Security overview
A plain-English tour of Telegram's protection layers — MTProto 2.0 transport, encrypted cloud storage, secret chats, two-step verification and per-device passcodes. If you install one thing from this page, make it a cloud password.
Four layers of protection
Rather than one giant claim, Telegram uses four distinct layers. Each covers a specific threat model. Here is what they do — and what they do not.
Every cloud message is wrapped in Telegram's proprietary MTProto 2.0 protocol with perfect forward secrecy between your client and the closest data-centre.
Cloud chats rest encrypted inside Telegram's server infrastructure. Encryption keys are split across data-centres in different jurisdictions to make coercion impractical.
Secret chats layer true end-to-end encryption on top of MTProto. They only exist on the two devices that started them and can self-destruct after a configurable timer.
Add a cloud password on top of your login code so a stolen SIM card is not enough to hijack your account. A recovery email lets you regain access if you forget the password.
Five-minute hardening
These are the exact settings we walk every new user through. Follow them once per device and you cover the vast majority of realistic attacks — SIM swap, credential leaks and lost devices.
Step 1. Turn on two-step verification
Settings → Privacy and Security → Two-Step Verification. Pick a strong cloud password and add a recovery email in case you forget it.
Step 2. Enable a passcode & biometrics
Settings → Privacy and Security → Passcode & Face ID / Fingerprint. Choose an auto-lock timer that matches your risk profile — one minute is a good default.
Step 3. Review active sessions
Settings → Devices. Terminate old browser sessions, name each active session and enable a session timeout so old logins expire automatically.
Step 4. Tune privacy defaults
Settings → Privacy and Security. Restrict who can see your phone number, last-seen timestamp, forwarded messages source, invite you to groups and call you.
Step 5. Enable auto-delete on sensitive chats
Long-press a chat → Clear History → Enable Auto-Delete. Pick 24 hours, 7 days or 1 month. Perfect for one-off financial or medical conversations.
Privacy controls
Telegram exposes granular privacy settings for every piece of identifying data. Here are the four we tweak most often — each has per-contact exceptions so you keep your closest people close.
Hide your phone number from strangers, contacts or both. Sign-in codes still work through your existing contacts and your @username.
Show last-seen only to contacts, everyone, or nobody. Use custom exceptions to whitelist your closest people even when you go global-private.
Prevent messages you send from being forwarded with your name attached — the recipient can share the text but never link it back to your profile.
Toggle NSFW content on public channels or leave it filtered by default. Independent from personal chats and communities you have already joined.
Print or screenshot this list. If every line is ticked on every device, your Telegram account is meaningfully harder to hijack than the average social profile.