What Is Canarytokens? Is It Free, How to Set Up a Fake AWS Key and PDF Trap, Docker Setup and License

On canarytokens.org you choose a trap type (such as a fake AWS key, a Word or PDF document, a web link or an MCP config file), enter your alert email and leave the resulting trap somewhere no one should touch; when someone touches it, you get an email. It's a service offered by Thinkst; the documentation says it's free and will stay free, and no installation is needed. It doesn't stop an attack, it only alerts you. The interface is in English; there's no Turkish.

What it does: Creates trap files and keys, alerts you when they're touched
Free: Yes, and will stay free per the documentation
Installation: Not needed (Docker for your own server)
Alerts: Email
License: GPLv3 + special terms
Turkish: No

What Is Canarytokens For?

Canarytokens creates traps that work like a “motion sensor” for your network, computers and cloud accounts. A trap (officially called a token) is something fake that looks valuable to an attacker: a key, a document, a link. You leave it where no one should touch it; if someone touches it, you get an email. That way you notice that someone got in or that files were being rummaged through.

TrapA fake key, document or link

Where you leave itServer, code repository, shared folder

Someone touches itOpens it, uses it or visits the address

Email alertThe note you wrote on the trap comes too

Create a trap and get alerted when it's touchedWhat you get: A trap (link, file or config text)Built into the app Plant a fake AWS keyWhat you get: A fake AWS credentials fileBuilt into the app Plant a trap Word or PDF fileWhat you get: A trap .docx / .pdfBuilt into the app

Who it helps: small businesses, agencies and developers who want to know whether someone has accessed their server, code repository or shared folder without permission. It doesn't stop the attack; it only says “someone touched it”.

Traps call back to canarytokens.org. Because of this, an experienced attacker who knows the domain may recognize the trap; think of it as an extra alarm, not your only defense.

How Do You Set Up Canarytokens? Hosted and Docker

For most users there's no installation: you create traps on canarytokens.org. If you want to run it on your own server, the officially recommended route is Docker; installing without Docker isn't recommended.

Go to canarytokens.org and choose the trap type (Web bug, DNS, AWS keys, Word, PDF, MCP configuration…).
Enter the alert email address and a note (memo) describing where the trap will be placed, then create it.
Put the resulting link, key or file where you'll leave it.

Source: docs.canarytokens.org Getting Started, October 15, 2026. What the site's My Tokens page requires is not clear in the official sources.

First you need an internet-facing Docker server, at least one domain (two domains for the PDF trap) and an email provider (Mailgun, SMTP or SendGrid). You point the domain's name servers to the server's IP.

Download the repository.
Copy the config files: copy switchboard.env.dist and frontend.env.dist as switchboard.env and frontend.env, and fill in the required settings inside.
Start it with Docker Compose; the frontend opens at /generate.

Download the repository and start it

› git clone https://github.com/thinkst/canarytokens-docker
cd canarytokens-docker
docker compose up -d

Source: canarytokens-docker README, October 15, 2026. Records are kept in a Redis file (data/dump.rdb). There's a separate docker-compose-letsencrypt.yml for HTTPS.

How Do You Use Canarytokens? Fake AWS Keys, PDF, Word and MCP Traps

When the alert arrives depends on the trap type. The documentation describes them like this:

Trap	When it alerts
Web bug / link	When someone visits that address
DNS	When someone looks up that domain
AWS key	When the key is used with the AWS API (may be delayed 2–30 min)
Word	When it's opened in Microsoft Office on Windows or macOS
PDF	When it's opened in a compatible PDF reader; it only shows that it was opened and roughly where from
MCP config file	When a client connects or a tool is called (you choose)

Sample trap note (memo)"fake AWS key in /srv/app/.env on the prod server, October 15, 2026"The note appears in the email when the trap is triggered. Vague notes like “test” keep you from remembering where you put the trap when the alert arrives.

Pick an enticing file name, such as salaries.docx or passwords.docx. Place the document in a folder on the server or share, somewhere no one would normally open.

If a Word or Excel trap you downloaded doesn't alert, Windows may have put a network block on the file; check the Unblock box in the file's Properties window (official wiki FAQ).

The MCP trap imitates the mcp.json file found in AI agents' config folders. The documentation gives folders such as .claude/ or .cursor/ as examples; VS Code looks for it as .mcp.json at the workspace root.

Is Canarytokens Free? Pricing

Yes. The canarytokens.org terms of use say the service is offered for free, and the documentation says the tokens you create on canarytokens.org are free and will stay free. There's no plan or credit system, and no Turkish lira pricing.

Your own server

The software is free; the cost of the server, domain and email provider is on you. The amounts aren't given in the official sources.

Thinkst Canary

The same company's paid product is a separate product (canary.tools). Check the price on the canary.tools pricing page.

Canarytokens License, Data and Turkish Support

License

GPLv3, but the LICENSE file adds extra clarifications and exceptions. A separate commercial license is sold for embedding the technology in closed-source software. That's why GitHub shows the license as “Other”.

Data

According to the terms of use, they don't sell the information you provide; they may use third parties such as Mailgun for email and AWS for hosting. The content of a separate privacy page is not clear in the official sources.

Usage rule

You can use the service for any lawful purpose; illegal or harmful use and unauthorized interference with other people's networks are prohibited.

Turkish

The interface, documentation and alert emails are in English. Turkish support isn't mentioned.

Security record

There are 11 security advisories on GitHub; the most recent are from 2026 (low and medium, HTML/XSS in emails and pages). There are no critical or high entries. If you run your own server, keep it updated; there are no release tags on GitHub, and the latest commit is from October 9, 2026.

Frequently asked questions

What is Canarytokens and what is it for?

It creates a fake key, document or link; when someone touches it, it alerts you by email. It doesn't stop the attack, it only alerts you.

Is Canarytokens free?

Yes. The documentation says the tokens you create on canarytokens.org are free and will stay free.

Does Canarytokens require installation?

No installation is needed on canarytokens.org. To run it on your own server, you need Docker, a domain and an email provider.

How do the Canarytokens PDF and Word traps work?

A Word document sends an alert when it's opened in Microsoft Office, and a PDF when it's opened in a compatible PDF reader. The PDF only shows that it was opened and roughly where from.

Is Canarytokens open source?

Yes, the code is on GitHub; the license is GPLv3 plus special terms. A commercial license is sold for embedding it in closed-source software.

Related guides

Sources

Not clear in the official sources: A separate privacy page · whether the My Tokens page requires an account · alert channels on the hosted version (the documentation describes email; a webhook option isn't clear) · token and alert quotas on the hosted version · Thinkst Canary pricing · the steps for deleting a token or closing an account. Each is covered in the relevant section along with what you can do.