Is Telegram safe? Tips to protect your privacy

If you’re wondering whether Telegram is safe to use, especially after all the headlines about its CEO, you’re not alone.

Telegram is a cloud-based messaging app with open-source apps, popular with privacy-minded users. In August 2024, its CEO, Pavel Durov, was arrested in France in an investigation into criminal activity on the platform, and many users now ask whether Telegram is trustworthy and whether it’s suitable for kids.

In this blog, we’ll explain how Telegram’s security works, where its weak spots are, which scams to watch for, and which settings help you use it more safely.

Is Telegram safe to use?

Telegram is generally safe for everyday messaging, as long as you understand what it does and doesn’t protect. It offers large groups and broadcast channels, one-to-one secret chats, and file sharing of up to 2 GB per file (4 GB with Premium). Its encryption is built on Telegram’s own protocol, MTProto. If you also convert files online, read is CloudConvert safe.

The key point most people miss: regular Telegram chats are not end-to-end encrypted. They are encrypted between your device and Telegram’s servers and stored there so you can open them on any device. Only secret chats and calls use end-to-end encryption.

How safe is Telegram for user privacy and security?

Telegram’s security isn’t flawless, but it offers privacy controls that are rare among mainstream messaging apps. Here is what works in its favor.

1. MTProto Encryption Protocol

Telegram encrypts all traffic between your device and its servers with MTProto, its custom protocol based on 256-bit AES, 2048-bit RSA and Diffie-Hellman key exchange, according to the Telegram FAQ. The current version, MTProto 2.0, has been studied by academic researchers. A 2021 formal analysis found the core design sound but flagged a weakness in its rekeying step (Miculan and Vitacolonna).

Telegram also ran public cracking contests. The last one offered $300,000 to anyone who could decrypt a secret chat, and it ended in February 2015 with no winner. A contest with no winner is not the same as an independent audit.

2. End-to-end encryption (in secret chats and calls)

Telegram offers end-to-end encryption (E2EE), where not even Telegram can read the content, in Secret Chats and in voice and video calls, including group calls.

Secret chats are one-to-one only, tied to the device where you started them, and not stored in the Telegram cloud. They are available in the mobile apps and the native macOS app, but not in Telegram Desktop for Windows and Linux or in Telegram Web.

3. Two-step verification (2FA)

Two-step verification adds a password, so anyone logging in needs both the login code and your password. Telegram also supports passkeys, which let you log in with your device’s PIN, fingerprint or face scan instead of an SMS code (Telegram FAQ).

4. Self-destructing accounts, messages and media

You can set messages to auto-delete, send media with a self-destruct timer, and have your account deleted if you stop using it for a set period.

5. User-controlled privacy settings

You decide who can see your phone number, find you by it, add you to groups, call you, and see your photo and last-seen status. Controlling these settings can help you stay safe from spammers and hackers.

6. Open-source client code

Telegram’s apps are open source, and Telegram offers reproducible builds for iOS and Android, which let experts check that the app in the App Store or Google Play was built from the published code (Telegram FAQ). The server-side code, however, remains closed.

So is the Telegram app safe to use? Yes, for privacy-aware users who understand its limits and turn on its security features.

What makes Telegram unsafe?

Experts’ main concern is that Telegram’s default chats are stored on its own servers in a form the company can decrypt, which leaves your privacy and security vulnerable if you assume otherwise. Many users think Telegram is fully encrypted by default, which isn’t true.

1. End-to-end encryption is not default

Regular one-to-one chats, groups and channels are not end-to-end encrypted. E2EE is only available in secret chats, which you have to start manually, and there are no end-to-end encrypted group chats.

2. Confidential server framework

Telegram’s server infrastructure is proprietary, so researchers cannot verify how data is handled once it reaches Telegram’s servers.

3. No full independent audit of the server side

Telegram’s server infrastructure has not had a full, published independent security audit. What does exist is academic cryptanalysis of its protocol. In 2021, researchers from Royal Holloway and ETH Zurich reported four issues in MTProto 2.0 and Telegram’s apps, including a message reordering attack and timing side channels in three official clients. Telegram fixed them and paid bug bounties. The researchers said the immediate risk for most users was low, but that Telegram fell short of the guarantees offered by well-studied protocols like TLS (Four Attacks and a Proof for Telegram, IEEE S&P 2022).

4. Custom encryption protocol (MTProto)

MTProto is used almost only by Telegram, so it has had far less scrutiny than widely used standards such as the Signal Protocol. The earlier version, MTProto 1.0, was shown to have theoretical weaknesses (Jakobsen and Orlandi), and Telegram replaced it with MTProto 2.0 in 2017.

