TgWitnessOff
Notifications
Problems, deleted and edited messages and a daily summary in Telegram, Discord, email or another service.
A bot, a webhook or a mailbox
GET STARTED
Connect your Telegram account
Sign in, choose your sources, then start observation.
- 1 Connect account
- 2 Choose sources
- 3 Start observation
Journal
Captured messages. Preserved changes. One record.
Overview
Messages observed0Live messages + history snapshots
Edits recorded0Observed versions, preserved
Deletion notices0Scoped Telegram notifications
Selected sources0Ready for observation
Event timeline
| Event / observation | Source | Observed | Open |
|---|
No observations here yet
Connect an account, choose your sources, then start observation.
Sources
Choose the conversations to record and what to keep.
Read the chats and folders available to this account. This refreshes the list; it does not download messages.
Not refreshed in this session.
Chats in scope
| Source | Type | Status | Priority | Actions |
|---|
Available chats
Full history
Bring past messages into this workspace
Load the available history of every enabled source into Chats and the signed journal. Progress survives a restart. Attachments follow your media settings. Deleted messages and unseen past edits cannot be recovered.
For an account archive, choose Whole account above, load and review the source list, then start observation. This run uses the enabled sources listed at its start; new sources are not added to a running job.
Use Export evidence to hand over the journal and saved attachments. Finishing history reads does not mean every attachment was downloaded.
Export records
Workspace ID: default · Large downloads & verification
Signed archive
Journal, report, attachments and verification tools.
Includes all sources through a fixed journal boundary, regardless of filters. Streaming export · ZIP limit: 4 GiB uncompressed unless changed in Parameters.GitHub Actions capture (preview)
A fresh Telegram login, one chat, an encrypted archive and GitHub provenance.
The file is saved as an AES-256 ZIP that 7-Zip or WinRAR opens with this password. Inside is the unchanged signed file, so verify.py works as before. The password is not stored; without it the file cannot be opened.
Prepared exports
The last 20 files prepared by this workspace. Compare a file with its SHA-256 below. This list does not store downloads or prove delivery.
Automatic timestamps and an encrypted off-site copy: Extras → Evidence that holds up.
Verification & limitations
Your signing identity
Ed25519 · SHA-256 public-key fingerprint
Retain this fingerprint and signed checkpoints outside the collector. A self-contained archive can verify its internal consistency; independently retained records help detect replacement or truncation.
Acquisition process receipt
The signed journal records program hashes, dependency versions, starting scope, account, settings, run identifier, and periodic heartbeats. Local checkpoints are saved at startup, every five minutes while observing (changeable in Parameters), and on orderly stop.
This is a collector-signed process record. It is not independent attestation or a trusted timestamp. Copy checkpoints to a separately controlled location for a stronger chain of custody.
External time anchoring
Prepare an RFC 3161 request for a signed checkpoint. Submit it to a timestamp authority you trust, then verify its response against independently obtained CA certificates.
No external service is contacted by this button. A prepared request is not a timestamp proof. The package includes instructions for checking a TSA response with OpenSSL.
Clear boundaries make stronger evidence
Message edits
Versions are preserved when received. Intermediate changes during downtime may be missing. The sender is not necessarily the editor.
Deletions
Earlier captured content remains. Telegram usually does not supply the deleter or exact deletion time. Unscoped notices remain account-level observations.
Reactions & membership
Counts, recent reactors, service messages, and participant updates are recorded when delivered. These are not guaranteed complete lists.
Coverage & time
Collector starts, stops, detected disconnects, and heartbeats are recorded. Brief outages can escape detection. Times depend on the collector's clock.
Integrity & authenticity
Signatures bind saved bytes to this collector's key. They do not establish Telegram origin, truthfulness, trusted time, or protection from an operator controlling the signing key.
EVIDENCE MODE
Evidence that holds up.
Timestamps show the journal existed at a given time; an off-site copy keeps it if this machine is lost or seized.
NOTIFICATIONS
Know when something happens.
Choose a service, fill in one or two fields and send a test.
24/7 SERVER
A sealed server, set up by commands you can check.
The server has no SSH and no open ports: the panel is reached through a Cloudflare Tunnel, and anyone with a read-only token can check how it was created.
Run these on your own computer in a checkout of TgWitness. Provider and Cloudflare tokens are read from files there; this panel never asks for them.
Tokens, costs and what the check proves ↗
WORKSPACE OPTIONS
Extras
Optional · your account and sources are enough to start collecting.Off
Evidence & backups
Anchor checkpoints and keep an encrypted off-site copy of the journal and files.
Timestamps work at once · the copy needs S3 storage
Off
Server 24/7
Collect around the clock on a cloud server without SSH, with a provider log anyone can check.
Hetzner, DigitalOcean, Linode, Vultr, AWS or your own server + Cloudflare
Not checked
Witness bot
Keep signed checks in Telegram so you can compare your saved history later.
Your bot + a channel + a witness host
Not checked
Code check
Compare the running program with a public Git commit and retain the result.
A public GitHub repository · no token
Only the option you choose opens its settings. Nothing is connected automatically.
TELEGRAM BOT
Your bot, in three steps.
A separate witness checks the journal and your bot publishes the result.
Give the witness read-only access
Create an access token for this account. It cannot read conversations or control collection.
Save this token; it is shown only once.
Existing connections
Choose where to publish
Create your bot with @BotFather and allow it to post in your channel.
Start it on the witness host
The saved configuration is a setup file. Run it on the witness host to begin checks and publication.
