Saved Messages++

Saved Messages++ is a personal vault inside Telegram. It lets you write notes, keep login and password cards, attach small files, and return to earlier revisions. Content is encrypted on your device before it reaches the server, and opened after you unlock the vault.

The bot is an entry point to the Mini App. The web app also has its own address; a real vault requires verified Telegram context. An ordinary browser offers a temporary demo that does not persist data as a personal account. The application interface is currently in English.

Separate records for everyday information

The application has three content types: note, password, and file. A note stores a title and body, with Markdown and a preview. A password card separates the login, secret, and website address from ordinary text. File records retain the filename and bytes; a small attachment can also accompany a record.

Tags and search help you find an item without browsing the entire collection. Search runs locally over data already decrypted on your device: titles, bodies, logins, addresses, and tags. Password-field values are excluded. The server does not need a plaintext index of your content.

You can pin an important record, move another to the archive, and restore it later. Permanent deletion is a separate action that requires confirmation. These states serve different purposes: archiving organizes the list rather than promising data destruction. The main screens are Notes and Settings; the same mobile interface is used in a wide Telegram desktop window.

Signing in and recovering access are different tasks

Telegram verifies which account a request belongs to. Decrypting records requires the application’s own keys. A Telegram ID or an active server session alone does not open the vault’s contents.

Creation generates a separate 24-word recovery phrase. It is tied to the vault’s identity and restores access through the application’s recovery flow. It is not your Telegram password or a phrase from an existing cryptocurrency wallet. Keep it somewhere other than the only device that currently opens your notes.

Subsequent access depends on the client environment. PIN unlock is implemented and requires a connection to the server. Where Telegram provides suitable protected capabilities, the app can retain access on the device and use biometric unlock. It checks actual capabilities instead of promising identical behavior in every browser and Telegram version.

The primary device has a separate recovery-phrase backup flow, which you can revisit in Settings. Hiding a backup reminder does not acknowledge that a backup actually exists. When protected storage is unavailable and access lasts only for the current session, closing the app without an external copy of the phrase can mean losing access.

Settings also lists trusted devices and lets you revoke them. Revocation stops the corresponding future server access; it does not erase copies already downloaded for offline use or replace protecting the recovery phrase itself.

Working with an unreliable connection

Saving a record first creates an encrypted local copy and an operation in the outgoing queue. A brief network interruption should therefore not force you to retype text that has already been saved locally. The client sends queued operations when connectivity returns. Local saving and completed server synchronization remain distinct states.

A retry sends the same operation so a network failure does not create an extra record. If versions conflict, the application must not silently overwrite a newer remote edit with its local copy. Access errors, network failures, quota exhaustion, and conflicts are handled separately.

The unsaved editor has its own encrypted local drafts. After an authorized unlock, you can restore or discard them. If the underlying record has changed, restoring a separate copy helps preserve both versions. This is not a promise to survive every abrupt process termination: the operating system can stop the application before the latest characters reach local storage.

Reopening without a connection uses a previously prepared public application shell and local encrypted data. A first launch without a prepared cache still needs connectivity. Offline availability also depends on the browser retaining its storage and on the chosen unlock method. PIN unlock requires internet access.

History without plaintext copies

Each record offers its current version and up to 32 previous server revisions. Historical content arrives encrypted and is opened on the device. Restoring a selected revision creates a new version rather than rewriting history with an old set of bytes.

This lets you undo an unwanted text change while keeping a clear sequence of revisions. The client checks for subsequent server changes or pending local operations before restoring. Revision history does not replace a backup of your keys: without the ability to decrypt them, earlier versions remain inaccessible too.

What the server stores

The client uses Next.js, React, and TypeScript; Go implements the API and MongoDB access. Protobuf and Connect define the contracts. Server-side rendering supplies the public shell, but receives no decrypted notes, recovery phrase, or private keys through page properties.

Text, titles, tags, card fields, filenames, and supported attachment contents are part of the encrypted record. Encryption uses AES-256-GCM. The server retains the technical information required to operate: identifiers, versions, sizes, permissions, and synchronization state. “Content is encrypted” therefore does not mean “the server sees no information.”

Protection also depends on the client and device. Malicious JavaScript inside the open application or a compromised operating system can access data that has already been decrypted. No independent security audit is claimed.

Current release boundaries

The bot currently opens the Mini App and responds to service commands. Forwarding a message to the bot does not yet save it as a note. Message capture, inline workflows, and collaboration are not listed here as shipped capabilities.

The account has a shared 10 MB budget. Attachments are limited to roughly 500 KB per record, with an exact combined limit of 512,000 bytes; this interface does not yet accept audio or video uploads. The app is intended for short personal records and small files, not unlimited media storage.