Canary Token

Definitions

1. A digital tripwire — a fake file, URL, or credential planted in a system that triggers an alert when accessed, indicating unauthorized activity. Named after canaries in coal mines.

   In plain English: A trap file or link planted in your system that alerts you when someone accesses it — proof that an intruder is snooping around.

2. Canary tokens are trivially easy to deploy — services like canarytokens.org generate free tokens in seconds. You can create fake AWS keys, Word documents, DNS records, or URLs. When accessed, you get an alert with the accessor's IP and timestamp.

   Example: 'I scattered canary tokens across our S3 buckets — fake credentials.csv files. If anyone opens one, I get an instant Slack alert.'

   Source: practical deployment

Related Terms

• Honeypot
• Red Team
• Blue Team
• Active Defense
• Adversary Emulation
• Modbus Security
• Remote Attestation