Cowrie

Linux · Self-hosted

Visit site Alternatives

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

Cowrie is ranked #5 of 18 in honeypot software on Freedom251. It runs on Linux, Self-hosted. There is a free plan.

Cowrie plans and pricing

All plans

Cowrie Free Free and open-source SSH and Telnet honeypot · BSD licensed cowrie.org · 2 Oct 2026

Compared on honeypot software

Free plan: Yes
Deployment model: self-hosted
Decoy scope: multi-layer
Credential lures: Yes

Best Cowrie alternatives

See all 12

Two bars Canarytokens Free tier No. 1Free6.6 One bar OpenCanary Free tier No. 2Free6.5 Two bars T-Pot Free tier No. 3Free6.5 One bar Beelzebub Free tier No. 4Free6.4 One bar Endlessh Free tier No. 6Free6.4 One bar Dionaea Free tier No. 7Free6.3

The record

What it does: Cowrie is a medium- to high-interaction SSH and Telnet honeypot designed to log brute-force attacks and attackers’ shell activity.
Emulated shell: Its default shell mode emulates a UNIX system in Python with a fake filesystem and does not run attackers’ commands on the real host.
Proxy mode: Proxy mode forwards SSH and Telnet sessions to another system while monitoring attacker behavior.
Session recording: Cowrie records terminal sessions with timing information for later replay using its playlog utility.
Malware capture: Cowrie saves files fetched with wget or curl and files uploaded with SFTP or SCP for later inspection.
Logging: Cowrie logs attacker activity as JSON, including logins, commands, downloads, TCP forwards and session metadata.
Integrations: Output plugins include Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, Prometheus, Datadog and Amazon S3.
LLM mode: An experimental LLM backend can generate dynamic shell responses and maintain conversation context across a session.
Deployment: Cowrie can be installed using pip, Docker or a Git checkout, and its documentation lists Python 3.11+ and python-virtualenv as local requirements.
Security boundary: The feature page says the emulated shell is safe to expose because commands run in a fake filesystem and do not touch the real host.
License and history: Cowrie is free and open source under a BSD license and began in 2014 as a fork of the Kippo honeypot.
Who maintains it: Cowrie is maintained by volunteers, and the project credits creator and maintainer Michel Oosterhof.
Intended users: The project says it is used by security researchers, CERTs and defenders around the world.
Support: The project links users to community Slack and Discord channels.
Price from: Free

Where it ranks on Freedom251

Best Honeypot Software in 2026#5 of 18

Is Cowrie yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Cowrie

Sources

docs.cowrie.org/en/stable/README.html· checked 2 Oct 2026
cowrie.org/features/· checked 2 Oct 2026
cowrie.org· checked 2 Oct 2026
cowrie.org/integrations/· checked 2 Oct 2026
cowrie.org/about/· checked 2 Oct 2026