nullcipher

Telegram bot tokens (123456789:AA…)

A 5-16 digit bot ID, a colon, a capital A and 34 more characters — masked when a name containing “telegr” (TELEGRAM_BOT_TOKEN=, telegram_token:) comes just before it. Below: the exact rule, a live check, why it matters, and what to do if one already leaked.

Live check: Telegram bot token

What an AI chat would receive after masking

# EXAMPLE, not a real bot token
TELEGRAM_BOT_TOKEN=[TELEGRAM_BOT_API_TOKEN_1]

1 × Telegram bot token found and masked.

How nullcipher recognises it

Checked only when the text contains “telegr” (any case). Pattern (gitleaks rule telegram-bot-api-token, v8.30.1, translated to JavaScript): /[\w\-.]{0,50}?(?:[Tt][Ee][Ll][Ee][Gg][Rr])(?:[\w\t \-.]{0,20})[\s"']{0,3}(?:=|>|:{1,3}=|\|\||:|=>|\?=|,)[\s"'=`]{0,5}([0-9]{5,16}:(?:A)[\-0-9A-Z_a-z]{34})(?:[\s"';`]|\\[NRnr]|$)/ — the first capture group is masked; any surrounding key name stays readable.

This is the rule text of the “Telegram bot token” detector in the masking engine, copied from the engine when this page was built; the rule is ported from gitleaks’ default rule set (MIT licence; version, skipped rules and changes). Detectors run in a fixed order and, where two overlap, the earlier one wins.

Example (fake)

# EXAMPLE, not a real bot token
TELEGRAM_BOT_TOKEN=123456789:AAEXAMPLEexampleEXAMPLEexample00000

nullcipher replaces it with [TELEGRAM_BOT_API_TOKEN_1]. The bot ID is 123456789 and the secret part spells EXAMPLE. Telegram never issued it. Telegram's own docs illustrate the shape with 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11.

Why it matters in an AI chat

Telegram's Bot API documentation says each bot is given a unique authentication token when it is created, and every Bot API request carries it in the URL (api.telegram.org/bot<token>/method). Whoever has it controls the bot: they can read messages sent to it, message its users and change its webhook to point at their own server.

Because the token sits in the request URL, it also leaks through proxy logs, error messages and stack traces that print the URL — exactly the text that gets pasted into an AI chat when a bot breaks.

Limit of this rule (it is gitleaks' rule): a token pasted on its own, with no name containing “telegr” before it, is not masked. Paste the line with its variable name, or add the token to your list of words to always hide.

If it already leaked

  1. Open @BotFather in Telegram and send /token for your bot. Telegram's bot documentation says to use the /token command to generate a new token if your existing one is compromised. [1]
  2. Put the new token in your bot's configuration and restart it. If the bot uses a webhook, set it again with the new token so updates keep arriving. [2]
  3. Bots managed through Telegram's managed-bot feature can have their token replaced by the managing bot with the replaceManagedBotToken method, which revokes the current token and generates a new one. [1]

Sources

  1. Telegram Bot Features — BotFather and generating a token — checked 2026-09-25.
  2. Telegram Bot API — authorizing your bot — checked 2026-09-25.

Open the full masking tool to mask a whole log, .env file or e-mail — every type at once — and restore the values in the AI's answer. Or see all 229 detectors, with a page for 46 secret types, and how to delete a chat you already sent.