5. Chat data accessible to Telegram

Your regular chats, groups, supergroups and channels are stored on Telegram’s cloud servers. Telegram says this data is stored encrypted, in data centers across different jurisdictions, with the decryption keys split up and kept apart from the data (Telegram FAQ). That makes legal and physical access harder, but Telegram still holds the keys, so the company can technically access cloud chats, even if it says it doesn’t read them.

6. Your IP address and phone number can be shared with authorities

In September 2024, Telegram updated its privacy policy. It now says that if Telegram receives a valid order from judicial authorities confirming you are a suspect in a criminal case, it may disclose your IP address and phone number. Before this change, the policy limited such disclosures to terror suspects (BleepingComputer).

Is Telegram safe from hackers and scams?

Most Telegram “hacks” trick the user rather than break the encryption. Research shows that Telegram has been used in fraud cases, including investment scams and illicit marketplaces.

Fake investment and crypto channels

Scammers run channels that promise guaranteed profits, “VIP signals” or trading bots, post fake earnings screenshots, and push you to deposit money on a platform they control.

How to spot it: guaranteed or very high returns, pressure to act fast, requests to pay in crypto, and “withdrawal fees” you must pay before getting your money back.

Impersonation of people and channels

Scammers copy the name and photo of a real channel, public figure or friend, use a near-identical username, and ask for money or a crypto transfer.

How to spot it: check the exact username (@name), not just the display name. Official channels and public figures usually have a verified badge. If a friend asks for money, confirm through another channel, such as a phone call. If someone is impersonating you, Telegram asks you to report it to @NoToScam.

Fake support accounts

Accounts called “Telegram Support” or “Admin” message you to say your account is flagged or about to be deleted.

How to spot it: Telegram doesn’t contact you through random private accounts. Official service messages come from the verified “Telegram” service chat in your chat list.

This is the most common way accounts get taken over. You receive a login code you didn’t request, then someone asks for “the code you just got,” sends a fake login page, or asks you to scan a QR code to “verify” your account. Doing any of these logs them into your account.

How to spot it: nobody legitimate will ever ask for your login code. Telegram says login codes are sent to the official “Telegram” service chat and should never be shared with anyone (Telegram FAQ).

If you think your account was compromised, go to Settings → Devices, end any sessions you don’t recognize, and turn on two-step verification right away.

Is Telegram safer than WhatsApp?

Not by default. WhatsApp encrypts all personal and group chats end-to-end using the Signal Protocol, while Telegram only does so in secret chats and calls. Telegram’s advantages are elsewhere: open-source apps, more control over who sees your phone number, and usernames that let you chat without sharing your number.

Feature	Telegram	WhatsApp
End-to-end encryption by default	No. Only secret chats (one-to-one) and calls	Yes, for all personal chats and calls
Group chat E2EE	No (group calls are E2EE)	Yes
Can the company read regular chats?	Technically yes, cloud chats are stored with keys Telegram holds	No, message content is E2EE
Metadata	Collects metadata such as your IP address and devices; may disclose IP and phone number on valid legal orders	Collects metadata such as your phone number, contacts and usage, shared within Meta per its privacy policy
Phone number required	Yes, but you can hide it and chat with a username	Yes; optional usernames began rolling out in 2026
Open-source apps	Yes, with reproducible builds on iOS and Android	No
Backups	Cloud chats sync automatically (not E2EE); secret chats are not backed up	Optional end-to-end encrypted backups to iCloud or Google Drive

In short, WhatsApp protects message content better by default, while Telegram gives you more options for hiding your phone number. Both collect metadata and can see your IP address when you connect.

Why is Telegram controversial?

Telegram has been used for everything from political organizing in Iran and Belarus to communication in war zones like Ukraine. Its light content moderation also lets misinformation, hate speech and illegal activity spread with less oversight than on other major platforms. Creator platforms raise similar questions; see is OnlyFans safe.

That moderation approach is at the center of the case against Pavel Durov. He was arrested at Le Bourget airport near Paris on August 24, 2024, and on August 28 French judges charged him on 12 counts, including complicity in running a platform that enabled illegal transactions, drug trafficking and the distribution of child sexual abuse material, and refusing to cooperate with authorities (TechCrunch). Durov denies wrongdoing. French judges lifted his travel restrictions in November 2025, and as of September 2026 the investigation is still open with no trial date announced (TechPolicy.Press).

Is Telegram safe for kids?

Telegram is not designed for children. Its terms of service require users in the EU to be at least 18, public channels with adult content are easy to find, and strangers can message users unless settings are changed. If a teenager in your home uses Telegram, set these up together:

Phone Number: set “Who can see my phone number” to Nobody and “Who can find me by my number” to My Contacts.
Groups & Channels: set “Who can add me” to My Contacts, so strangers can’t pull them into groups.
Calls: set “Who can call me” to My Contacts.
Profile photo and Last Seen: limit these to My Contacts.
Username: skip a public username, since anyone who finds it can send messages.
Passcode lock: add a passcode under Settings → Privacy and Security.
Two-step verification: turn it on so a stolen login code isn’t enough to take over the account.

