Decoy: a believable fake secret

A fake secret.
A deliberate purpose.

Give an agent a fake key instead of a live one, or prepare a harmless message to reveal. Start with free browser suggestions, then explore hosted generation.

Explore the encryptor ↗
HOW A FAKE IS MADE

Choose the shape.
Generate a fake.

The live suggestion engine receives a type label, not your secret.

  1. 01Choose a kind of secret

    Send only its type label, such as API key.

  2. 02Generate a believable fake

    The suggestion service returns a matching shape.

  3. 03Choose how to use it

    Reveal it deliberately, or give it to an agent.

THE ONLY INPUTopenai-keyA type label
ILLUSTRATIVE OUTPUT SHAPE
sk-···· ···· ····

A shape-matched suggestion.
Not a live credential.

FIG. / SPECIMEN

For alerts, register a separate tripwire (a monitor for use of an armed decoy). Honey Mode supplies wrong-password results for supported formats.

01 / Choose your layer

Two different jobs.

Choose a message, generate a suggestion or add Honey Mode for supported formats.

Describe the type, not the secretILLUSTRATIVE GENERATION FLOW
YOUR INPUTCredential type{ type: "openai-key" }The live engine receives the type label.
Shape-matched suggestionA plausible form, not a working key.
YOUR CHOSEN DECOYUse it as plaintextThen create the decoy control file (the file that selects which message opens).
Secret stays out of this request.Register separately for monitored alerts.
01

Your chosen message

Write the message that the decoy control file should reveal. Both web/SDK passwords remain the same.

Understand control files ↗
02

Structured suggestions

Local suggestions come from the browser bundle. The optional live engine receives a type label, not your secret, to suggest a shape-matched decoy.

Try the tool ↗
03

Honey Mode

For supported formats, a wrong password/control combination produces a fake in the right format. The same wrong inputs give the same result.

Read the guide ↗
02 / Detection is separate

Create a fake. Monitor separately.

A registered decoy can trigger an alert when our monitored decryption service sees its fingerprint, a unique identifier.

Limits and scope

Monitored deny.sh endpoints can record a registered decoy’s use. A provider rejection is not automatically a deny.sh detection event, and offline decryption is not observed. Generation does not arm a tripwire. Review evidence and current status.

Tripwire implementation guide ↗
03 / Type catalogue

Shape matters.

Browse the existing credential-type catalogue. A matching shape does not make a decoy a working credential or automatically arm a tripwire.

Cloud, API & infrastructure (32)
stripe-test-keystripe-live-keygithub-pat-classicgithub-pat-fineopenai-keyanthropic-keyresend-keyaws-access-keyjwt-tokenprivate-key-pempostgres-urimongodb-urislack-bot-tokenslack-user-tokendiscord-bot-tokendigitalocean-patgcp-api-keygcp-service-account-keyazure-client-secretazure-storage-keytwilio-auth-tokensendgrid-keyhuggingface-tokennpm-publish-tokenpypi-tokengitlab-patmailgun-api-keylinear-api-keynotion-tokenshopify-tokensquare-tokencloudflare-api-token
Crypto wallets (4)
bip39-phraseethereum-private-keybitcoin-wifsolana-private-key
Healthcare (5)
uk-nhs-numberus-npius-dea-numberus-medicare-mbius-ndc
Finance & securities (10)
ibancredit-cardleiisincusipus-eindunsus-routing-numberus-bank-accountbic-swift
Government & identity (8)
us-ssnuk-ni-numberus-itinpassport-mrzus-passportuscis-numberaadhaareidas-id
Network, device & contact (8)
email-addressphone-e164ipv4-addressipv6-addressmac-addressimeivinuuid
Unstructured catch-alls (2)
genericfreeform-secret

Choose a type in the encryptor, or follow the decoy generation API reference. Hosted generation needs an API key, your account’s access credential, and is subject to plan limits.