In this article
Telegram has two separate locks and they protect against different things. A cloud password stops someone signing in as you from another device. A passcode lock stops someone reading the app on the phone in their hand.
Setting one and assuming you are covered is the common mistake. The clip shows both switches; below is which threat each one actually answers.
What you will be able to do
- check_circle Set a cloud password so an intercepted SMS code is not enough to take your account.
- check_circle Attach a recovery email, and understand what happens if you skip it.
- check_circle Add a local passcode with biometric unlock for the device itself.
- check_circle Say which of the two protects you in a given situation, rather than guessing.
Both settings live under Privacy and Security, one above the other — which is part of why they get confused.
lock Two locks, two different doors
Signing in to Telegram normally needs one thing: a code sent to your phone number. Anyone who can receive that code can become you on a new device. That is the entire attack behind SIM swapping, and it does not require touching your phone.
The cloud password is a second factor that lives on the account. With it set, the code alone is refused. It is asked for only when a new device signs in, so it does not appear in daily use and is easy to forget you have — which is why the recovery email matters.
The passcode lock is unrelated. It sits in front of the app on one device, using a PIN or your fingerprint or face. It does nothing at all for the account; someone signing in from a laptop never sees it.
Which lock saves you
Four situations. In each, one of the two protects you and the other does nothing — which is the argument for having both.
sim_card Someone takes over your phone number
phonelink_lock Your unlocked phone is taken
help You forget the cloud password
They are not alternatives: the cloud password guards the account, the passcode guards the handset.
settings Setting both
- Open Privacy and Security Settings, then Privacy and Security. Both controls are on this screen.
- Set the cloud password Two-Step Verification, then Set Additional Password. Use something long that you do not use elsewhere; the hint is shown to whoever is trying to sign in, so it should mean nothing to a stranger.
- Attach the recovery email Telegram sends a code to confirm it. Do this now — it is the difference between a forgotten password being an inconvenience and being the end of the account.
- Add the passcode lock Back on the same screen, Passcode Lock. Set a PIN, then turn on Face ID or fingerprint so you are not typing it constantly.
timer The waiting period is a feature
If you have no recovery email and no password, resetting the account is possible but deliberately slow. The delay exists so that someone who has taken your phone number cannot simply wait you out in an afternoon — you get days of warning, during which you can cancel the reset from any device still signed in.
That protection has a cost, and the cost is yours if you are the one locked out. It is another way of saying the same thing: attach the email.
This page is the two switches. The curriculum step covers the account's security surface as a whole: sessions, recovery, and what an attacker can and cannot reach at each layer.
At a glance
- 1Cloud password
It stops a stolen SMS code from being enough to sign in.
- 2Recovery email
Without one, a forgotten password means a long wait to reset.
- 3Passcode lock
It protects the device in your hand, not your account elsewhere.
Updated
