In this article
Telegram can lock itself behind a passcode that is not your Two-Step Verification password and has nothing to do with it. It takes half a minute to set up and it covers one specific set of situations extremely well.
Knowing which situations those are is the point. People turn it on believing they have secured their account, and they have secured a screen.
What you will be able to do after this step
- check_circle Set an app passcode with an auto-lock that engages on its own.
- check_circle Say which threats it covers and which belong to Step 008 instead.
- check_circle Close the two gaps that make a lock less useful than it looks.
- check_circle Explain why forgetting it has no recovery path.
lock A lock on this app, on this device
The passcode is in the privacy settings, and it does exactly what the name says: Telegram will not open on this device until it is entered. It can usually be satisfied with a fingerprint or a face instead of typing, which is what makes it survivable as a daily habit.
On a desktop it does something additionally useful. Step 003 described the session folder that sits on disk — the one that is your logged-in account, copyable by anybody with access to the machine. Turning on the local passcode encrypts that folder, so a copy of it is useless without the code. On a shared or work computer, that is the single most valuable thing on this page.
Two properties follow from it being local. It is per device, so setting it on a phone leaves a laptop open. And there is no recovery: nobody can reset it, because nobody else has it. Forgetting it means logging out of that installation and starting again — which costs you nothing in cloud chats and permanently destroys any Secret Chats on that device.
Four situations — which lock helps?
Two different protections exist and they almost never overlap. Pick a scenario and see which one is doing the work.
check_circle The passcode is the whole answer
rule And the gap
Exactly what this feature is for. Turn off previews at the same time or you have locked a door beside an open window.
check_circle It buys you time
rule But the real action is elsewhere
The passcode is the delay; the device list is the fix. Step 028 is the one to have read before this happens.
check_circle Where it does most
rule Better still
Essential if you must stay signed in. Not staying signed in is better, and Step 006 covers that route.
cancel The passcode does nothing
check_circle What does
This is the scenario people think the passcode covers. It does not. Step 008 does.
visibility_off The two gaps worth closing
A passcode with default settings around it is weaker than it feels, for two reasons that have nothing to do with the code itself.
Notification previews. A locked app still produces notifications, and a preview puts the message text on the lock screen where anybody standing nearby reads it without touching anything. If the reason for the lock is that people nearby should not read your messages, previews have to go too — and that is partly a Telegram setting and partly a system one.
The auto-lock delay. A lock that only engages when you close the app is a lock that is open precisely when you walked away without thinking. Set it to engage after a minute or two of inactivity. The friction is small because biometrics reopen it instantly; the coverage difference is enormous.
There is a third thing the app does for you, worth knowing because people are surprised when it stops: when you switch apps, Telegram obscures its own preview in the task switcher so your conversations are not on display while you flick between applications. That is automatic and needs no setting.
touch_app Try it now — five minutes
Four steps, and the second is the one that determines whether this is real protection or a decoration.
- Turn on the passcode where other people can reach the device A shared laptop, a household tablet, a work machine. On a phone that never leaves your pocket it is optional; on anything else it is not.
- Set auto-lock to a minute or two This is the setting that makes it work. Manual locking is a habit nobody keeps, especially on the day it would have mattered.
- Turn off message previews in notifications Otherwise the lock screen displays what the lock is hiding. Do it for the whole app, or per chat for the ones that matter.
- Enable biometric unlock — and rehearse the code once Type it deliberately today so you still know it in six months, because after a restart the face will not be enough.
psychology_alt The part nobody writes about: how a lock reads
Security advice usually stops at the technical answer. This one has a social half, and ignoring it is why plenty of people never turn the feature on.
A lock in front of a partner, a flatmate or a colleague is visible. It says, correctly, that there are things on this device you do not want them reading — and the fact that this is true of everybody does not stop it registering as a statement in a way that a device lock does not, because a device lock is universal and an app lock is chosen.
Two things make it much easier. The first is to lock the device rather than only the app where you can: a phone that locks itself covers the same ground without singling anything out. The second is to be straightforward if it comes up — the honest reason is usually that other people's messages are in there too, and they did not consent to being read by whoever picks up your phone.
The reverse is worth saying as well. If you would feel unable to put a lock on your own device, that is worth noticing for what it is. This is the one page in the curriculum where the correct configuration depends on something other than the software.
help Common questions at this stage
Is this the same as my phone's own lock screen?
No, and the difference is why it is worth having both. Your phone's lock protects the device from somebody who picks it up cold. Telegram's passcode protects the app from somebody using the phone while it is unlocked — handed over to show a photograph, left open on a table, borrowed for a call. That is a much more common situation than a stolen handset, and the device lock does nothing about it.
Can I have a different passcode on each device?
Yes, and you may well want to: a four-digit code on a phone you unlock constantly, something longer on a desktop you leave running. They are entirely independent, since each is local to its installation. The corollary is that setting one is not a job you do once — a new laptop starts with no lock at all.
Does the passcode encrypt my messages?
On a desktop it encrypts the local session and cached data, which is a meaningful protection against somebody copying that folder. It does not encrypt your history on Telegram's servers — that is a different layer entirely and not something a local code could reach. The distinction is the same one Step 025 drew: local protection guards this device; what the service can see is decided by whether a chat is a cloud chat or a Secret Chat.
What happens if somebody guesses wrong repeatedly?
Attempts are slowed down after failures, so guessing a short code becomes impractical rather than merely tedious, and biometric unlock stops being offered until the code is entered correctly. That is enough for the threat this feature addresses — a person with your phone for a few minutes — and it is why a four-digit code is not as weak here as it sounds.
Will my Secret Chats survive if I forget it?
No. Recovering from a forgotten passcode means logging out of that installation, and logging out ends every Secret Chat on the device permanently — there is no backup and no export, as Step 025 explained. Cloud chats come back the moment you sign in again, so for most people the cost is an inconvenience; if you keep anything in Secret Chats, the cost is that conversation.
Should I turn this on if I live alone?
On a phone, probably not — your device lock already covers you and the daily friction buys little. On a laptop, yes, because of the desktop session folder: an encrypted one is useless to malware that copies files, and an unencrypted one is a complete account. That asymmetry is the practical rule: passcode everything with a keyboard, decide case by case on things with a screen lock.
At a glance
- 1Set a passcode
Turn on Passcode Lock with an auto-lock time.
- 2What it covers
Someone picking up your unlocked device; not a login on another device.
- 3If you forget it
There is no recovery: log out, sign in again, and Secret Chats are lost.
Updated
