@TotpAuthenticatorBotFree
68 / 100
Score
Password bots do two safe things: generate a new random password and produce one-time 2FA codes. They should never store or check your real passwords, and the bots in this rating do not ask to. A breach checker tells you whether an email address appeared in a known leak.
| # | Bot | Price | Languages | Inline | Groups | Score |
|---|---|---|---|---|---|---|
| 1 | @TotpAuthenticatorBot | Free | EN | no | no | 68 |
| 2 | @easystrongpasswordbot | Free | EN | no | no | 64 |
| 3 | @passwordaudit_bot | Free | EN | no | no | 64 |
| 4 | @pwned_robot | Free | EN | no | no | 63 |
| 5 | @gen_password_bot | Free | RU | no | no | 61 |
| 6 | @HalltapePassBot | Free | RU | no | no | 60 |
| 7 | @pwn3dbot | Free | EN | no | no | 58 |
| 8 | @password_save_bot | Free | RU | no | no | 56 |
We generated a hundred passwords from each generator and checked length, character classes and repetition. The TOTP bot was set up with a test secret and its codes compared with Google Authenticator over an hour. For the breach checker we tested a known-leaked and a clean address. We read each bot's description and, where available, source code for any sign of storing input, and excluded every bot that offered to "save" or "check" an existing password.
Generating a password is safe when the bot does not keep it, and a generator with published code, like Halltape's, can be checked. A TOTP bot holds the secret key for each site, the same thing an authenticator app holds; that is a real convenience for people who lose phones, and a real risk if the Telegram account is compromised, so protect Telegram itself with a strong cloud password. Breach checkers need only your email address, never a password.
Store your passwords. Telegram chats are not end-to-end encrypted by default, the bot's developer can read every message, and a "password manager bot" is a list of your passwords on a stranger's server. Use a real password manager for storage; use bots only for generation and codes.
Random strings from Password Generator (@gen_password_bot) are strongest and belong in a manager, not in memory. EasyStrongPasswordBot trades some entropy for passwords you can type on a TV or a bank terminal; use those where you must type by hand. Whatever the style, use a different password per site, which is the point of a manager.
TOTP-Authenticator generates the same codes; it is convenient, but your Telegram account then guards every 2FA secret, so enable a cloud password.
No. The developer can read your chat; use a real password manager and bots only for generating passwords.
Send the address to Have I been pwned? (@pwned_robot); never send a password to any bot.
Any that does not store input; Halltape's generator publishes its source on GitHub so this can be verified.
