Honeytokens (also called decoy credentials, deception tokens, or cyber tripwires) are secrets that look real and are never meant for production use. You place them in repos, CI variables, laptop credential files, wikis, and backups. Attackers who steal files or scrape .env dumps cannot tell them from live keys until they try them.
HorasEye is a cloud-native honeytoken platform. You generate tokens from a dashboard, plant them yourself, and we detect the callback or cloud API use. There is no agent on your servers and no change to your infrastructure.
How a honeytoken tripwire works
A tripwire is useful only if the right people never step on it. You bury an AWS key, a DNS hostname, or a GitHub PAT where attackers hunt and where your own automation will not. First use is the detection: IP, time, and which decoy was touched. That is the whole product idea, whether you call it a honeytoken or a tripwire.
Clone detection is the same idea for phishing: a small script on your real login page acts as a tripwire if someone copies the page onto another domain.
What you can plant
- AWS IAM honeytokens, S3 decoy buckets, and Bedrock API keys
- Azure / Entra login certificates
- Supply-chain secrets: GitHub PATs, npm, PyPI, Docker registry, and Stripe keys
- DNS callbacks and HTTP beacons
- PDF, Word, Excel, QR, and MySQL dump lures
- Clone tripwires that fire if someone copies your login page
Why teams use them
Credential theft is quiet. EDR and SIEM often miss a stolen key until it is used against a real account. A honeytoken tripwire flips that: the first use is the alert. That is why they are one of the highest-confidence detections available to small security teams.
For how this differs from running fake servers, see honeytoken vs honeypot.