Keybox Telegram Here

Write-Up: Keybox Telegram Bot – Secure Credential Delivery

Self‑Hosting the Bot

1. Create a new bot via @BotFather on Telegram.
2. Deploy the bot code (Docker or Python) on your own server.
3. Set environment variables: DB_URL, ENCRYPTION_SALT, ADMIN_IDS.
4. Run docker-compose up -d

Limitations

• Telegram itself is not end‑to‑encrypted by default for bot chats (use secret chats with a wrapper, or rely on client‑side crypto).
• Metadata (key names, timestamps) is visible to the bot operator – avoid revealing secrets in key names.
• Not a replacement for HashiCorp Vault in large orgs, but perfect for small teams or individuals.

How It Works

1. User authenticates with the bot using a master passphrase (never stored).
2. Client‑side encryption encrypts the key+metadata before sending to the bot.
3. Bot stores the encrypted blob in a database (no plaintext keys ever touch the server).
4. On request, the bot returns the encrypted blob → decrypted only on the user’s device.

For sharing, the bot generates a one‑time, expiring decryption token tied to the recipient’s Telegram ID.