Canary Tokens — Self-Hosted, Open-Source

Generates lightweight, embedded honeypot triggers called canary tokens for detecting unauthorized access.

License: BSD-3-Clause. Built with: Python, CSS, HTML, Shell, JavaScript. Website: https://canarytokens.org. Source: https://github.com/thinkst/opencanary.

Features

Mimic an array of network-accessible services for attackers to interact with.
Receive various alerts as soon as potential threats are detected, highlighting the threat source IP address and where the breach may have occurred.

Installation

$ sudo apt-get install python3-dev python3-pip python3-virtualenv python3-venv python3-scapy libssl-dev libpcap-dev $ virtualenv env/ $ . env/bin/activate $ pip install opencanary

Why self-host Canary Tokens

Self-hosting gives you three things SaaS can’t: data ownership (the files live on disks you control), cost predictability (a one-time setup vs. recurring per-seat fees that grow with your household or team), and longevity (open-source means the app keeps working even if the maintainers move on, since you can pin a working version). The trade-off is that you take on the operational work of running a server, applying updates, and handling backups.

Hardware notes

AMD64: Python 3.10+ ARM64: Python 3.10+

Where to go from here

Last verified: 2026-04-21