Thinkst Canary vs Canarytokens.org vs Self-Hosted AWS Canary Keys

1. The options

canarytokens.org (free, by Thinkst)

A free service with over thirty token types: documents, DNS names, URLs, database dumps, kubeconfig files, and an AWS API key. You fill in an email address or webhook, get a key pair, and are alerted if it's ever used through the AWS API. The key belongs to an AWS account Thinkst runs, so the detection is theirs, not yours.

In September 2025 Thinkst added an AWS Infrastructure Canarytoken, which helps you deploy decoy resources in your AWS account, also free and without signing up. That's a different thing from the AWS key token: decoy resources to be discovered, not a credential to be stolen.

Thinkst Canary (paid)

Thinkst Canary is the commercial product: hardware, virtual and cloud Canaries (decoy machines and services) plus Canarytokens, managed from a private console. For AWS keys, the paid console lets you choose the key's user name, which the free service doesn't (per Thinkst's launch post). Cloud Canaries can be enabled on multiple AWS accounts through Thinkst support. We couldn't verify a published price; ask Thinkst.

Self-hosted, in your own AWS account

An IAM user in an account you choose, denied every action, with one access key, and alerts through your own CloudTrail, EventBridge and SNS. You own every part, including the account ID an attacker will see. The canary credentials guide builds one step by step, and the free terraform-aws-honeytoken module packages it, with alerting in every enabled region.

There's a middle path too: the canarytokens server itself is open source (GPLv3 with Thinkst's clarifications), and Thinkst publishes a Docker setup to run your own. Check the project's documentation for what its AWS key tokens need when self-hosted.

Other services

• Tracebit deploys canaries across cloud environments. Its free Community Edition includes a limited number of canary credentials for individual projects and small teams; cloud infrastructure canaries are in the paid plans.
• GitGuardian Honeytoken issues real AWS keys aimed at detecting code leakage, inside GitGuardian's secrets platform. GitGuardian also publishes ggcanary, an open-source (MIT) Terraform project for AWS canary tokens in your own account.

2. The fingerprinting question

This is the difference that matters most and is discussed least. An AWS access key ID isn't random: for most keys, the AWS account ID can be decoded from the key ID itself, offline (Aidan Steele, 2020; older keys with certain prefixes don't decode). The sts:GetAccessKeyInfo API returns it too, and according to Hacking the Cloud that call is logged only in the caller's account, not the key owner's.

So anyone holding a key can learn which account owns it without touching your logs. If that account belongs to a well-known canary service, the key is recognisable. In February 2024 TruffleHog announced that it identifies canarytokens.org AWS keys "completely statically without setting them off", by decoding the account ID and matching it against a list. It also said it is deliberately not including the account IDs of Thinkst's paid offerings.

What that means in practice:

• canarytokens.org AWS keys can be spotted by anyone running TruffleHog. They still catch the careless attacker, and many are careless, but not one who checks.
• Thinkst Canary's paid tokens aren't fingerprinted by TruffleHog by choice, not because it's impossible.
• A self-hosted key shows your own account ID, the same one the attacker sees in every ARN in your environment. With a believable user name, it blends in. The cost is a deny-all IAM user to explain to auditors, or a dedicated decoy account whose ID matches nothing else they've found.

3. Alert latency

Every AWS key honeytoken is detected from CloudTrail, so every option inherits CloudTrail's delay. Thinkst documents a delay of between 2 and 30 minutes for canarytokens.org AWS key alerts. AWS says CloudTrail typically delivers logs within an average of about 5 minutes, without a guarantee, and one vendor's measurement found S3 delivery averaging around 2.5 minutes. AWS publishes no figure for the EventBridge path a self-hosted key usually alerts through, so test-fire yours and time it against the event's eventTime.

A self-hosted setup has one trap the services handle for you: an EventBridge rule only matches read-only calls such as GetCallerIdentity, usually the attacker's first, if its state is ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS, and rules are regional.

4. Comparison table

5. How to choose

Pick canarytokens.org if you have no honeytokens today. Make one now, put it somewhere an attacker would look, and test it. A recognisable token still catches most intruders, and it costs nothing.

Pick Thinkst Canary if you want deception across the estate (networks, endpoints, cloud) with a vendor who runs it, or Tracebit if your estate is mostly cloud, and the budget for that. The paid service's AWS tokens also avoid the TruffleHog list.

Self-host if the key needs to look like it belongs to your environment, you want the alert wired straight into an automated response, or you have many accounts to cover with code. Budget for keeping region coverage and alert routing working, and for testing them on a schedule.

These aren't exclusive. A common progression: a free token today, a self-hosted key in the two or three places that matter most this week, and a product once you want coverage you don't have time to build. Honeytokens vs GuardDuty explains what any of them adds to AWS's own detection.

6. Other tools, and ones to avoid

• SpaceCrab, Atlassian's 2017 AWS honeytoken tool, is gone: its repository returns a 404.
• SpaceSiren (GPL-3.0) still exists on GitHub but hasn't been updated since 2021.
• ggcanary (GitGuardian, MIT) is an open-source Terraform option from a security vendor, last updated in June 2025; see above.

Whatever you pick, check when it was last maintained. A honeytoken system that silently stopped alerting is worse than none, because you believe you're covered.

7. Where Compass fits

Disclosure: we make it. Compass is our open-source tool for the self-hosted path at scale. It maps your AWS account, suggests where honeytokens would look real, plants them as pull requests to your infrastructure repository, and, when one is used, responds within a risk policy you set (for example by deactivating the key or restarting the ECS task it was taken from). Today the IAM key decoy is the one that works end to end. If you only need the key and the alert, the Terraform module is enough.