What to do if your Telegram bot token leaks

Fix it now: revoke the token

Revoking creates a new token and kills the old one at once. Whoever has the old token loses control of your bot the moment you do this.

1. Open @BotFather and send /mybots.
2. Tap the bot whose token leaked.
3. Tap API Token, then Revoke current token.
4. BotFather shows the new token. Copy it, and don't paste it anywhere except where your bot runs.
5. Update the token wherever your bot runs. Your bot stops replying until you do.

If you built the bot with Echo Maker, revoking the token disconnects it from Echo Maker instantly. Reconnect the bot with the new token to bring it back. If you run your own code, put the new token in your configuration and restart the program.

Your bot's username, users, groups and channels stay the same. Users don't need to do anything, and they won't notice unless the bot was silent for a while.

Make sure you're in the real BotFather: it has a verified badge and the exact username @BotFather. For the full steps, including how to find a token later, see how to get and reset a bot token.

What someone can do with your token

A bot token is like a password for your bot. Anyone who has it can control the bot through Telegram's Bot API, the interface programs use to run bots. That means they can:

• Receive messages sent to your bot. While they're connected, new messages from your users go to their program instead of yours, so your bot stops replying.
• Send messages as your bot. They can reply to anyone who writes to it with spam, phishing links or fake offers, under your bot's name.
• Use the bot's admin rights. If your bot is an admin in a group or channel, they get whatever rights you gave it. That can mean deleting messages, banning members or posting in your channel.
• Change the bot's details. The Bot API lets them change the bot's name, description and command list.

What they can't do

• Take over your personal Telegram account. The token only controls the bot.
• Delete the bot, change its username, or transfer it to someone else. Only the owner can do those, in BotFather.
• Stop you from revoking the token. That's why revoking always works.
• Download a full list of your users. The Bot API has no such feature. Still, if the bot saves user data somewhere, protect that separately.

Signs your token has leaked

Sometimes you know straight away: you posted a screenshot and spotted the token in it. Other times, the bot tells you. Watch for:

• The bot stops replying even though nothing changed on your side. Someone else may be receiving its messages.
• It replies with things you didn't write, or users complain about strange messages or links from it.
• Its name, description or commands changed.
• Unexpected posts or deleted messages in a group or channel where the bot is an admin. Check the group's recent actions to see what the bot did.
• For developers: an error saying another getUpdates request is running, or a webhook URL you don't recognize. Both mean another program is using the token.

If you see any of these, revoke first and investigate after. Revoking a token that wasn't actually leaked costs you a minute. Waiting while one is in use can cost you your users' trust.

After you revoke: check for damage

Once the old token is dead, clean up anything that happened while someone else had it:

1. Check the bot's profile. In BotFather, look at the name, description, about text and commands. Fix anything that changed. See how to change a bot's name and description.
2. Check your groups and channels. Delete any posts the bot made that you didn't, and unban anyone it removed.
3. Reduce the bot's admin rights. If it doesn't need to ban members or add admins, take those rights away. Less power means less damage next time.
4. Warn your users if spam went out. A short broadcast like "Our bot sent some messages we didn't write. Please ignore them and don't click those links" protects people and keeps their trust. See how to message all your users.
5. Find the leak. Work out how the token got out, using the list below, so it doesn't happen again.

How tokens usually leak

Tokens rarely get "hacked". Almost always, the owner shares them without noticing:

• Screenshots. Someone posts a screenshot of their BotFather chat to ask for help, and the token is right there in the message. Cropping or a quick blur often isn't enough.
• Public code. A developer puts the token directly in their code and uploads it to a public repository on GitHub or a similar site. Public code is easy to search, and people look for tokens in it.
• Sharing in groups. Pasting the token in a group or a chat with a "developer" who offers to help. Anyone in that chat now has it, and so does anyone they forward it to.
• Untrusted services. Pasting the token into a bot host, tool or website you know nothing about. Whoever runs it can keep a copy.
• Fake BotFather bots. Lookalike bots that ask you to "confirm" your token. The real BotFather never asks you to send it your token.
• Old helpers. A freelancer or former team member who once had the token still has it, unless you revoked it after they left.

How to keep your token safe from now on

• Treat it like a password. Never post it, screenshot it or send it in a chat. If you need help with your bot, describe the problem instead of showing the token.
• Keep it out of code. Developers should store it in an environment variable or a configuration file that isn't uploaded, for example one listed in .gitignore.
• Only give it to services you trust. A bot host needs your token to run the bot. That's normal. Choose one you trust, and remember you can revoke the token at any time to cut it off.
• Revoke when people leave. If a developer or admin who had the token stops working with you, revoke it and update your bot. It takes a minute.
• Protect your Telegram account. Your token sits in your BotFather chat. Anyone who gets into your account can read it, so turn on two-step verification.
• Give the bot only the admin rights it needs. If the token ever leaks again, a bot that can only delete messages does much less harm than one with every right.

For more on scams that target bot owners and users, see are Telegram bots safe?