Free tripwires with Canarytokens

Updated 11 October 2026 · 4 min read · By Anders Karlsson

Canarytokens is a free service from the security company Thinkst. You create a fake file, link or key that looks valuable and place it where an attacker would look. When someone opens or uses it, you get an alert by email. It takes ten minutes to set out the first ones, and it costs nothing.

How it works

Each token contains a unique address that points to the Canarytokens server. When someone opens the file, clicks the link or tries to use the key, the server is contacted and you get an alert with the time, IP address and which program was used. Nobody in the company has any reason to touch a token, so an alert means someone is snooping.

The principle is the same as for a honeypot, but instead of a fake device on the network it is fake documents and credentials.

What kinds of tokens are there?

The service offers around thirty types. Some that suit a small business:

Word and Excel documents that raise an alert when opened.
PDF documents that raise an alert when opened in Adobe Acrobat Reader.
Windows folder that raises an alert when someone browses into it in File Explorer.
Web address that raises an alert when someone visits it, for example a link in an email.
Fake cloud keys, for example for Amazon Web Services, that raise an alert when someone tries to use them.
QR code that raises an alert when scanned.

Get started step by step

Go to canarytokens.org.
Choose a token type, for example a Word document.
Enter the email address the alerts should go to. You can also enter a webhook, for example to Teams, Slack or ntfy.
Write a reminder of where you are placing your token, for example "Salaries 2026.docx in the finance folder on the file server". It is shown in the alert, so you know what was touched. Do not write any sensitive information here.
Download the file or copy the key and put it in place.
Test by opening it yourself, and check that the alert arrives.

Ideas for where to put them

"Salaries 2026.xlsx" in a shared folder on the file server or in SharePoint. Anyone looking for something to steal will open it.
"Passwords.docx" among the administrator's documents. A classic, and it works.
A Windows folder named "Backup" on a file share. Attackers look for backups in order to delete them.
Fake cloud keys in an old configuration file or a code repository. Stolen keys are often tried automatically within minutes.
A web address in an email with the subject "VPN details" in an inbox. If someone takes over the email account and searches for logins, they will click the link.

Set out several of them in different places. An attacker rarely opens everything, but it is enough that they touch one.

Limitations

The computer that opens the file must be able to reach the internet. If a document is opened completely offline, or in the Office programs' Protected View, the alert may not be triggered.
The alerts go via Thinkst's servers. The reminder you write and information about whoever triggered the alert pass through their service. If you want to avoid that, you can run Canarytokens yourself, since the code is open source.
Canarytokens does not see network traffic. An attacker who scans the network or tries to log in to devices goes unnoticed. For that you need a honeypot on the network.

Canarytokens and a honeypot therefore complement each other. The tripwires catch whoever searches through files and inboxes, and the honeypot catches whoever maps the network.

Frequently Asked Questions

Does Canarytokens cost anything?

No. The service at canarytokens.org is free. Thinkst sells a commercial service with central administration, but you do not need it to get started.

Can employees trigger alerts by mistake?

Yes, if someone opens a file with a tempting name out of curiosity. So only tell those who need to know, and place your tokens where ordinary users have no reason to look.

Will the attacker notice that the file is a trap?

They may suspect it afterwards, but by then the alert has already gone off. An ordinary document with a believable name and content looks no different.

What do I do when an alert arrives?

Check the reminder to see which token was touched, find out which computer or account was used, and treat it as a possible intrusion. The steps are described in the guide to honeypots.