Is Telegram safe? What it encrypts and what it can share

Telegram describes itself as a messaging app "with a focus on speed and security," and more than a billion people use it. Whether it is safe depends on which kind of chat you are in, and most people are never in the encrypted kind. Everything below comes from Telegram's own FAQ and privacy policy, published cryptography research, and disclosure figures through mid 2026.

Is Telegram safe?

Telegram is safe from strangers on your network, but its regular chats are not end-to-end encrypted. Messages, groups and channels are stored on Telegram's servers, and Telegram holds the keys. Only Secret Chats, started by hand with one person on one device, are end-to-end encrypted. Under a valid court order, Telegram may disclose your IP address and phone number.

For casual chat and public channels, the main risks are scams and account theft, and a few settings cut both. Anything you would not want a company or a court to be able to read does not belong in a regular Telegram chat. Secret Chat content is out of Telegram's reach, with limits on where it works.

Is Telegram encrypted? Chat type by chat type

"Encrypted" covers two different things. Encryption between you and a server stops people on the Wi-Fi from reading along, but the server can read the message. End-to-end encryption means only the people in the conversation hold the keys.

Telegram's FAQ says it plainly: "Server-client encryption is used in Cloud Chats (private and group chats), Secret Chats use an additional layer of client-client encryption."

Three limits on Secret Chats matter in practice:

• They are manual. You open a contact's profile, tap the "..." menu, and choose Start Secret Chat. Nothing switches to a Secret Chat on its own.
• They are one-to-one. There is no Secret Chat for groups or channels.
• They are tied to one device. Telegram says a Secret Chat "will only be available on that device," and logging out deletes it. The mobile apps and Telegram for macOS have them. Telegram Desktop, the app most Windows and Linux users run, does not: the feature request has been open on the project's issue tracker since 2014.

Can Telegram read my messages?

For cloud chats, Telegram has the technical ability, because it stores the messages and holds the keys. Its privacy policy describes two cases where that ability is used: moderators "may check messages that were reported to them by their recipients," and Telegram "may also use automated algorithms to analyze messages in cloud chats to stop spam and phishing." The same policy says cloud chat content is not used for ad targeting.

Telegram's defense of this design is that cloud chat data sits in data centers in several jurisdictions and that "the relevant decryption keys are split into parts and are never kept in the same place as the data they protect," so several court orders from different countries would be needed to force access. That raises the legal bar without changing who holds the keys.

For Secret Chats, the policy says: "There is no way for us or anybody else without direct access to your device to learn what content is being sent in those messages."

Does Telegram give data to the police?

Yes, account data. This is the part that changed most, and it is dated.

August 2024. Founder Pavel Durov was arrested at Le Bourget airport near Paris and placed under formal investigation over criminal activity on the platform and Telegram's lack of cooperation with authorities.

September 2024. Telegram rewrote section 8.3 of its privacy policy. The earlier version covered terror suspects only. The current one reads: "If Telegram receives a valid order from the relevant judicial authorities that confirms you're a suspect in a case involving criminal activities that violate the Telegram Terms of Service, we will perform a legal analysis of the request and may disclose your IP address and phone number to the relevant authorities."

The numbers since. Telegram publishes them only through its @transparency bot, one country at a time. For the United States, BleepingComputer reported 14 fulfilled requests covering 108 users from January through September 2024, and 900 requests covering 2,253 users for the full year. A crowdsourced archive of the bot's reports, last updated on October 5, 2026, shows the following for the US:

Worldwide, 404 Media counted data on 22,777 users handed over in the first three months of 2025 alone. The archive is volunteer-collected, so treat country totals as a floor.

What is not in those numbers. Telegram's FAQ states: "To this day, we have disclosed 0 bytes of user messages to third parties, including governments." The disclosures above are phone numbers and IP addresses, which are enough to identify an account holder. Telegram's policy says it can keep IP addresses, device details and username history for up to 12 months.

The French case as of October 2026. The investigation is still open. Durov was allowed to leave France in March 2025, and investigators fully lifted his travel ban in November 2025. In July 2026 he was questioned by investigating judges for a fourth time, according to AFP reporting. His lawyers say there is no evidence for the charges.

Is Telegram's own encryption protocol secure?

Telegram uses its own protocol, MTProto, where most apps use TLS for the server connection. The current version is MTProto 2.0, built on AES-256, SHA-256 and 2048-bit Diffie-Hellman. It has been studied in public more than once:

• 2015, Jakobsen and Orlandi. Showed that the original MTProto did not meet a standard security definition (IND-CCA). They did not find a way to recover messages, and MTProto 2.0 later replaced the design they examined.
• 2020, Miculan and Vitacolonna. Machine-checked MTProto 2.0 with the ProVerif tool and proved its authentication, secrecy and forward secrecy properties, while finding one theoretical weakness in the rekeying step.
• 2022, Albrecht, Mareková, Paterson and Stepanovs. "Four Attacks and a Proof for Telegram", presented at the IEEE Symposium on Security and Privacy, found four weaknesses, including one that let a network attacker reorder messages. Telegram fixed them in mid 2021 app updates. The authors wrote that "for most users, the immediate risk is low," and proved that the corrected protocol provides a confidential, integrity-protected channel, with caveats about its unusual building blocks.
• 2026, Symbolic Software. A review made public in May 2026 found that the Android and desktop apps send a long-lived device identifier, auth_key_id, in a form any network observer can read. It does not expose message content, but it could let an internet provider or a state-level network observer follow one device across networks and locations. Telegram told reporters the identifier changes regularly and reveals nothing about users or messages. The reviewers dispute that for the builds they tested.

