Canary
Plant a decoy login where only a snooper would find it. If anyone opens it, you get an email straight away with when, where and what device.
- 1Create a canary. You get a decoy password and a trap link.
- 2Plant it in your password manager, email drafts or cloud files, looking like a real login.
- 3Get an alert if anyone ever opens the trap link.
For the geeks: how secure is it?
The trap link opens a plain “Session expired” page with no mention of pass.new, so a snooper won't suspect a thing. The alert is sent by the page's JavaScript, so link previews in most chat apps don't set it off.
Your decoy password is made on your device and we only keep a fingerprint of it (SHA-256), never the password itself. Alerts include the time, rough location from the internet connection, IP address and device, with at most one email every 10 minutes.
1 Confirm your email
We've sent a confirmation link to . Alerts start once you tap it.
2 Plant your canary
Good places to plant it:
- In your password manager: add a login called something tempting like “Bank (old)”, with the trap link as its website and the decoy password.
- In your email drafts or notes: a note called “logins” with the trap link and decoy password.
- In cloud storage: a document called “passwords” containing the trap link.
Don't open the trap link yourself, or you'll trip it. Avoid pasting it into chat apps, whose link previews can sometimes trip it.
3 Save your management link
See every alert, or delete the canary.