Two-step verification adds a password on top of the SMS login code. With it enabled, signing in requires both, so a code alone is not enough for anybody to take the account. It is the single most valuable setting in Telegram.
Turning it on
- Open Settings.
- Go to Privacy and Security.
- Choose 2-Step Verification.
- Set a password, and add a hint you will understand but others will not.
- Add a recovery email address and confirm it. Without one, a forgotten password cannot be reset.
Why an SMS code alone is not enough
SMS delivery is an industry standard because it is convenient, not because it is strong. A text can be intercepted, redirected by a carrier, read from a lock screen, or obtained through a SIM swap. If you have reason to doubt your carrier, or you operate somewhere the carrier can be leaned on, that single factor is the whole of your account security. A password closes it, because it is something the attacker has to obtain from you rather than from the network.
Practical notes
- Choose a password you can remember or store in a password manager. Recovery depends on the email address you set.
- The password protects the account and its cloud chats; it is not an encryption key you can lose data by forgetting.
- It also unlocks receiving the login code as a dictated phone call, which only works for accounts that have it enabled.
Set this up now rather than when something goes wrong. It cannot be added while somebody else is already inside the account, which is precisely when people go looking for it.
Updated