Nobody has published a way to decrypt Telegram traffic. The larger exposure is the storage model above.

Is Telegram safe from hackers and scammers?

Most people who lose a Telegram account are tricked, not hacked.

Account takeover. Telegram logs you in with a code sent by SMS or inside the app. Anyone who gets that code, by phishing you or by taking over your phone number, gets your cloud chats. Telegram's FAQ says login codes arrive in the verified "Telegram" service chat and "should never be shared with anyone."

Impersonation and investment scams. Fake support accounts, fake admins in crypto groups, and job offers that pay for small tasks and then ask for a deposit are all common. A stranger can message you if they have your number, find your username, or share a group with you.

Malicious files. Telegram allows files of up to 2 GB, and attackers use that. In July 2024, ESET documented "EvilVideo," an exploit that made a malicious Android app look like a video in a chat. Telegram patched it in version 10.14.5.

Private photos. In a regular chat, a photo is stored on Telegram's servers like any other message, and the recipient can save or forward it. In a Secret Chat it is end-to-end encrypted and can self-destruct, but Telegram itself warns there is "no bulletproof way of detecting screenshots."

Can people see my phone number on Telegram?

Telegram requires a phone number to sign up. By default, per the FAQ, "your number is only visible to people who you've added to your address book as contacts." A separate setting controls whether someone who already has your number can find your account with it, which is how strangers match numbers to profiles. Both are in step 3 below. Your display name, profile photos and username are always public.

A two-minute check you can run yourself

1. Open Settings > Devices. Every phone, computer and browser logged in to your account is listed. End any session you do not recognize.
2. Log in to Telegram on a second device. Your regular chats appear in full, because they were on the server all along. Any Secret Chat is missing, because it never was.
3. Open the @transparency bot (the one linked from section 8.3 of Telegram's privacy policy) to see the disclosure report for your own country.

How to make Telegram safer: 8 settings to change

Setting names are from Telegram's FAQ and app documentation as of October 2026. Labels differ slightly between platforms.

1. Turn on 2-Step Verification. Settings > Privacy and Security > 2-Step Verification. This adds a password on top of the login code, so a stolen SMS is not enough. Add a recovery email you control.
2. Set a passcode. The passcode option is also under Settings > Privacy and Security. It locks the app itself on a shared or unlocked phone.
3. Hide your number. Settings > Privacy and Security > Phone Number. Set "Who can see my phone number" to Nobody, then set "Who can find me by my number" to My Contacts.
4. Use Secret Chats for anything sensitive. Contact's profile > "..." > Start Secret Chat. Compare the encryption key picture with the other person, and set a self-destruct timer.
5. Limit what strangers see. In Privacy and Security, restrict who can see your last seen time and profile photo, who can call you, and who can add you to groups.
6. Set a default auto-delete timer. Settings > Privacy and Security > Auto-Delete Messages. New chats will clear themselves after the period you pick.
7. Review Devices every month. Settings > Devices. You can also add a passkey under Privacy and Security > Passkeys, which Telegram describes as more secure than SMS codes.
8. Clean up synced contacts. Settings > Privacy and Security > Data Settings lets you stop contact syncing and delete the contacts already uploaded.

No setting moves a group or channel off Telegram's servers. Write there as if the message could be read later.

The same question applies to your inbox

Telegram's cloud chats come down to who holds the keys to stored messages, and email works the same way. Most inboxes sit on the provider's servers in a form the provider can read. Secria Mail uses zero-access encryption for every message in your mailbox: your keys are created on your device and only reach our servers encrypted. Our guide on whether Signal is safer than email covers which jobs belong in a messenger and which belong in an inbox.

Frequently asked questions

Is Telegram end-to-end encrypted by default?

No. Regular chats, groups and channels use encryption between your device and Telegram's servers, and the messages are stored there. Only Secret Chats are end-to-end encrypted, and you have to start each one yourself.

Can the police read my Telegram messages?

Telegram's policy allows it to disclose an IP address and phone number under a valid judicial order, and it says it has never disclosed message content. Telegram cannot read Secret Chat content. Police who have your unlocked phone can read whatever is on it.

Are Telegram group chats encrypted?

They are encrypted in transit and in storage, with keys held by Telegram. They are not end-to-end encrypted, and there is no Secret Chat option for groups.

Is Telegram safe to use with strangers?

Treat every unexpected message as unverified. Hide your phone number, never share a login code, do not open files you did not ask for, and do not send money or crypto to anyone you met in a chat.

Telegram is a broadcast and community tool with one private mode attached. Use that mode when it matters, lock the account down, and give your inbox the same scrutiny with Secria Mail.