Author: Pavel Onuchin, VPN and network security specialist

12 min read

Updated: October 27, 2026

VPN bots in Telegram: how they work, what you risk and how to check a bot before paying

A VPN bot in Telegram doesn't encrypt anything itself. It is a cash desk and a key dispenser: you choose a plan in the chat, pay and get a vless:// string or a subscription link, which you paste into a separate client such as Happ, v2rayTun or Hiddify. It is convenient and often inexpensive, but the seller is usually anonymous, and under Telegram's own rules, responsibility for a purchase in a bot lies only with the bot's owner, not with the messenger.

If you need a VPN to make Telegram itself open, that is a different task: it is covered in the article VPN for Telegram.

What is a VPN bot in Telegram and how does it work?

A VPN bot sells access to someone else's servers and issues a configuration for connecting. The connection itself is made by a separate client app on your phone or computer, and Telegram takes no part in it.

A typical scheme, according to the instructions on the Tok VPN («Ток ВПН») site (checked October 13, 2026):

Install a client from the app store. The Tok VPN site suggests v2rayTun, Streisand and Hiddify; Happ is also often used.
Open the bot, choose a plan or a trial period and pay.
Copy the key or subscription link from the bot's message.
In the client, tap "+" and add the configuration from the clipboard.

How a key differs from a subscription and what is inside a vless:// string is covered in the article what a VPN key is.

The client and the seller are different here. On the Happ listing in the App Store, the developer writes that it doesn't sell VPN services and warns about scammers posing as the "official Happ VPN".

Bots do have real advantages. One client accepts keys from different sellers, so you don't need a new app for each service. Many bots offer a trial period; for Tok VPN it is 3 days for 1 ruble. Prices are low: as of October 26, 2026, the same site lists 299 rubles a month for 7 devices. Renewal and support live in the same chat.

If you don't want to deal with keys and sellers, we recommend BessyConnect: it is an app from the App Store and Google Play with its own servers, and it doesn't need a key from a bot.

What do you risk when buying a VPN through a bot?

The main risk is that you are paying someone you don't know. In its rules for developers, Telegram states plainly that it is not affiliated with third-party bots and that all disputes over purchases are resolved by the bot's owner.

There is no seller in the legal sense. From the chat with the bot you can't see who owns it: there is no legal entity and no company details until the seller provides them. On the Tok VPN site we found no public offer, no privacy policy and no tax number (INN). There is no one to demand a refund from.

The bot can disappear along with your subscription. A bot works as long as the owner's account is alive and as long as Telegram opens. In March 2026 the messenger stopped working en masse in Russia: according to the outage tracker «Сбой.рф» (Sboy.rf), about 12 thousand complaints came in on March 15 (as retold by the magazine «Код» (Kod) on March 17). On such days the bot through which you renew your subscription is unavailable too. In addition, according to Roskomnadzor (Russia's internet regulator) data retold by Habr on February 27, 2026, since the start of 2025 Telegram has received demands to remove 35.5 thousand pieces of content about VPNs.

Payment without buyer protection. What matters here is exactly how you pay:

Telegram Stars. Telegram's rules require that digital goods and services in bots be sold only for Stars. If a bot didn't fulfill an order, the developer can refund the stars. The bot must respond to the /paysupport command, and if it refuses a legitimate refund, under the Stars terms you can take the transaction ID from the settings and file a complaint with Telegram.
A transfer to a card or via SBP (Russia's Faster Payments System). This is a transfer to a private individual, not a purchase. A chargeback, that is, disputing the transaction through the bank, isn't carried out for such transfers: it applies only to payments for goods and services from a registered seller.
Payment via a link to an external page. Telegram's payment rules don't apply here. If a payment service with a registered seller operates there, you can try to dispute a card payment through your bank.

On October 25, 2026, Russia's Interior Ministry (MVD) explained the rise in fraud through Telegram bots by how easy they are to create: according to the ministry, bots are connected to payment gateways and used for fake login windows.

Why does one VPN bot often have several lookalikes?

Because a bot's name can be anything, and only its address is unique. Under Telegram's rules, a bot's address (username) consists of 5–32 Latin letters, digits and underscores and must end in "bot". The name you see in the chat list is chosen freely by the owner.

In the Tok VPN review we found four bots with this name. On October 26, 2026, the picture is the same:

@tokvpn_bot is called "TOK VPN";
@tok_vpnbot is called "Tok VPN | Подключился — и работает" (Tok VPN | Connected — and it works);
@tok_vpn_bot and @tokvpnbot exist without a description.

The first two differ by the position of a single underscore. The site that calls itself official doesn't link to any of them. Which of the bots is the "real" one can't be established from open data.

The verification checkmark doesn't help much. Telegram grants it based on notability: verified accounts on at least two major platforms and press coverage. A small VPN service usually doesn't have one, so take the address from the service's site, not from comments or ads in channels.

What does the owner of the bot and the server see?

The bot's owner sees your Telegram account, and the server's owner sees where and when you connect. Often they are the same person.

Under Telegram's privacy policy (section 6.3), a bot receives your name, username, profile photo and everything you write to it. Your phone number only if you have shared it, your IP address if you open a link to a site it controls.

The server your traffic goes through sees your real IP address, the time and volume of connections and the addresses you connect to. With HTTPS, site names are usually visible from the SNI field, while the content of pages and messages is encrypted. The bot issues a key or subscription to each buyer separately, otherwise it couldn't disable them after the paid period ends. This means the owner has a link: this Telegram account uses this key.

