Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 14 November 2026.

In one sentence: A canary token is a fake file, link or password that nobody in your business has a reason to touch, set up so that you get an alert the moment someone does.

What it is

Thinkst, the company behind the free Canarytokens service, calls them “free, simple digital tripwires that notify you immediately when touched”. They come as document tokens, web links, API keys, VPN profiles, QR codes and more.

The NCSC uses the broader word “honeytokens” and groups them as tripwires: components “designed to detect a threat actor” by disclosing their unauthorised presence. Think of a motion sensor in a room nobody should be in. This entry is a companion to what-is-a-honeypot. A honeypot is a decoy system. A token is a decoy object.

How it works

1. You create a token, for example a Word document, a link, or a set of fake cloud keys.
2. You place it somewhere a legitimate user would not go but an intruder might browse. Thinkst says each token should be “placed in a single location”.
3. You name it something tempting. Thinkst’s examples include “Company Bonus Structure” and “AWS Break-glass credentials”.
4. If someone opens the file, visits the link, or uses the key, the token calls home and you receive an alert.

Some tokens are stronger than others. Thinkst says document tokens are “most reliable” where you control installed applications, internet access and file types. Credential tokens such as the AWS API key need the attacker to actually use the key, which “drastically” reduces accidental triggers. Because the AWS token points at Thinkst’s own AWS account, you do not need to use AWS yourself.

Other token types in Thinkst’s list: DNS names, PDF, Windows folders, a cloned-website check, an Office 365 mail bug, and a sensitive command token that alerts when a named program runs on a machine.

The UK angle

The NCSC sees low-interaction “digital tripwires and honeytokens to alert to unauthorised access” as a use case for “all organisations”, while honeypots suit those with mature security operations. In a blog post of 12 August 2024 the NCSC listed an objective of 2,000,000 tokens deployed, to build an evidence base. It wants to learn how well deployments find hidden compromises. Because that is still evidence gathering, treat tokens as an extra layer, not a guarantee.

Who it affects and how badly

A token does not stop an attack. It shortens the time you stay unaware of one.

• Sole trader to 10 staff: Most useful as a cheap alarm on a shared folder or password list. Worst case without it: an intruder reads client files for weeks unseen.
• 10 to 50 staff: Accountancy, legal and recruitment firms with shared drives. One token in a “HR salaries” folder can flag a compromised account.
• 50 to 250 plus: Manufacturing, fintech and councils with servers and cloud accounts. Tokens feed a SOC with a high-confidence signal. Worst case without monitoring: alerts go to an unread inbox.

Real examples

No publicly reported incident was opened for this entry, so none is claimed. The official UK source is the NCSC evidence programme linked above.

Worked example (illustration only)

A 40-person accountancy firm stores client files in SharePoint. The owner places a tokenised Word file named “Client passwords old” in an archive folder nobody uses, and a fake cloud key in a “scripts” folder. Six months later an alert shows the document was opened from an unfamiliar address. The firm checks the account, forces a password reset, and finds a stolen login. Cost: an afternoon of work. Without the token the intruder might have kept reading files until they emailed clients.

How to detect it

Tokens are the detection. To make them useful:

1. Send alerts to a shared mailbox that a named person checks.
2. Write down where each token lives and what it is called, so an alert is not a mystery.
3. Test each token yourself once, then record the date.
4. Treat every real alert as a possible compromise (an indicator of compromise): check that account’s sign-in logs in Microsoft 365 or Google Workspace.

How to fix or prevent it

Tokens warn, they do not block. Prevention comes from basics:

1. Set up multi-factor authentication on every account.
2. Remove old accounts and unused shares, so a stolen login reaches less.
3. Keep real secrets out of documents and chat (see api-key-exposure).
4. Place tokens in a few high-value spots first: a shared drive, a password-notes file, a code repository.
5. Use tokens that give no real access. Never put a working credential in a decoy.

Related terms

What is a honeypot, API key exposure, How to check open ports on your network, Indicators of compromise

Back to the Security tools and testing methods hub.

Frequently asked questions

Are canary tokens free? Thinkst describes Canarytokens as free and unlimited.

Do they replace monitoring? No. They add an alarm for snooping. The NCSC treats them as a use case within wider defence.

Can a token stop an attacker? No. It alerts you. Thinkst says each token should be placed in one location.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan or see penetration testing.