Generate honeypot tokens (URLs, DNS names, email addresses, files) that alert you when accessed by an attacker.
This tool creates canary tokens: unique markers you hide in places an attacker might touch. Choose a carrier, a URL, a DNS name, an email address, or a file, and the tool generates a token with its own identifier, entirely in your browser, nothing about your setup is uploaded. When someone later fetches that URL, resolves that name, mails that address, or opens that document, you receive an alert. The surprise most people hit: generating the token is the easy part. It does nothing until deployed where an attacker can find it, and the alert only reaches you if its notification channel is configured.
At creation, each token receives an identifier different from every other token. The tool formats that identifier into the carrier you selected: a URL path, a DNS name, an email address, or a file. The carrier looks like the ordinary thing it pretends to be, so it attracts no special attention, and the embedded identifier is what makes a later hit traceable to this one token.
A token alerts when something actually touches it: an HTTP request to the URL, a DNS lookup of the name, mail delivered to the address, or a document that fetches a remote resource. The alert is then delivered through the notification channel attached to the token. A token that is never deployed, or deployed where no listener can observe it, stays silent.
Probably not, but verify before relying on it. Many readers never fetch remote content: email preview panes, PDF viewers, and sandboxed Office apps commonly block it, so nothing triggered the token. It can also mean the notification channel is misconfigured or filtered as spam. Trigger the token deliberately with a normal browser, and confirm the alert arrives, before you trust the setup.
Yes, sometimes. Tokens are designed to look unremarkable, but someone who inspects a document's internals or a URL's hostname can recognize a marker that points to a monitoring service and strip it out. That is not a failure of the design: a canary's value is the alert you get when a file is touched that you expected nobody to touch, not secrecy.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.