On the witness host, save the read-only token in witness-token.txt and the BotFather token in bot-token.txt next to witness.json. The bot token is never entered into this collector panel.
Keep the witness key fingerprint separately. Confirm the first signed post in your channel; a downloaded file does not mean the bot is running.
What does the bot actually prove?
Collector signs a checkpoint→Witness verifies and signs→Bot publishes to your channel
Run the witness on another host, ideally with another operator. Its bot token and signing key stay there. The bot is the publisher; the separate witness process performs verification.
Deployment and verification commands
You need a Telegram bot (create one with @BotFather) that is an administrator of a channel, and this panel's address reachable from the witness — over HTTPS outside a private network. Any Telegram account can watch the channel; its posts carry Telegram's own times.
Docker, next to this collector
On another server
Check it later
A running witness records missing or invalid collector answers. Verification compares retained checkpoints with the full export and detects missing or invalid signed posts in a channel export. Witness downtime and posting failures leave intervals without external anchors; signatures do not prove complete Telegram delivery.
Witness options
How often it checks, how long it waits, which checks it posts (all, only a new head or a problem, only problems) and the words of its posts are options of the witness itself: on its command line, in its environment or in a JSON file given with --config. Wording never affects verification: verify.py checks the signed token at the end of every post.
VERIFIED CODE
Know which software made the record.
Every program file is compared with the same file in the commit on GitHub. The result is saved in the signed journal, so anyone holding an export sees which public code was running.
- Fork the repository on GitHub and review the code, or use the official one.
- Enter the repository and a release tag or commit: a commit cannot change later, a branch can.
- Check again after every update; the badge shows when the running code is no longer the checked one.
Parameters
Limits and pace of collection, rechecks, downloads, people profiles, notifications and exports for this workspace. Each change applies from the next use of the value and is recorded in the signed journal.
No parameters match these filters.
Workspace
Add account
Demo
Sample workspace
Try TgWitness with your account
Stop the demo with Ctrl+C, then run from your project folder:
python start.pyOn Windows, you can double-click Start.cmd instead. Open the panel address printed in the terminal.
Installation help ↗Scan with Telegram
Settings → Devices → Link Desktop Device
Connection settings
Connection route
Direct connection
Choose a route before signing in.
Change connection route
Pause observation to change the route. Until then, observation keeps using the current one.
Public MTProxy lists
Choose a proxy, save it and test the Telegram connection before signing in. Your own proxy can be entered below.
Where the list comes from
Only compatible public addresses are included. Fake TLS ee entries are skipped. A listed server has not necessarily been tested from your network.
Proxy servers
Automatic MTProxy
Every server the automatic route can use: whether it answers, how fast, its country and list. A workspace keeps its server while it works and moves to the next one when it fails.
| Country | Server | Ping | Status | List | Used by | Action |
|---|
Lists and sources
Bundled lists
Public lists maintained on GitHub. Switch off the ones you do not trust.
Your lists
Add a list address, upload files or paste links. Lists are read for tg://proxy and t.me/proxy links anywhere in the text.
Paste links
GitHub
With a token, downloads from GitHub are authenticated and TgWitness can search GitHub for newly published MTProxy lists whenever the lists update. The token is kept encrypted and is sent only to GitHub.
Country lookups ask a public GeoIP service about the server addresses only, through the same route as list downloads.
Storage protection
Use an encrypted disk or volume for message content, attachments, temporary exports and backups. Signatures detect changes; they do not hide content. A proxy routes Telegram traffic and does not protect the web panel.
Workspaces · add or switch accounts
Add as many workspaces as you need. Use a distinct Telegram account per workspace: the same session in two places makes Telegram revoke it (AUTH_KEY_DUPLICATED).
Accounts
Isolated workspaces — add as many as you need. Each has its own session, sources, journal and signing key, and runs its own collector. Several accounts can export one chat together.
Bulk import
Import many accounts at once
Each account gets its own workspace, signing key and proxy. Files with the same name form one account, for example name.session with name.json. A session that does not sign in is not kept.
No matching workspaces.
Groups and shared settings
Ask the archive
Search saved observations, review the sources, then choose whether to use AI.
Review selected sources
Edits and deletion notices are separate records. Missing on recheck does not establish that Telegram sent a deletion notice.
Data sent to the model
Answer with sources
Analytical reports
Review report
Observed facts, model inferences and analyst notes remain distinct. The original signed events are unchanged.
Recognize an attachment
Open a saved attachment's journal record and choose Recognize attachment. Processing runs locally in an isolated worker.
Integrations
AI provider settings
The external model can receive messages requested by its client. Choose the workspaces and chats you want to share.
Shown once
Save your connection
The token is shown only here. Save it now; it cannot be retrieved later.
The copied token grants access to the selected archive. Keep it out of repositories, logs and shared screenshots.
Install TgWitness with MCP support on the client device. The local relay connects to this panel; the panel must stay running.
The configuration never includes your token. Add the saved token only in your MCP client's settings or environment.
Archive connections
Outgoing webhooks
Structured notifications for n8n and SIEM. Metadata is sent by default; message text requires a separate choice.
Configure the receiver to verify the signature and timestamp, and deduplicate by event_id.
Delivery status
Recent delivery attempts
Access
Give each person their own access to chosen workspaces and chats. The panel token remains the administrator key.
Issued
Granted access
Open sessions
My session limits
These limits apply to your own sign-ins with the panel token.
System log
Activity since this process started: connections, proxy changes, sign-ins, refusals and settings changes across workspaces. Messages remain in the journal.