Telegram encrypts everything, but not all chats are encrypted in the same way, and the difference decides what the answer means for you. Secret Chats are end-to-end encrypted. Cloud chats are encrypted in transit and at rest.
The two modes side by side
| Cloud chat | Secret Chat | |
|---|---|---|
| Encryption | Client to server, and stored encrypted | End to end, device to device |
| Who holds the keys | Split between the service and its storage | Only the two devices |
| Syncs to your other devices | Yes | No |
| Survives a new phone | Yes | No |
| Self-destruct timer | No | Yes |
| Forwarding restricted | No | Yes |
Why cloud chats are the default
Because they can be restored. A message that exists only on one handset is gone when the handset is. The design limits what that convenience costs by keeping encryption keys and encrypted data in separate places under separate jurisdictions, so neither one on its own is enough to read anything.
What you control
- Turn on two-step verification. Settings, Privacy and Security. This is the single most valuable thing on the list, because the realistic attack on an ordinary account is someone obtaining the login code, not breaking encryption.
- Review active sessions. Settings, Devices. Terminate anything you do not recognise.
- Use a Secret Chat when the content warrants it. It costs nothing and takes two taps.
- Set who can see your number and last seen. Privacy settings decide how much a stranger learns from your profile.
The apps are open source and builds are reproducible, so the claim that the app does what it says can be checked rather than believed. That is a meaningfully different position from a closed application making the same promise.
Updated