# What is a Honeytoken?

> A honeytoken is a deliberately fabricated data item, identifier, or credential placed where legitimate activity should not access or use it.

- Canonical URL: https://yellowcube.eu/glossary/honeytoken/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Monitoring that artifact can reveal suspicious discovery, copying, movement, or attempted authentication with relatively little expected background activity. Examples include decoy records, access keys, user credentials, links, or marked documents, provided they grant no real production privilege.

Each token should be uniquely attributable to a location and owner so an alert has useful context. Detection may come from access logging, an attempted sign-in, a callback, or discovery of the token outside its intended placement. The resulting event is an investigation lead, not an automatic incident conclusion.

### Key points

- **Placement:** Put tokens on approved systems and paths where unauthorized access would be meaningful, while accounting for legitimate indexing, backup, testing, synchronization, and security tools.
- **Lifecycle:** Record the token’s purpose, location, creation and expiry dates, expected trigger, response owner, and removal process; test alert routing without exposing a real secret.
- **Risk controls:** Prevent the artifact from granting production access or enabling harmful activity, minimize collected data, and review privacy, employment, contractual, and third-party implications.
- **Important limitation:** Benign automation or mishandling can trigger a honeytoken, while an attacker may avoid, recognize, or copy it without producing the expected signal. A trigger does not prove attribution or scope, and silence does not prove absence of compromise.

### Related terms

[Honeypot](<https://yellowcube.eu/glossary/honeypot/>) · [Canary token](<https://yellowcube.eu/glossary/canary-token/>) · [Deception technology](<https://yellowcube.eu/glossary/deception-technology/>) · [Identity threat detection and response (ITDR)](<https://yellowcube.eu/glossary/identity-threat-detection-and-response/>) · [Data loss prevention (DLP)](<https://yellowcube.eu/glossary/data-loss-prevention/>)

### Sources

[MITRE D3FEND: Decoy Object](https://d3fend.mitre.org/technique/d3f:DecoyObject/) · [MITRE D3FEND: Decoy User Credential](https://d3fend.mitre.org/technique/d3f:DecoyUserCredential/) · [NIST SP 800-53 Rev. 5, Update 1](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.