In this article
- storage What is actually on the disk
- rule Four endings that are not the same ending
- devices The remedy that works from anywhere
- lock Why the local passcode is the one real countermeasure
- cleaning_services What about wiping the drive
- touch_app Try it now — five minutes
- help Common questions at this stage
- At a glance
Signing into Telegram Desktop on somebody else's computer takes about thirty seconds, and it leaves behind something that closing the window does not remove: a folder on that machine holding the authorisation for your account.
That part is true and worth knowing. What follows from it is less dramatic than the usual telling, because the remedy does not require you to go back to that computer — it happens on your phone, from anywhere, in about four taps.
What you will be able to do after this step
- check_circle Say what the desktop app writes to disk and why it matters.
- check_circle Tell apart closing the window, deleting the folder and signing out.
- check_circle End a session remotely, after you have already walked away.
- check_circle Pick the right approach for each kind of borrowed machine.
storage What is actually on the disk
Telegram Desktop keeps its state in a folder of its own, called tdata on Windows and Linux and living inside the application support directory on macOS. It holds the authorisation for your account together with cached messages, media and settings. It is the reason the app opens straight into your chats rather than asking who you are every morning.
The awkward property is that this folder is enough on its own. Copied to another computer and dropped into a clean installation, it can open your account there. No code is sent, nothing is typed, and nobody is asked to prove anything — because from Telegram's point of view nothing new is happening. It is the same session, running somewhere else.
That last sentence is the part worth holding on to, and it is also why this does not announce itself. A cloned session is not a new login, so it does not necessarily surface as a new device to be curious about. It presents as the computer you already know about.
rule Four endings that are not the same ending
People use these interchangeably and they do completely different things.
Closing the window. The application quits. The folder is untouched and the session is still live — the next person to open Telegram on that machine is in your account. This is the one that feels like leaving and is not.
Deleting the folder, or dragging it to the recycle bin. The copy on that machine is no longer in front of the next user, which is not nothing. But Telegram was never told anything, so the session remains valid, and if anybody took a copy earlier that copy still works. You have tidied the desk rather than changed the lock.
Signing out from inside the app. This one genuinely ends it. The session is invalidated on Telegram's side and the local data is cleared. If you are sitting at the machine and can do this, it is the right thing to do.
Ending the session from your own phone. The same result as signing out, available after you have left the building. This is the tool the situation is actually shaped for, because the moment you remember a borrowed computer is usually not the moment you are sitting at it.
Four computers, four different answers
"Somebody else's computer" covers situations with very little in common. What is sensible on a work machine is careless in a hotel lobby, and the reverse is simply inconvenient.
A computer you use every day at work
Installing the app here is reasonable and staying signed in is the point of it. The exposure is not a burglar with a memory stick; it is the ordinary fact that you stand up and walk to a meeting, and that the machine may be administered by people you have never met.
The setting that changes this one is the local passcode from Step 027. With it, the app asks for something when it wakes, and the folder on disk stops being a self-sufficient key. Without it, anybody who sits down while you are at lunch reads everything.
The second habit is to keep the device list in Step 028 honest, so that the machine you left at a previous job is not still listed there two years later.
Sign in, and add a passcode the same day. A permanent session on a machine other people can touch is the case the passcode was written for.
An internet cafe, a hotel business centre, a library
Do not install anything. There is no version of this where leaving an application and its folder on a machine used by strangers is a good outcome, and you have no idea what is already running on it.
Use the web client instead — Step 006 covers it — in a private browsing window. It keeps far less on the machine, and closing the window ends most of the story rather than some of it.
Then, when you are outside, end the session from your phone. Do this even if you signed out properly. It costs one tap, it covers the case where you were rushed or the machine misbehaved, and it is the only action available to you after the fact.
Web client, private window, and terminate the session from your phone once you leave — regardless of how cleanly you think you finished.
A laptop belonging to somebody you trust
The risk here is not the person. It is time. That laptop will be repaired, sold, handed to a younger relative or left on a desk during a house move, and none of those moments will remind anybody that your account is signed into it.
So the rule is simply to finish properly: sign out from inside the app when you are done, rather than closing the lid. If the reason you borrowed it was to send one file, the web client is quicker anyway and leaves nothing to sign out of.
If it has already been months, you do not need to ask for the laptop back. Open your device list and end that session; the folder still sitting on their disk becomes inert.
Sign out when you finish, and treat a forgotten session as a five-second fix on your phone rather than a conversation.
A computer you are selling, returning or passing on
Order matters here, and most people get it backwards. Sign out of Telegram first, while the app is still installed, because signing out is what invalidates the session. Then uninstall, and then do whatever you were going to do about wiping the machine.
Uninstalling first is the common mistake. Depending on the platform it may leave the folder in place, and it certainly leaves the session alive, so the account stays reachable by anything that folder ends up inside.
Finish on your phone. Even after a careful sign-out, read the device list and confirm that machine is no longer there. That confirmation is the only evidence that any of it worked.
