In this article
Telegram publishes its client code openly, which is one of the reasons it is trusted. It also means anybody can take that code, change a few lines, rebuild it, and hand you an app that looks exactly like the real one and quietly forwards your login to somebody else.
This step is therefore not really about downloading. It is about the short list of places the app should come from, and the two or three checks that make a tampered build obvious.
What you will be able to do after this step
- check_circle Name the official source for Telegram on every platform you use, without searching for it.
- check_circle Explain why a modified build is dangerous in a way that a modified web browser is not.
- check_circle Tell the difference between a warning that is routine and a warning that means stop.
- check_circle Check who signed a desktop installer before you run it.
rule One rule removes most of the risk
Telegram is free. Not free with a paid tier for basic use, not free after a trial — the app itself costs nothing and always has. Telegram Premium exists, but it is an optional subscription bought inside the app, and it changes limits rather than unlocking the messenger.
That single fact rules out an entire category of traps at a glance. A page that wants a payment for the installer, a survey before the download begins, a phone number to receive the file by SMS, or that offers Premium already unlocked, is not a distribution channel that got greedy. It is the whole point of the site.
The second half of the rule is just as short: get the app from Telegram's own domain or from the app store built into your device. Both are places where the publisher is verifiable. Everywhere else — software catalogues, download portals, APK archives, a link in a chat — is a copy of unknown provenance, even when the file it hands you happens to be genuine today.
devices The official sources, in one place
Everything below is reachable from telegram.org/apps, which is worth bookmarking now so that you never have to search for it again. The right-hand column is what actually differs between them, because on several platforms there is more than one legitimate answer.
| Platform | Official source | Publisher shown | What is different about it |
|---|---|---|---|
| Windows | desktop.telegram.org, or the Microsoft Store | Telegram FZ-LLC | The website offers an installer and a portable build; the Store version is sandboxed and can lag slightly behind on new features. |
| macOS | macos.telegram.org, or the Mac App Store | Telegram FZ-LLC | These are two genuinely different applications rather than two copies of one. Step 004 covers which to choose. |
| Android | Google Play, or telegram.org/android | Telegram FZ-LLC | The direct download is a plain APK file and updates itself; the Play version updates through the store. |
| iPhone and iPad | The App Store only | Telegram FZ-LLC | There is no sideloading route and no second edition. Anything offering one is a scam. |
| Linux | desktop.telegram.org, Flathub, or Snap | Telegram FZ-LLC / org.telegram.desktop | Three packaging formats of the same client, differing in sandboxing. Step 005 covers the trade-off. |
| Any browser | web.telegram.org | — | Nothing is installed at all, which makes it the right answer on a computer that is not yours. |
security What a tampered build actually does
It helps to be specific about the danger, because "malware" is vague enough to be ignored. A modified Telegram client is not trying to slow your computer down. It is sitting in the one place where your account is unlocked.
The straightforward version copies the login. Once a client is signed in, it holds a session that can read your entire cloud history and send as you — that is what Step 001 established, and it cuts both ways. A build that quietly reports its session details to somebody else has handed them your account, and nothing on screen will look unusual.
The desktop variant often adds a clipboard watcher: every time you copy a long string that looks like a cryptocurrency address, it substitutes a different one before you paste. People lose money to this without ever seeing an error, because the thing that failed was the copy, not the transfer.
And the "free Premium" version cannot possibly work as advertised. Premium is validated on Telegram's servers against a real subscription; no app on your phone can grant it. The offer exists to make you install something, and what you install is a credential harvester with a Telegram logo.
Android warns that "this type of file can harm your device" when you download the APK from telegram.org. What does that tell you?
It is a generic notice about the category of file, shown before anything has been examined. The thing that makes the download safe is not the absence of a warning, it is that the address you typed was Telegram's own. This is exactly why warnings are a poor substitute for knowing your source.
Windows SmartScreen blocks a freshly downloaded Telegram installer and says the publisher is unknown. What now?
SmartScreen does sometimes flag a genuine new release before it has built a reputation, and in that case the dialogue still names the publisher correctly. A signed Telegram build is never published by "unknown" — that word means the file carries no valid signature, and no amount of clicking will make it safe. Delete it and download again from the official address.
A well-known software catalogue offers Telegram Desktop and the file it serves is genuinely unmodified. Is using it fine?
