Overview

Canarytokens is a decoy-based alerting service for people who want to spot unexpected access across computers, networks, and cloud environments. It suits security-conscious individuals and teams who need a lightweight way to make suspicious interactions visible; its strength is the breadth of token types, while each token’s setup and behavior differs.

The hosted service lets you create tokens without installing software, then receive an email when a token is triggered. The maker also publishes an open-source server for self-hosting and recommends Docker, making that route more suitable for operators who want to manage their own deployment.

Tokens can act as credential lures or cloud decoys, among other uses. Examples include HTTP and DNS tokens, Windows directory tokens, AWS API keys, Kubernetes configurations, and WireGuard tokens. Canarytokens is made by an organization headquartered in Cape Town, South Africa. See Honeypot Software for more options in the category.

Key features

Email alerts: Add an email address when creating a token to receive an email when it is triggered. This gives individuals and small teams a direct notification path without requiring a separate alerting integration.
Webhook alerts: Some token types, including Kubeconfig and Sensitive Command, accept a webhook address. This is useful when alerts need to feed into another workflow, but it is not supported across every token.
Identity decoy: The Fake IdP SAML App includes setup instructions for Microsoft Entra ID and Okta, making it relevant to organizations that want a decoy in an identity-provider context.
Phone-oriented decoy: Fake App is a Progressive Web App that alerts when opened and can include device location if location access is allowed. Its browser support is limited to Safari and Google Chrome, so it is not a fit for users relying on other browsers.
Windows command monitoring: Sensitive Command monitors execution of a specified command on Windows. Setup requires importing its registry file with admin permissions, a meaningful constraint for users without administrative access.
Self-hosted server: The open-source server can be installed with Docker. This offers a self-managed alternative to the hosted service, but means the operator takes on deployment rather than simply creating hosted tokens.
Legacy Slack token: Slack API Tokens are deprecated and cannot be created anew. Existing tokens continue to work, but this type is not an option for new deployments.

Pricing

Canarytokens hosted service — 0.00 USD per free. Tokens deployed through canarytokens.org are free, and a free plan is available. The service does not offer a free trial because access is already free. No seat or token quota is stated, so the published price alone does not establish a usage cap.

The hosted plan is the practical starting point for users who want to deploy decoys without installing software. Those who need self-management can instead use the maker’s open-source server; it is a different deployment path, not a paid tier with additional stated allowances.

Platforms

Canarytokens is available on web, Android, iOS, and Windows, with a self-hosted option. The range reflects distinct token use cases rather than a single identical client experience: Fake App supports Safari and Chrome, while Sensitive Command monitors a specified Windows command and requires admin permission to import its registry file.

Who it's for

Canarytokens is a good fit for people and organizations that want to place decoys across several environments and get an alert when those decoys are accessed. Its mix of credential and cloud decoys, email alerts, and selected webhook support can serve both straightforward monitoring and more integrated setups.

It is less suitable if you need every token type to support webhooks, if Fake App must work in a browser other than Safari or Chrome, or if Windows command monitoring must be installed without administrator access. The hosted option favors convenience; self-hosting is better for operators prepared to manage a Docker-based deployment.

Pros and cons

Pro: Hosted token creation requires no software installation, lowering the setup burden for users who want to start with decoys.
Pro: Token examples span web, DNS, Windows, cloud credentials, Kubernetes, and WireGuard, making the service useful across more than one environment.
Pro: The free hosted service and open-source self-hosted server provide two deployment routes without a stated subscription price.
Con: Webhook alerts are limited to some token types, so notification integration depends on the decoy selected.
Con: Fake App supports only Safari and Chrome, and Sensitive Command requires Windows admin permissions.
Con: New Slack API Token deployments are unavailable because that token type is deprecated.

Alternatives

Choose Beelzebub if you want a free, self-hosted core framework for API and Linux environments; its plan includes a free trial.

OpenCanary is a free, open-source self-hosted option for Linux and macOS, while Cowrie is a free, BSD-licensed SSH and Telnet honeypot for Linux self-hosting.

Honeyd is a free, GPL-licensed distributed option with Linux, Windows, and self-hosted platforms. MedPot is a free open-source repository for Linux self-hosting that requires Go 1.17 or newer.

Heralding is a free GPL-3.0 open-source honeypot for Linux self-hosting. Honeytrap is a free Apache License 2.0 self-managed option for Linux, with no free trial.

T-Pot is a free open-source self-hosted option for Linux, macOS, and Windows; hardware and network requirements apply.

Verdict

Choose Canarytokens if you want free hosted decoys across multiple environments, with email alerts and the option to self-host the server. Look elsewhere if your use depends on broader Fake App browser support, Windows monitoring without admin access, or webhook alerts for every token type.

	Canarytokens	Endlessh
Free plan	Yes	Yes
Free trial	No	No
Paid from	Free	Free
Open source	No	No
Platforms	Android, iOS, self-hosted, Web, Windows	Linux, self-hosted
Free plan	Yes	—
Deployment model	cloud	self-hosted
Decoy scope	multi-layer	network
Credential lures	Yes	No
Cloud decoys	Yes	—

Canarytokens vs Endlessh

Canarytokens

Endlessh