Sign out, then uninstall, then wipe — and check the device list afterwards, because that list is the record Telegram actually keeps.
devices The remedy that works from anywhere
On your phone, in Settings, there is a list of every client signed into your account — phones, tablets, desktops, browser sessions — with where and when each one last connected. Step 028 is the full treatment of that screen. For this step, only one thing about it matters.
Ending a session there is immediate and final. The authorisation held by that computer stops working, and the folder sitting on its disk becomes a directory of useless files. Nobody has to go back, ask for the laptop, or run anything on it.
There is also a single control that ends every session except the one you are holding. If you have arrived at this page because you cannot remember which machines you have signed into over the years, that control is the honest answer. You will sign in again on the two or three devices you actually use, which takes a minute, and the unknown remainder ceases to exist.
lock Why the local passcode is the one real countermeasure
For machines you keep using, there is a setting that changes the situation rather than managing it. A local passcode, covered in Step 027, means the data the app keeps on that disk is protected by something you know, instead of by nothing in particular. The folder stops being sufficient by itself.
It is worth being clear about what that does not cover. It protects the data while the app is locked; it does nothing about a machine that is compromised while you are sitting in front of it signed in and working. And it is local to that installation — forgetting it means signing in on that computer again, not losing your account, since your messages live in the cloud rather than on the disk.
That mild consequence is the reason to use it. A protection whose worst failure is a two-minute inconvenience is a protection you can afford to have switched on.
cleaning_services What about wiping the drive
The usual version of this topic ends with commands for overwriting files several times. It is worth saying why that advice is misplaced here rather than simply omitting it.
First, it solves the wrong problem. The session is what grants access, and you can revoke it from your pocket; scrubbing a disk you may no longer own is a great deal of effort to achieve less. Second, the tools do not do what their names promise on modern storage, because solid-state drives move data around underneath the file system and an instruction to overwrite a file is not an instruction to overwrite the physical cells that held it.
If you are disposing of a computer, the sensible step is the one your operating system already offers: a full reset that erases the drive, or full-disk encryption switched on from the beginning so that the reset only has to destroy a key. That is a good habit for every reason, not just this one. It is simply not the lever for this particular problem.
touch_app Try it now — five minutes
Four steps, and the first is the one that resolves anything already outstanding.
- Open your device list and read it properly On your phone, in Settings, under Devices. Read every entry, including the ones that look familiar. Most people find at least one computer they have not used in a year.
- End everything you do not currently need Not just the suspicious entries — the finished ones. An old work laptop and a friend's desktop are the realistic version of this risk, and neither looks alarming in a list.
- Set a local passcode on the desktop machines you keep Step 027 has the detail. Do it on the work computer first, because that is the one other people walk past.
- Decide your rule for borrowed machines, once Web client, private window, terminate afterwards. Deciding it now means not having to decide it while standing in a hotel lobby with somebody waiting.
help Common questions at this stage
If I delete the folder, am I signed out?
No. Deleting it removes the local copy but tells Telegram nothing, so the session stays valid and any copy taken earlier still works. Signing out from inside the app, or ending the session from your phone, is what actually invalidates it. The folder is a consequence of the session rather than the session itself.
If somebody copied my folder, would a new device appear in my list?
Not reliably, and this is the honest answer people find unsatisfying. A copy is the same session rather than a new one, so it can present as the machine already in your list. That is precisely why the useful discipline is ending sessions you no longer need, rather than watching the list for something suspicious to appear. You are removing the possibility instead of waiting to detect it.
Is the web client genuinely safer on a borrowed computer?
For this specific problem, yes: it keeps far less on the machine and a private window discards most of it on close. That is a statement about how much is left behind, not a claim that browsers are more secure than applications. On a machine you control, the desktop app with a passcode is the better arrangement by some distance.
Do my secret chats travel with a copied folder?
No. Secret chats are tied to the device that created them and do not follow a session around, which is the whole design covered in Step 025. It is a useful reminder that a copied session is not a complete copy of everything you have — and equally a reminder that ending a session on a device ends any secret chats that lived there, permanently.
Should I be worried about a computer I used years ago?
Only to the extent that the session might still be listed, which takes ten seconds to check and one tap to resolve. If the session is gone, the folder on that machine has been inert since the day it ended. Worry is not the useful response to this topic; reading the list twice a year is.
Does any of this apply to phones and tablets?
The same principle applies — a signed-in device holds a live session — but the exposure is different, because phones are locked, rarely shared and not usually left on a desk for the next person. The practical version for mobile devices is the one in Step 028: know what is on the list, and end anything you have sold, lost or stopped using.
At a glance
- 1What stays on disk
The desktop app saves a signed-in session folder on that computer.
- 2Close is not logout
Closing the window or deleting the folder does not end the session.
- 3End it remotely
From your phone: Settings › Devices › terminate that session.
Updated
