Chosen plaintext
Write the message that the decoy control file should reveal. Both web/SDK passwords remain the same.
Understand control files ↗Decoy designPlausible material.
Plausible material.
Explicit purpose.
A deliberately chosen decoy and a Honey Mode wrong-password result are different layers. Use each with a clear threat model.
01 / Choose your layer
Two different jobs.
Do not confuse generating a decoy with arming a monitored tripwire.
A type, not your secretILLUSTRATIVE GENERATION FLOW
YOUR INPUTCredential type
{ type: "openai-key" }The live engine receives the type label.Shape-matched suggestionA plausible form, not a working key.
YOUR CHOSEN DECOYUse it as plaintextThen create the decoy control file.
Secret stays out of this request.Generation does not arm a tripwire.
Structured suggestions
Local suggestions come from the browser bundle. The optional live engine receives a type label, not your secret, to suggest a shape-matched decoy.
Try the tool ↗Honey Mode
Supported structured types get a deterministic, type-correct fake from an incorrect password/control combination.
Read the guide ↗02 / Detection is separate
Generation is not observation.
An armed decoy can trigger an alert when it reaches a monitored deny.sh decrypt endpoint.
Define the event you can actually see.
A provider rejection is not automatically a deny.sh detection event. Offline decryption is not observed by hosted endpoints.
Tripwire implementation guide ↗03 / Type catalogue
Shape matters.
Browse the existing credential-type catalogue. A matching shape does not make a decoy a working credential or automatically arm a tripwire.
Cloud, API & infrastructure (32)
stripe-test-keystripe-live-keygithub-pat-classicgithub-pat-fineopenai-keyanthropic-keyresend-keyaws-access-keyjwt-tokenprivate-key-pempostgres-urimongodb-urislack-bot-tokenslack-user-tokendiscord-bot-tokendigitalocean-patgcp-api-keygcp-service-account-keyazure-client-secretazure-storage-keytwilio-auth-tokensendgrid-keyhuggingface-tokennpm-publish-tokenpypi-tokengitlab-patmailgun-api-keylinear-api-keynotion-tokenshopify-tokensquare-tokencloudflare-api-tokenCrypto wallets (4)
bip39-phraseethereum-private-keybitcoin-wifsolana-private-keyHealthcare (5)
uk-nhs-numberus-npius-dea-numberus-medicare-mbius-ndcFinance & securities (10)
ibancredit-cardleiisincusipus-eindunsus-routing-numberus-bank-accountbic-swiftGovernment & identity (8)
us-ssnuk-ni-numberus-itinpassport-mrzus-passportuscis-numberaadhaareidas-idNetwork, device & contact (8)
email-addressphone-e164ipv4-addressipv6-addressmac-addressimeivinuuidUnstructured catch-alls (2)
genericfreeform-secretChoose a type in the encryptor, or follow the decoy generation API reference. Hosted generation is authenticated and rate-limited.