All of these are under Settings → Privacy and Security. Pair them with Screen Time (iPhone) or Google Family Link (Android), and teach your child never to share login codes, photos or personal details with strangers.

Tips on how to protect your privacy on Telegram?

Telegram’s default settings are not the most private. Adjust these key settings and habits:

1. Use secret chats

Use secret chats for sensitive conversations so your messages are end-to-end encrypted. Secret chats don’t allow forwarding, support self-destruct timers, and stay on the device where you started them. Here’s how you can start a secret chat on Telegram:

Open the app → select the contact’s name.
Tap the three dots.
Tap Start Secret Chat.
Tap the clock icon in the text field to set a self-destruct timer for messages. Auto-delete timers are also available for regular chats.

2. Enable two-step verification

Here’s how to turn it on:

Open the Telegram app and go to Settings.
Tap Privacy and Security → Two-Step Verification.
Set a strong password and an optional hint.
Add a recovery email. Telegram sends a confirmation code to that email address to finish setup.

Don’t skip the recovery email: without it, a forgotten password can lock you out of your account.

3. Use VPN to hide IP address

Telegram, and anyone you call peer-to-peer, can see your IP address. A VPN like EonVPN helps:

Hide your IP address from Telegram and other services you connect to.
Encrypt the connection between your device and the VPN server with AES-256-GCM over the OpenVPN protocol, which protects you from local network snooping and ISP monitoring.
Keep DNS lookups inside the tunnel. On Windows, EonVPN also includes DNS leak protection.

A VPN does not make your Telegram chats end-to-end encrypted, and it doesn’t stop Telegram from storing cloud chats. For calls, also go to Settings → Privacy and Security → Calls → Peer-to-Peer and set it to Nobody (called Never in some app versions). Telegram will then relay calls through its servers instead of revealing your IP address to the other person.

4. Review privacy and security settings

In Settings → Privacy and Security, restrict who sees your number, photo and last-seen status, and who can add you to groups. Check Settings → Devices now and then and end sessions you don’t recognize.

5. Delete messages for everyone

In private chats, secret or regular, you can delete any message for both sides at any time, with no time limit.

Tap and hold the message you want to delete.
Tap Delete from the menu.
Choose “Delete for me and [recipient’s name].”
Tap Delete again to confirm.

6. Send self-destructing media files

Is Telegram secure for sending private photos? Secret chats are the safest option. In regular chats, you can send photos and videos with a self-destruct timer so they disappear after viewing.

Tap the paperclip icon to attach media.
Choose a photo or video.
Tap the clock icon before sending.
Set the timer and send. The media will auto-delete after viewing.

The other person can still photograph their screen with another device. You can also set a default timer in Privacy and Security → Auto-Delete Messages.

Telegram can delete your account if it stays inactive for a set period, a useful last resort if you lose access. Don’t set it too short, or you could lose your account before you notice.

Open the app and go to Settings.
Go to Privacy and Security → If Away For.
Set it to your preference.

8. Be cautious of bots, strangers, and spam

Anyone can create a Telegram bot, and bots can be used for phishing or spreading malware. Avoid unfamiliar bots, especially ones that ask you to log in, connect a wallet or share a code.

Don’t accept messages, calls or group invites from strangers, and block and report suspicious senders.

Conclusion

Is Telegram a safe app? It depends on how you use it. Regular chats are not end-to-end encrypted, Telegram can technically access them, and since 2024 it may share your IP address and phone number with authorities on valid legal orders. Researchers have studied its encryption and the issues they found were fixed, but its servers have never had a full independent audit.

Telegram can still be used safely: use secret chats for sensitive conversations, turn on two-step verification, lock down your privacy settings, and learn to spot common scams.

FAQs

Why is Telegram a red flag?

Some people see it as a privacy or safety concern because of its light content moderation, its use by criminal and extremist groups, and the lack of end-to-end encryption in standard chats.

Is Telegram’s secret chat safe?

Yes. Secret chats use end-to-end encryption, aren’t stored on Telegram’s servers, don’t allow forwarding, and support self-destructing messages. They only work one-to-one and only on the device where you started them.

Is Telegram untraceable?

No. Telegram knows your phone number and IP address, and its privacy policy allows it to share them with authorities in criminal cases. Cloud chats are also stored on its servers.

Is the Telegram app used for scams?

Yes. Common Telegram scams include fake investment and crypto channels, impersonation of friends or public figures, fake support accounts and login-code phishing.

Why do people use Telegram?

People use Telegram for its speed, large file sharing, big groups and channels, and privacy options.