Whether they keep logs, you won't find out. If the bot's author hasn't written their own privacy policy, Telegram's standard template applies by default, without specific commitments.

Free VPN bot: what's the catch?

A free bot can be honest if a known developer is behind it and states the limitations plainly. If the author is unknown, a free key means someone else is paying for the server, and you don't know why.

Amnezia has an example of an honest free bot. The project's bot issues a vpn:// key for the Amnezia Free service, and the documentation says plainly that this gives access only to certain sites and that YouTube doesn't work through it in Russia. The limitation is named in advance, and the developer is known.

The opposite example was described by the company F6 on February 16, 2026. A bot promised to speed up Telegram, asked you to confirm that you are "not a robot", and with that button obtained your phone number. Then it asked for a five-digit "verification" code, which was actually the Telegram login code. Without a cloud password, the account went to the attackers. In similar channels, according to F6, an archive with a "client" containing a Windows trojan was handed out.

Telegram's rules prohibit bots from asking for your account password or one-time code. If a bot does this, it is a scammer. More about fake clients and configurations from chats is in the article how to tell a fake VPN app.

How to check a VPN bot before paying: a checklist

The check takes a few minutes:

Check the address. Take the @username from the service's site and compare it character by character. A matching name means nothing.
Send /terms and /paysupport. Telegram requires a selling bot to show its terms of sale and accept payment questions. No answer means no obligations.
Look at the payment method. Paying in Stars gives you at least some way to complain. A transfer to a private individual's card gives you nothing.
Start with a trial period or one month. Don't pay a year in advance to a service that is a week old.
Make sure the bot doesn't ask for anything extra. A phone number, a code from an SMS or from Telegram, installing a file from the chat: a reason to leave immediately.
Find out where else the service lives. A site, an email, a personal account outside Telegram. If the messenger becomes unavailable, that is the only way you'll be able to renew your subscription and contact support.
Install the client only from an app store or from the developer's official page, not from a link in the bot.

After paying, save the receipt, the conversation and the bot's address. If the charges are recurring, find out right away where auto-renewal is turned off.

A bot, an app from the store or your own server: what to choose?

A bot wins on speed of getting started, an app from the store on predictability, your own server on control.

	A VPN bot in Telegram	An app from the App Store or Google Play	Your own server
Who sells	Often unknown, no company details	The developer listed on the store listing	You rent the server yourself
What to install	A third-party client plus a key from the bot	One app	A client plus server setup
Payment	Stars, a card transfer or an external link	Through the store or the service's site	To the hosting provider
If the seller disappears	The key stops working, and there is nowhere to look for the seller	The developer is listed on the listing, but without them the app won't work either	The server is yours as long as the hosting is paid
Who controls the server	The bot's owner, whom you don't know	The service listed on the store listing	You do
When Telegram is unavailable	Renewal and support via the bot are unavailable	No effect	No effect
Difficulty	Low	Low	High, skills required

How much your own server costs and who it suits is covered in the article your own VPN on a VPS. And if you only need Telegram, the built-in proxy is sometimes enough: see the article MTProto proxy for Telegram.

Why we recommend BessyConnect

We recommend BessyConnect to those who don't want to choose between lookalike bots and copy keys. It is an app from the store with its own servers: install it, turn it on, and it works. No key from a bot is needed, and Telegram isn't required for renewal.

What is known about BessyConnect:

the VLESS protocol with Reality camouflage, traffic looks like ordinary HTTPS;
more than 100 servers;
no logs kept;
registration not required;
there is a trial period;
apps for iPhone, iPad, Mac, Apple TV, Android and Android TV.

Where to download it:

iPhone, iPad, Mac and Apple TV — App Store
Android — Google Play
Android TV — Google Play
All platforms — download page

Now, honestly, about the limits. A bot can be more convenient: if you already have a client like Happ or Hiddify installed and are ready for the risks above, a key from a bot connects in a minute. Keys from bots also open on Windows, for example via Hiddify, while there is no BessyConnect app for Windows. BessyConnect isn't in the Russian App Store either: installing it on an iPhone requires an Apple ID from another country. We can't help get back money already sent to someone else's bot. And when mobile internet is shut off completely, no VPN will connect, whether from a bot or from a store.

If your bot works and you have checked it against the checklist, there is no urgent need to switch. But if you are just choosing, or you are tired of looking for the "real" bot, start with BessyConnect: versions for all devices are gathered on the download page, and the trial period lets you test the service before paying.

Frequently asked questions

Is it safe to buy a VPN through a Telegram bot? It depends on the seller. Telegram isn't responsible for purchases in bots, and most bots have no company details or public offer, so pay small amounts and keep your receipts.

Is there a free VPN bot in Telegram? Yes, for example the Amnezia bot issues a free key for Amnezia Free, but it opens only certain sites. Free keys from unknown bots can stop working at any moment, and the server's owner sees your connections.

What should I do if a VPN bot disappeared after I paid? If you paid in Stars, send the bot /paysupport, and if it refuses, file a complaint with Telegram with the transaction ID. A card transfer to a private individual can't be disputed through the bank, so what remains is a police report if it is fraud.

How can I tell if a VPN bot is real? Compare the @username with the service's site character by character: an identical name proves nothing. A real bot responds to /terms and /paysupport and never asks for your Telegram login code.

How is BessyConnect different from a VPN bot? BessyConnect is its own app in the App Store and Google Play with its own servers on VLESS with Reality camouflage; no key from a bot and no Telegram for renewal are needed. But it has no Windows app, while a key from a bot can be opened on Windows.

Sign In