networks, computers, or cloud environments to surface unexpected access. Rather than blocking activity, a token is meant to alert you when someone interacts with it. The hosted service at canarytokens.org lets you create tokens without installing software, while the maker also publishes an open-source server for self-hosting and recommends Docker for installation.

The service has a multi-layer decoy scope, with credential lures and cloud decoys among its uses. Documented token types range from HTTP and DNS tokens to Windows directory tokens, AWS API keys, Kubernetes configurations, and WireGuard tokens. Each represents a different kind of decoy, so setup and behavior depend on the token chosen.

Canarytokens is made by an organization headquartered in Cape Town, South Africa. Browse more options in Honeypot Software.

Key features

• Email alerts: You can add an email address when creating a token and receive an email if it is triggered.
• Webhook alerts: Some token types, including Kubeconfig and Sensitive Command, accept a webhook address for notifications.
• Identity decoy: The Fake IdP SAML App token includes setup instructions for Microsoft Entra ID and Okta.
• Phone-oriented decoy: Fake App is a Progressive Web App that alerts when opened. It can include the device location if location access is allowed. It currently supports Safari and Google Chrome.
• Windows command monitoring: Sensitive Command monitors execution of a specified command on Windows. It requires importing its registry file with administrator permissions.
• Self-hosting: The open-source server can be installed separately, with Docker recommended by the maker.
• Legacy Slack token: New Slack API Token instances can no longer be created because the token is deprecated, though existing ones continue to work.

Pricing

Canarytokens is free. The hosted service plan is listed at free, and tokens deployed through canarytokens.org are free. There is no free trial listed; the service has a free plan.

Platforms

Listed platforms are Android, iOS, self-hosted, web, and Windows. These labels do not mean every token works in every environment: for example, Fake App currently supports Safari and Chrome, while Sensitive Command is specifically for Windows and requires an administrator-level registry import.

Who it's for

Canarytokens may suit people who want to make access to selected files, credentials, endpoints, or cloud configuration decoys visible. It can be used through the hosted service without installing software, or self-hosted when an independently deployed server is preferred. The different token types make it possible to choose decoys suited to particular environments, but users should check each token's setup requirements and notification options.

Pros and cons

Pros

• The hosted service is free and does not require software installation to create tokens.
• Email alerts are available, with webhook notifications supported by some token types.
• Documented examples cover several environments, including cloud credentials, Windows, Kubernetes, and network protocols.
• An open-source server is available for self-hosting.

Cons

• Token capabilities and setup requirements vary; Sensitive Command requires an administrator-permission registry import.
• Fake App has limited browser support, currently Safari and Google Chrome, and location information depends on permission being granted.
• The deprecated Slack API Token cannot be created anew.

Alternatives

Other options in this category include OpenCanary, Beelzebub, Cowrie, Heralding, DentiGrid, Thinkst Canary, T-Pot, and Conpot.

Verdict

Canarytokens is a free decoy-token service with both hosted and self-hosted deployment paths. Its documented token range and email alerts give users several ways to make unexpected access observable, while webhook support applies only to some tokens. The main considerations are choosing token types that fit the intended environment and accounting for their specific requirements, such as browser compatibility, location permission, or Windows administrator access.