Canarytokens

Canarytokens is a free, open-source tool and hosted service that lets you generate unique 'canary' tokens—decoy identifiers like URLs, files, credentials, or configs—that alert you via email when attackers access or use them, enabling early breach detection.

🚀 Overview

Canarytokens solves the critical problem of detecting data breaches and unauthorized access early, without the complexity of full honeypots or SIEM systems. By generating simple, deployable tokens (e.g., a fake AWS key or Word doc), it turns attackers into unwitting announcers when they interact with them, sending real-time alerts with details like IP, geolocation, and user agent.

It's built for security teams, penetration testers, IT administrators, developers, and even individuals who want quick, zero-cost tripwires for files, networks, cloud infra, or credentials. No steep learning curve—just generate, deploy, and monitor your inbox.

Thinkst Applied Research created it to make elite breach detection accessible to everyone, evolving from their Canary product into this free, painless service since 2020, with ongoing additions like AWS infra tokens.

✨ Key Features

Diverse Token Types: Over 30 options including web bugs (URL visits), document beacons (Word, Excel, PDF opens), credential traps (AWS keys, Kubeconfig), DNS resolutions, QR codes, Log4shell detectors, and infra explorers (AWS, Windows folders).
Real-Time Alerts: Email notifications with attacker IP, geo-location, timestamp, and device info; supports webhooks and throttling to prevent spam.
Easy Deployment: One-click generation and download/embed; self-hostable for privacy/control.
Upcoming/Experimental: New tokens like CrowdStrike API and SVG images; continuous additions based on threats.

🛠 Tech Stack

Frontend: Vue.js, HTML/CSS, TypeScript
Backend: Python, Django (Poetry-managed)
Database: PostgreSQL (Django default)
Auth: Custom (email-based alerts)
Hosting: Docker self-hosting, Terraform infra; hosted service at canarytokens.org

👥 Who Is This For?

This project is useful for:

Developers who want to secure shared docs/files or test app vulnerabilities
Teams looking for low-effort breach detection in cloud infra or networks
Indie makers and pentesters building quick traps for red teaming or personal security

📸 Screenshots / Demo

Live demo: https://canarytokens.org
GitHub: https://github.com/thinkst/canarytokens

🔥 Project Status

🟢 Actively building

Last updated: 2026-03-24

❓ FAQ

Is this project free?

Yes — Completely free hosted service and open source software.

Is the source code available?

Yes — link to repository https://github.com/thinkst/canarytokens

Can I contribute?

Yes — Check the contributing guidelines, open issues for bugs/features, submit PRs (use pre-commit hooks, follow code of conduct at https://github.com/thinkst/.github).