Enter a bot username to check what a prospective user sees before pressing Start. Add a token and it also reports the configuration nobody can see from outside — registered commands, webhook backlog, the last delivery error, privacy mode and group permissions.
Read this before pasting. A bot token is full control of the bot — reading messages, sending them, changing the webhook. This tool sends it to this site's server, which calls seven read-only Bot API methods (getMe, getMyCommands, getWebhookInfo and four more), uses the answers to build the report, and keeps nothing: the token is never written to disk, never logged and never stored in your browser. It still leaves your machine, which is a decision only you can make. If you would rather not, run the public audit — or paste the token, read the report, and rotate it with /revoke in @BotFather afterwards.
{{ error }}
Usernames and scores only. Tokens are never written here.
Weighted over the {{ result.weighted_total }} points that applied. Informational rows carry no weight, so a bot is never marked down for a deliberate choice such as running without inline mode.
This is the public half only. Commands, webhook health and permissions are invisible from outside and are not in this number.
{{ result.public.description }}
Token rejected: {{ result.api_error }}
Nothing failed. The remaining rows are informational.
| Command | Description |
|---|---|
| /{{ command.command }} | {{ command.description || '—' }} |
No commands registered in the default scope.
Only the webhook origin is shown. The path is effectively a shared secret — anyone who knows the full URL can post forged updates to it — so it is withheld from the report and from anything you export.
{{ exportText }}Without a token the audit reads the public t.me page — the display name, the bio and the photo. That is exactly the surface a prospective user judges before pressing Start, and it is the part most often left empty: Telegram silently substitutes "You can contact … right away" when there is no bio, which looks like a description while saying nothing. The public page is a marketing page rather than an API, so these fields are reported as observed and never inferred.
With a token the interesting half becomes visible. getWebhookInfo alone answers most "the bot stopped working" tickets: pending_update_count shows a queue building because the endpoint is erroring or too slow, and last_error_message names the exact reason Telegram could not deliver. Almost nobody reads that field. The audit also reports registered commands and whether their descriptions say anything, the empty-chat and short descriptions, the menu button, and the permissions — group mode, inline mode, business connections and privacy mode.
Privacy mode deserves its own note. With it off, the bot receives every message in every group it is in. That is occasionally required and always a liability, because it widens both what you store and what a breach exposes. If no feature depends on reading ambient group traffic, it should be on.
What this cannot tell you. Whether the bot actually works. There is no substitute for sending it a message. It also cannot see your code, your error rate, your response latency or what happens after /start — only the configuration around them. A perfect score here is a well-configured bot, not a good one.
Related: Telegram Webhook Tester decodes an update payload and verifies Mini App initData signatures, Telegram Studio composes and previews what you send, and Telegram Stars Invoice builds payment payloads.
Privacy: the username is public. The token, if you supply one, is sent to this site's server over HTTPS, used for read-only Bot API calls in a single request, and discarded when that request ends — it is never written to disk, never logged and never stored in your browser. Only the username, tier and score are kept in local history.
