Telegram Bot Token Checker
Paste a bot token to check its format, then call getMe and getWebhookInfo to see whether Telegram accepts it, how the bot is receiving updates, and whether privacy mode is hiding group messages. The request goes from your browser straight to api.telegram.org - the token never touches conferbot.com and is not stored.
Check a bot token
Expected shape: 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11 - digits, a colon, then letters, digits, - and _.
What the token format tells you before any request
A Telegram bot token is two parts joined by a colon: the bot's numeric ID, and a secret issued by @BotFather. Telegram's own example is 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11. Tokens created in recent years have an ID of eight to ten digits and a secret of exactly 35 characters drawn from letters, digits, hyphen and underscore. Telegram does not publish a formal grammar, so this page treats a mismatch as a warning rather than a hard stop - but in practice a token that fails the shape check was almost always truncated, had a line break pasted into it, or lost a character around the colon. The live check is the authority; the shape check just saves you a round trip.
What getMe proves
getMe is the cheapest call in the Bot API: it takes no parameters and returns the bot's own User object. If it comes back with ok: true, the token is live. If Telegram answers 401 Unauthorized, the token is wrong or has been revoked, and no amount of webhook debugging will help until that is fixed. Beyond yes-or-no, the response carries three flags worth reading. can_join_groups says whether anyone can add the bot to a group. can_read_all_group_messages is the privacy-mode switch - when it is false, the bot only receives group messages that are commands, replies to it, or mentions, which is the single most common reason a group bot appears to ignore people. supports_inline_queries reports whether inline mode is on.
Reading getWebhookInfo like a pro
A bot receives updates in one of two ways, never both: Telegram pushes them to a webhook URL you registered, or your code pulls them by long polling getUpdates. getWebhookInfo is the flight recorder for the push mode - every field distinguishes a healthy setup from a specific failure:
| Field | Healthy | Trouble sign |
|---|---|---|
url | Your HTTPS endpoint - or empty because you poll on purpose | Empty when you believed a webhook was set: setWebhook never succeeded |
pending_update_count | Zero, or a small number that drains | A number that grows on every refresh - the endpoint is not answering 2xx |
last_error_date / _message | Both empty | A recent timestamp plus Telegram's own words: timeout, TLS failure, wrong response |
ip_address | Resolves to your current server | A previous host's IP after a migration - DNS still points at the old box |
max_connections | The default of 40 | A 1 left over from debugging, quietly throttling delivery at volume |
allowed_updates | Empty (Telegram's default set) | A restricted list missing message - ordinary chats are filtered out before they reach you |
Telegram keeps undelivered updates and retries, so the moment the endpoint answers correctly the backlog drains on its own - no resubmission needed.
Polling, webhooks and the 409 Conflict
Because Telegram allows exactly one consumer per bot, getUpdates returns 409 Conflict if a webhook is registered, or if a second process is already polling with the same token. The second case is the sneaky one: a development instance still running on a laptop while production starts, or a container that restarted before the old one exited. The fix is either deleteWebhook before you poll, or finding and stopping the duplicate poller. Both variants have their own reference pages - getUpdates while a webhook is active and terminated by another getUpdates request - and a fuller walkthrough of silent-bot causes is in why your Telegram bot is not responding. Rate limits that can also make a bot look dead - messages per second to one chat, per minute to a group - are on the Telegram limits page.
Keeping the token safe
The token is the bot's only credential: anyone holding it can send messages as the bot, read its updates, and re-point its webhook. This page sends it from your browser to api.telegram.org over HTTPS and nowhere else - there is no Conferbot server in the path and nothing is logged. Even so, a token that has been pasted into a web page, a chat message or a screenshot is a token you should consider exposed. If that bothers you, run the check, then open @BotFather and send /revoke; Telegram issues a fresh token immediately and the old one stops working, with no change to the bot's username, groups or settings. Update your deployment's environment variable and carry on.
If you would rather not run a webhook endpoint at all, a hosted Telegram chatbot holds the token, registers the webhook and answers messages for you. And once the bot is alive, the Telegram link generator builds the t.me start links that bring people into it.
Frequently asked questions
What does a valid Telegram bot token look like?
Telegram's documentation gives the example 123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11 - a numeric bot ID, a colon, then a string of letters, digits, hyphens and underscores. Real tokens issued today have an 8 to 10 digit ID and a 35-character secret. BotFather shows it once when you create the bot and again under /token, and it is the only credential your bot needs.
Is it safe to paste my bot token into this page?
The token travels from your browser straight to api.telegram.org over HTTPS, the same request your own code makes. It is not sent to conferbot.com, logged, or stored anywhere. If that still makes you uneasy, test with the token, then open @BotFather and use /revoke to issue a new one - the old one stops working immediately and nothing else about the bot changes.
Why does getMe return 401 Unauthorized?
The token is not one Telegram currently recognises. Either it was mistyped or truncated while copying, or it has been revoked through @BotFather and replaced with a fresh one, or the bot was deleted. Check for trailing spaces and line breaks first, since a token pasted from a chat message often picks one up, then ask BotFather for the current token with /token.
My webhook URL is set but the bot does not respond. Why?
Look at last_error_message and pending_update_count in the webhook info. If Telegram records an error such as a connection timeout, a TLS failure or an HTTP status other than 2xx, your endpoint is rejecting deliveries and updates are piling up in the pending count. Fix the endpoint - certificate, port, response code - and Telegram will retry the queue automatically.
What does a 409 Conflict from getUpdates mean?
Two things are trying to consume the same bot's updates. Either a webhook is registered while your code also polls with getUpdates, or two instances of your polling process are running at once - a forgotten terminal, a stale container, a crashed process that restarted alongside the new one. Telegram only allows one consumer. Delete the webhook or stop the duplicate poller.
Why can my bot not see ordinary messages in a group?
Privacy mode is on, which is Telegram's default. In that mode a bot in a group receives only commands, replies to its own messages, and messages that mention it - everything else is withheld. This checker shows it as can_read_all_group_messages being false. Turn it off with /setprivacy in @BotFather, then remove and re-add the bot to each group so the change applies.
Should my bot use a webhook or polling?
Polling with getUpdates is simpler to run locally and needs no public HTTPS endpoint, so it suits development and small bots. A webhook delivers each update the moment it arrives, scales better, and is what production bots and hosted platforms use - but it requires a reachable HTTPS URL with a valid certificate. Whichever you choose, use only one at a time.
Related
Let a chatbot hold the webhook for you
Connect your Telegram bot to Conferbot and it answers in minutes. Free plan, no credit card.