Side by side
Canarytokens vs Endlessh
Both stand on honeypot software. Which one you can start free with, which one lets you read the code, and what each costs once you pay.
Free plan AndroidiPhoneSelf-hosted+2
Canarytokens offers a range of decoys and alert options, with both hosted and self-hosted approaches. Check browser support and Windows setup requirements for the token types you plan to use.
Visit Canarytokens Free plan LinuxSelf-hosted
Endlessh provides a focused SSH tarpit with configurable logging and network binding options. Its default client limit and queued excess connections are worth considering when planning deployment.
Visit EndlesshThe facts
| Canarytokens | Endlessh | |
|---|---|---|
| Free plan | Yes | Yes |
| Open source | Not published | Not published |
| Runs on | Android, iPhone, Self-hosted, Web, Windows | Linux, Self-hosted |
| Lowest paid plan | Free or on request | Free or on request |
| Plans published | 1 | 1 |
| Maker | Not published | Not published |
| Website | canarytokens.org | github.com |
| On honeypot software | #1 of 21 | #5 of 21 |
Canarytokens: what it does well
- Hosted token creation requires no software installation.
- Email alerts are available when tokens are triggered.
- Some token types support webhook alerts.
- Documented decoys cover network, cloud, and Windows examples.
- Hosted service is free.
What to know first
- Fake App supports only Safari and Google Chrome.
- Sensitive Command requires admin permission to import its registry file.
- New Slack API Tokens cannot be created.
Endlessh: what it does well
- Free and identified as open source.
- Supports IPv4 and IPv6.
- Allows up to 4096 clients by default.
- Can send logs to syslog.
- Configuration can be reloaded with SIGHUP.
What to know first
- Linux and self-hosted platforms are listed.
- Excess connections wait in the queue.
- Maximum banner line length defaults to 32 characters.
Alternatives to Canarytokens Alternatives to Endlessh The whole list