In this article
Your phone already has a lock screen. The Telegram passcode is a second one, in front of this app only, for the ordinary situation where the phone is unlocked and in somebody else's hands.
Setting it takes a minute. The parts worth reading are the auto-lock interval, which decides whether it protects anything in practice, and the fact that a forgotten passcode has no recovery at all.
What you will be able to do
- check_circle Set a passcode with biometric unlock, on a phone and on a computer.
- check_circle Choose an auto-lock interval that is short enough to matter.
- check_circle Lock the app instantly when you are handing the phone over.
- check_circle Close the gap the passcode leaves wide open: your notifications.
The padlock at the top of the chat list is the manual lock — one tap, before you pass the phone across the table.
lock What it locks, and where
The passcode is entirely local. It lives on the device you set it on, it is not stored on Telegram's servers, and it has no effect on your account: the same account on your laptop is unaffected by the passcode on your phone.
While the app is locked its local data is encrypted with a key derived from the passcode, so the message cache is not readable by pulling the files off the device. Unlocking decrypts it again. That is the entire mechanism, and it is a good one for the threat it addresses.
The threat it addresses is a person, not a laboratory: someone borrowing your unlocked phone, a colleague at your desk, a shared computer. For anything about your account — someone signing in as you from another device — the control is the cloud password, which is a different setting on the same screen.
What the passcode does and does not cover
Four situations people expect it to handle. It handles one of them completely, one partially, and two not at all.
phone_iphone Someone is holding your unlocked phone
notifications_active Messages appearing on the lock screen
devices Someone signs in as you on their own device
help You cannot remember the passcode
Two settings, not one: the passcode locks the app, turning off previews locks what the app is allowed to announce.
timer The interval is the whole setting
Auto-lock offers a range from about a minute up to several hours. The number decides whether any of this does anything, because a passcode on an app that is never locked protects nothing.
A minute is the honest choice for a phone. It is short enough that stepping away and coming back finds the app locked, and biometric unlock makes the cost close to zero — you look at it and you are in. If you are typing the code by hand every time, you chose the interval before you turned on Face ID or the fingerprint reader; turn that on and the short interval stops being annoying.
Longer intervals suit a desktop you leave running in a locked office. They suit a phone much less well, because the phone is the device that ends up in other people's hands.
settings Setting it up
- Open Privacy and Security Settings, then Privacy and Security. On iOS the entry is called Passcode & Face ID.
- Turn the passcode on A four-digit PIN by default; the options let you use a longer alphanumeric one instead, which is worth it on a desktop.
- Set the auto-lock interval The shortest one you can live with. A minute, with biometrics on.
- Enable Face ID or the fingerprint reader Same screen. This is what makes a short interval bearable.
- Turn off message previews Settings, Notifications. Different screen, and the half of this that people skip.
- Learn the padlock It appears at the top of your chat list once a passcode is set. One tap locks the app immediately, whatever the timer says.
This page is the setting and its blind spots. The curriculum step covers the layer underneath: how the local database is protected, what an attacker with the device can and cannot extract, and where this sits among the other defences on the account.
At a glance
- 1Set a passcode
Add biometric unlock on a phone or computer.
- 2Short auto-lock
A long delay leaves the app open when it matters.
- 3Lock notifications too
Hide message previews, which a passcode does not cover.
Updated
