Freedom251 › IT & Infrastructure
Free and open first
Best Honeypot Software in 2026
Honeypot software offers decoys intended to draw or detect activity, with different options for decoy scope and deployment. Compared on cloud decoys and credential lures, the entries also show deployment model, data retention and maximum decoys. These details can help you assess what an option can represent and what records it keeps. Free-plan availability and paid-from pricing are included for cost comparison. Consider the kind of decoy and deployment approach that suits your needs, then weigh tools such as Canarytokens, OpenCanary and T-Pot against those requirements.
- 21 apps
- Research read 23 Sept 2026
- How the order is worked out
- 1
Canarytokens
Free plan AndroidiPhoneSelf-hosted+2Canarytokens offers a range of decoys and alert options, with both hosted and self-hosted approaches. Check browser support and Windows setup requirements for the token types you plan to use.
- 2
Beelzebub
Free plan APILinuxSelf-hostedBeelzebub combines protocol decoys with session investigation and reporting, with deployment options for cloud, on-premises and self-hosted use.
- 3
Cowrie
Free plan LinuxSelf-hostedCowrie offers SSH and Telnet monitoring with session replay, file capture, and multiple logging integrations.
- 4
Dionaea
Free plan LinuxSelf-hostedDionaea provides a broad range of network-service honeypot protocols, logging formats, and deployment choices. Review the documented system guidance and security warning before deploying it.
- 5
Endlessh
Free plan LinuxSelf-hostedEndlessh provides a focused SSH tarpit with configurable logging and network binding options. Its default client limit and queued excess connections are worth considering when planning deployment.
- 6
Honeyd
Free plan LinuxSelf-hostedWindowsHoneyd offers extensive virtual-host and network simulation capabilities for self-hosted honeypot setups. Traffic routing requires separate configuration, and the latest listed release is dated 2007.
- 7
Conpot
Free plan LinuxSelf-hostedChoose Conpot if you need a free, self-hosted honeypot for industrial control system attack intelligence and want to customize the emulated environment.
- 8
Heralding
Free plan LinuxSelf-hostedHeralding combines credential capture with detailed session logging across many protocols.
- 9
Honeytrap
Free plan LinuxSelf-hostedHoneytrap provides flexible honeypot deployment and logging options, including centralized management for multiple agents. The lack of listed releases is worth noting before choosing it.
- 10
OpenCanary
Free plan LinuxMacSelf-hostedOpenCanary offers a range of decoy services and alert routes for self-hosted network monitoring. Review platform and module limits, and secure its root-read configuration file.
- 11
T-Pot
Free plan LinuxMacSelf-hosted+1T-Pot brings honeypots, event analysis, and monitoring tools into a self-hosted deployment. Its project warns that compromise is possible, so it should not hold sensitive data.
- 12
MedPot
Free plan LinuxSelf-hostedMedPot provides an application-level decoy for HL7 and FHIR services with configurable listening and logging options.
- 13
Mailoney
Free plan LinuxSelf-hostedWindowsChoose Mailoney if you need a self-hosted SMTP honeypot with credential capture and flexible event or database storage.
- 14
DentiGrid
Paid APISelf-hostedWebDentiGrid combines decoy-based detection with SOC alert details and several SIEM connections. Its stated limit of three decoys and 30-day retention are important to weigh for a deployment.
5.7 Visit site - 15
CounterCraft The Platform
Paid Self-hostedWebConsider CounterCraft The Platform if your organization needs deception environments across IT, OT, or hybrid infrastructure and wants threat intelligence that can feed existing security workflows.
- 16
KFSensor
Free trial WindowsKFSensor combines service emulation, event routing, reporting, and configurable alerts in a Windows honeypot.
- 17
ADBHoney
Paid Self-hostedChoose ADBHoney to observe connection, upload, and command activity against exposed ADB endpoints with a focused honeypot.
- 18
Thinkst Canary
Paid APILinuxMac+3Choose Thinkst Canary if you need network decoys, interaction alerts, and a hosted console with multiple deployment options.
5.3 Visit site - 19
Glutton
Paid Linux - 20
TANNER
Paid LinuxWeb - 21
SNARE
Paid Linux
#1Places #1, #2, #3, #4, #5 on this list can be bought by the makers of the software on it. See the price
More in IT & Infrastructure
- Identity and Access Management Software45
- Identity Governance Software28
- Identity Threat Detection and Response Software26
- Incident Response Software21
- Insider Risk Management Software26
- Internet Performance Monitoring Software30
- Intrusion Detection and Prevention Software39
- IT Asset Discovery Software26
- IT Asset Management Software112
- IT Automation Software77
- IT Capacity Management Software23
- IT Change Management Software43