Honey Mode | deny.sh

Honey Mode: fake outputs for wrong inputs

For supported structured types, Honey Mode returns a deterministic, type-correct fake for an incorrect password/control combination instead of plausible garbage. It is separate from the deliberately chosen plaintext revealed by a decoy control file. Local fake generation does not itself arm a hosted tripwire or deliver an alert. See the Honey Mode guide and the separate tripwire workflow.

Supported formats. Honey Mode supports 63 of the 69 credential types: two have no fixed structure, and four do not yet have byte-identical Honey generators across SDKs. It refuses generic, freeform-secret, jwt-token, postgres-uri, mongodb-uri and gcp-service-account-key. For those six types, use classic encrypt() / decrypt() with a hand-written decoy. Honey Mode is available in the Node.js, Python, Rust and Go reference SDKs.

Public result: Honey decrypt returns value only, not a real-versus-fake indicator. Internal test helpers retain a branch field; do not expose those helpers to callers.

TypeScript / Node.js

import { encryptHoney, decryptHoney } from 'deny-sh';

const res = await encryptHoney({
  secret: 'sk_live_51H8x...real',
  passwords: { p1: 'demo-pass-one', p2: 'demo-pass-two' },
  honeyType: 'stripe-live-key',
});

// Right passwords -> the real secret.
const real = await decryptHoney(
  res.ciphertext, res.realCtrl,
  { p1: 'demo-pass-one', p2: 'demo-pass-two' },
  res.honeyType, res.band,
);
// real.value is the real secret

// Incorrect password/control combination -> a deterministic, type-correct fake.
const fake = await decryptHoney(
  res.ciphertext, res.realCtrl,
  { p1: 'wrong', p2: 'wrong' },
  res.honeyType, res.band,
);
// fake.value is a plausible decoy

Python

from deny_sh import encrypt_honey, decrypt_honey

res = encrypt_honey(
    secret, p1, p2, 'stripe-live-key',
)

out = decrypt_honey(
    res.ciphertext, res.real_ctrl, p1, p2,
    res.honey_type, res.band,
)
# out.value: real secret on right pw, typed fake on wrong

Go

import deny "github.com/deny-sh-crypto/deny-go/v2"

res, _ := deny.EncryptHoney(
    secret, p1, p2, "stripe-live-key",
)

out, _ := deny.DecryptHoney(
    res.Ciphertext, res.RealCtrl, p1, p2,
    res.HoneyType, res.Band,
)
// out.Value: real on right pw, typed fake on wrong

Rust

use deny_sh::{encrypt_honey, decrypt_honey};

let res = encrypt_honey(
    secret, p1, p2, "stripe-live-key",
)?;

let out = decrypt_honey(
    &res.ciphertext, &res.real_ctrl, p1, p2,
    &res.honey_type, res.band,
)?;
// out.value: real on right pw, typed fake on wrong

CLI

deny-sh encrypt -m "sk_live_51H8x...real" -p1 "demo-pass-one" -p2 "demo-pass-two" \
  --honey --honey-type stripe-live-key

--honey requires --honey-type <type>; the CLI rejects unknown or honey-ineligible types up front. The encrypt step prints the type and band metadata you persist alongside the record (both are required inputs to decryptHoney).

Limits and scope

Classic decoys and Honey Mode can be used together. Neither local layer establishes hosted alert delivery on its own. Read the Honey Mode specification and the tripwire workflow.