Transport layer
Every request between your device and Telegram data centres runs over MTProto 2.0. Client-server communication is authenticated with rolling keys negotiated during the initial handshake.
Security architecture
How Telegram keeps your chats private
Telegram wraps your account in multiple layers of encryption and authentication. This page explains what runs where, and how you can tune the defaults for a hardened setup.
Three encryption layers, one messenger
Regular cloud chats already receive strong protection. Opt-in secret chats add an additional end-to-end layer for the strictest use cases.
Cloud storage
Server-stored chats are encrypted at rest and split across data centres in different jurisdictions so no single facility holds a complete copy of your data.
End-to-end secret chats
Opt-in secret chats add a second, device-to-device encryption layer on top. Only the two devices involved can decrypt the messages, and even Telegram cannot read them.
Account controls
Personalise every safety toggle
Telegram offers a rich privacy menu. From lock screens to self-destruct policies, every setting is opt-in and easy to revert.
Two-step verification
Add a cloud password on top of the SMS code so new logins require both pieces. Enable it from Settings → Privacy and Security → Two-Step Verification.
Passcode & biometrics
Lock the entire app or specific chats behind a PIN, Face ID, Touch ID, or Android biometrics. Auto-lock kicks in after a configurable idle period.
Active sessions review
Settings → Devices shows every desktop, web, or mobile session tied to your account. Terminate any of them with a single tap if you spot something suspicious.
Self-destruct policy
Set a global self-destruct window - if you do not log in for the chosen number of months, your account and all chats are deleted automatically.
Post-install security checklist
Complete these six steps within your first day on Telegram for a hardened baseline.
- 1
Verify installer signatures on Windows, macOS, and Android
- 2
Enable two-step verification and store your recovery email
- 3
Configure a passcode with Face ID, Touch ID, or biometric fallback
- 4
Review active sessions monthly and terminate unknown devices
- 5
Turn on Auto-Delete for sensitive conversations
- 6
Restrict who can find you by phone number and see your last seen
Transparency & open code
Every Telegram client is open source under GPL/MIT-compatible licences. Independent researchers audit the code, contribute patches, and receive rewards through the Telegram bug bounty programme. Transparency reports outline data requests from governments.
- · Bug bounty rewards up to $300,000 per finding
- · Reproducible builds for desktop and Android
- · Public GitHub org: github.com/telegramdesktop and TDLib