The reasoning runs backwards: you would need to have already verified the file to know the site was trustworthy. Catalogues also commonly wrap downloads in their own installer and serve whatever version they last mirrored, which may be months old. The habit — official domain or built-in store — is what protects you, not a judgement about any individual site.
task_alt
fingerprint Checking the signature yourself
On a desktop computer you do not have to take the download on faith. Both Windows and macOS attach a cryptographic signature to installers, and looking at it takes less time than reading this paragraph.
On Windows, right-click the downloaded installer, choose Properties, and open the Digital Signatures tab. There should be one entry, and the signer should be Telegram's own company name — Telegram FZ-LLC on current builds. Select it, click Details, and the dialogue should state that the signature is valid. If the tab is missing entirely, the file is unsigned and there is nothing further to consider.
On macOS the check is built into opening the file. Gatekeeper verifies that a downloaded application is signed by a registered developer and has been notarised by Apple. The dialogue that appears the first time you open an app from the internet is routine; a warning that the developer cannot be verified, or that the app is damaged, is not.
Neither check proves that the software is good, only that it is the file its publisher built and that nothing altered it in transit. That is precisely the property you want, because everything described in the previous section requires altering it.
touch_app Try it now — five minutes
Three small actions that turn this step from something you read into something already configured.
- Bookmark telegram.org/apps Not a search, not a link somebody sent you. Every future install and every time you help a friend set this up begins from that bookmark, and the decision is already made.
- Check what is already installed On a desktop, right-click the Telegram executable or application and look at the publisher. On Android, open the app's entry in the Play Store or your settings and see whether it came from the store or from a file. You want to know this now, not after something goes wrong.
- Open web.telegram.org once Sign in with the QR code from Settings, then Devices. It is the client you will reach for on a borrowed computer, and it installs nothing — but you want to have used it before the moment you need it. Step 006 covers it properly.
help Common questions at this stage
Is the direct Android APK safe, or is the store version safer?
Both are official and both are safe when they come from the right place. The practical differences are in updating: the direct build updates itself and reaches you as soon as Telegram releases it, while the store build updates on the store's schedule and runs under the store's sandboxing rules. The direct route asks you to allow installation from outside the store, which is a permission worth turning off again afterwards. If you have no particular reason to want the newest release the day it appears, the store is the simpler choice.
My phone already had Telegram on it when I bought it. Should I be worried?
On a phone bought new from a reputable seller, no — preloaded apps come through the manufacturer's own process. On a second-hand phone it is worth reinstalling from the store regardless, along with a factory reset, because a phone that somebody else configured is a phone whose software you did not choose. That advice has nothing to do with Telegram specifically; it applies to everything on the device.
Somebody sent me a modified Telegram that adds features. Is that the same thing as a fake?
Not necessarily, but the distinction matters less than it sounds. There are genuine third-party clients written by people with no bad intent, published openly, used by plenty of technical users. The problem is that you are not in a position to tell those apart from the malicious ones, and the cost of being wrong is your whole account rather than a bad app experience. Until you can read the source yourself or know the publisher personally, treat "modified Telegram" as a category to decline.
Can I have Telegram on several devices at once, or do I have to pick one?
Several, and this is the normal way to use it. Each installation signs in as its own session on the same account and receives the same history from the servers, as Step 001 described. There is no primary device and no pairing — a laptop client keeps working with the phone switched off. The only thing to keep an eye on is the list of signed-in sessions, which Step 028 covers.
How do I know an update is genuine?
Updates that arrive through the app itself or through an app store inherit the trust of the original install, because both verify that the new version is signed by the same publisher. What should make you stop is an update offered anywhere else: a message in a chat linking to a new version, a web page telling you your client is out of date, an email with an installer attached. Telegram does not distribute updates that way, and neither does any app store.
Does the web version leave anything behind on a shared computer?
It keeps your session in the browser, which is exactly what you would expect and exactly what you must remember to end. Signing out from within the web client removes it, and if you forget, you can terminate that session from any other device through Settings and Devices. On a machine that is not yours, a private browsing window plus an explicit sign-out is the combination worth making habitual.
At a glance
- 1Official sources
telegram.org/apps, desktop.telegram.org, Google Play and the App Store.
- 2Modified builds
A fake client sees every message you type and can take over the login.
- 3Check the signer
A Windows installer should be signed by Telegram FZ-LLC; an unknown publisher means stop.
Updated
