How to Check Active Sessions in Telegram

devices Why this list is the account

Step 024 explained that every client signs in independently and needs nothing from your phone afterwards. The convenient consequence is that a dead battery costs you nothing. The other consequence is this screen.

A session is not a login you renew. It persists until something ends it — you, from here, or an inactivity rule you set. Nobody is asked for a password again, because that is the point of staying signed in.

And because the history lives on the servers, a session does not merely receive new messages. It has everything: years back, searchable, downloadable. That is the whole reason to read this list occasionally rather than after something has gone wrong.

rule Reading a session entry

Each line tells you something, and each has a limit worth knowing before you draw a conclusion from it.

Two practical readings come out of that. First, the entry that matters is the one you cannot account for at all — not the one in an unexpected city. Second, terminating is cheap: a device you actually use simply asks you to sign in again, so there is no penalty for being wrong and no reason to leave a doubtful entry in place while you think about it.

notification_important The message that tells you it happened

Whenever a new session is created, Telegram sends a message about it to your account from its own service chat — the device, roughly where from, and when. That chat is official and it is the one place a login notice legitimately appears.

It is worth knowing the shape of a real one, because impersonating it is a standard trick. A genuine notice tells you something. It does not ask you to confirm anything, does not contain a link to press, does not want a code, and does not invite a reply.

So the rule is short: if a message about a login asks you to do anything at all, do not do it there. Close it and open Settings, then Devices, yourself. That way the question is answered by the list rather than by the message, and a convincing fake gets you nowhere.

There is also a deliberate delay after a new session appears: a freshly signed-in device is restricted from the most damaging account actions for a period, which exists precisely so that a legitimate owner has time to notice and evict it. That is a safety net rather than a plan — the plan is two-step verification from Step 008, so the session never exists.

alt_route Where unwanted sessions come from

They are rarely dramatic. Three ordinary routes account for most of them, and all three are avoidable.

A browser you did not sign out of. A library terminal, a hotel machine, a friend's laptop. Closing the tab hides it; the session keeps working. Step 006's habit — a private window and an explicit log out — removes this entirely.

A QR code you scanned for somebody else. A login QR is a request to create a session on the account scanning it. Scanning one that another person shows you, or that arrives in a message claiming to verify something, signs your account into their computer. There is no legitimate version of this.

A desktop session folder copied off an unprotected computer. Covered in Step 027: on a desktop, your signed-in state is a folder, and the local passcode is what makes a copy of it useless. This is the one that happens without any interaction from you at all.

Notice that none of the three involves guessing a password, which is why a strong password is not the defence here. The defences are ending sessions you no longer need, encrypting the desktop folder, and never scanning a code somebody else produced.

touch_app Try it now — five minutes

The first three take a minute. The fourth is what you do if something is wrong, and it is worth reading before you need it.

1. Open Settings, then Devices, and read every entry Most people find at least one thing they had forgotten. Terminate anything you cannot account for; a device you use will simply ask you to sign in again.
2. Set the automatic expiry for inactive sessions Something short enough to matter. This is the only item here that keeps working without you.
3. Find the service chat and look at a real login notice Knowing what a genuine one looks like is what makes a fake obvious later.
4. If you suspect somebody is in: terminate all other sessions, then change the cloud password In that order, from any device you still control. Then check your settings for anything altered — a new recovery address, a changed username, unfamiliar chats.

open_in_new The other list: websites and bots you authorised

Sessions are not the only standing permission attached to your account. Two more accumulate quietly, and neither appears in the device list.

Websites you signed into with Telegram. Some sites offer a login that goes through your Telegram account instead of a password; approving one creates a connection that stays until you remove it. The site receives your name, your handle and your picture — not your messages — and the connection persists long after you have forgotten the site existed. Telegram keeps a list of them in the privacy settings, and it is worth reading once a year for the same reason the device list is.

Bots you gave permissions to. A bot you granted admin rights in one of your groups keeps them until you take them away, and Step 067 goes into what that actually allows. Removing a bot from a room is the equivalent of terminating a session there.

The common thread is worth stating: an account is not only the devices signed into it. It is every standing grant you have made and not revisited, and the habit of reading those lists occasionally is the same habit in three places.

help Common questions at this stage