16.6
Canarytokens are decoy tokens placed in networks, computers, and cloud environments to alert users when someone accesses them.
Free planAndroidiOSWeb
Best Honeypot Software in 2026
Honeypot software uses decoys to draw attention to activity around systems, credentials, or other targets. Compare the options on cloud decoys, credential lures, decoy scope, and maximum decoys to see what kind of deception each supports. Deployment model and data retention add context on where an option runs and what information it keeps, while free-plan availability and paid-from pricing help with cost planning.…
26.5
OpenCanary is free, self-hosted software that acts as a network honeypot, imitating services so it can alert when someone interacts with them after…
Free planLinuxmacOSSelf-hosted
36.2
Honeytrap is a free, open-source system for running, monitoring, and managing honeypots on self-hosted Linux deployments.
Free planLinuxSelf-hosted
- 4
KFSensor
KFSensor is a self-hosted Windows honeypot that detects intrusion attempts by simulating vulnerable services and trojans.
Windows6.2From $120 a year - 5
Thinkst Canary
Thinkst Canary emulates attractive network targets and alerts when someone interacts with them, helping organizations detect intruders.
WebAPILinuxmacOS6.2From $7,500 a year - 6
Honeyd
Honeyd is a free, self-hosted daemon for creating virtual network hosts and honeypots for threat detection, assessment, simulation, and monitoring.
Free planLinuxSelf-hostedWindows6.0Free plan - 7
MedPot
MedPot is a free, open-source honeypot that emulates HL7 and FHIR services.
Free planLinuxSelf-hosted6.0Free plan - 8
T-Pot
T-Pot is a free, self-hosted honeypot platform for running more than 20 honeypots across multiple architectures.
Free planLinuxmacOSSelf-hostedWindows6.0Free plan - 9
Beelzebub
Beelzebub is a security platform that places decoys and canary credentials to help security teams spot attacker movement and investigate activity.
Free planAPILinuxSelf-hosted5.9Free plan - 10
Cowrie
Cowrie is a free, open-source SSH and Telnet honeypot for recording brute-force attempts and activity in attackers’ shell sessions.
Free planLinuxSelf-hosted5.8Free plan - 11
Dionaea
Dionaea is a self-hosted Linux honeypot designed to catch malware attempting to exploit network services, with the goal of obtaining a malware copy.
Free planLinuxSelf-hosted5.8Free plan - 12
Endlessh
Endlessh is a free, self-hosted SSH tarpit for Linux that slowly sends random banner text to keep unwanted SSH clients occupied.
Free planLinuxSelf-hosted5.8Free plan - 13
Heralding
Heralding is a free, self-hosted network honeypot for collecting credentials.
Free planLinuxSelf-hosted5.7Free plan - 14
Mailoney
Mailoney is a self-hosted SMTP honeypot that imitates a vulnerable mail server to detect and log access attempts, credential harvesting, and other SMTP attacks.
LinuxSelf-hostedWindows5.6 - 15
DentiGrid
WebAPISelf-hosted5.5 - 16
Conpot
Conpot is a free, open-source network honeypot for collecting intelligence about activity targeting industrial control systems.
LinuxSelf-hosted5.4 - 17
CounterCraft The Platform
CounterCraft The Platform uses deception technology to divert attackers from critical infrastructure and gather threat intelligence.
WebSelf-hosted5.3 - 18
ADBHoney
ADBHoney is a self-hosted, low-interaction honeypot for observing activity against Android Debug Bridge services exposed over TCP/IP.
Self-hosted5.2 - 19
TANNER
WebLinux4.7 - 20
Glutton
Linux4.4 - 21
SNARE
Linux4.4