In this article
This step closes the security module. The conventional way to end one is a checklist you score yourself against, and the conventional result is a number that feels like progress.
A score is a poor summary of this particular subject. These settings defend against different things, several have a real cost attached, and two of them can lose you the account outright if you set them up carelessly. What follows is the whole list, with what each item actually prevents and who should bother.
What you will be able to do after this step
- check_circle Say what each setting in this module actually stops, and what it does not.
- check_circle Separate the handful everybody needs from the ones that are situational.
- check_circle Recognise the two settings that create a risk of their own.
- check_circle Run the review in one sitting, in an order that does not double back.
security Start from the worry, not the list
"Is my account secure" has no answer, because security is always security against something. The useful question is what you are actually worried about, and there are only four honest candidates.
Somebody who picks up your device. A partner, a colleague, a thief, a border official. This is the most common one by a distance and it is answered locally — a device lock, and a passcode on the app itself.
Somebody who obtains your phone number. A reissued SIM, a swap arranged with a carrier, a number that lapses. This is the scenario two-step verification exists for and nothing else covers it.
Somebody watching the network. A public hotspot, an employer, a national filter. This is the narrowest of the four for most readers, and it is also the one the security literature spends the most time on.
Somebody who is already talking to you. Persuasion rather than intrusion: the message that asks you to read out a code, the support account that contacted you first. This is how accounts on this platform are most often lost, and no checklist item addresses it.
checklist Everything in the module, and what it is actually for
Each row is a setting from Steps 025 to 039. The second column is the claim you can make about it honestly; the third is the claim people make that is not true.
| Setting | What it stops | What it does not stop | Who needs it |
|---|---|---|---|
| Two-step verification (Step 008) | Anybody who obtains a code sent to your number from taking the account. | Anybody using a device you are already signed into. | Everybody, without exception. |
| A confirmed recovery email (Step 036) | You losing the account permanently when you forget the password. | Anybody who controls that mailbox — it is now a way in. | Everybody who did the row above. |
| Reading the device list (Step 028) | A session you forgot about, or one you never made, staying live. | A login that happens tomorrow. | Everybody, twice a year. |
| Local app passcode (Step 027) | Somebody picking up an unlocked device, or sitting at your desk. | Anything at all while you are signed in and using the app. | Shared computers, and any phone without a strong lock. |
| Who can see your number (Step 009) | Strangers who bought a list of numbers finding your account with one. | Telegram knowing your number, or people who already have it. | Everybody. |
| Last seen and forwarding privacy (Step 009, Step 029) | Casual observation of when you are awake, and of who you are. | Anybody determined, and it is reciprocal — you lose the same view. | Anyone whose schedule is somebody else's interest. |
| Calls relayed, not peer-to-peer (Step 031) | Your approximate location leaking to whoever you are on a call with. | Anything about what is said, which is encrypted either way. | Anybody who accepts calls from people they do not know. |
| Secret chats (Step 025) | The conversation existing anywhere except the two devices in it. | The other person keeping, copying or photographing it. | Specific conversations, not your messaging in general. |
| Auto-delete timers (Step 026) | An old conversation being read months later on either device. | Anybody who saved, forwarded or screenshotted it while it was there. | Conversations with a natural end, not every chat. |
| Link previews off (Step 030) | A URL in a secret chat being fetched by Telegram's servers. | The site learning anything when you actually open the link. | Secret chat users. In ordinary chats it buys nothing. |
| A proxy (Step 035) | A network block between you and Telegram. | The proxy operator seeing that you are connecting, and when. | People who cannot otherwise connect. Nobody else. |
| Login relay opt-out (Step 038) | Your phone number being shown to strangers receiving codes. | Anything, if the feature was never offered to you. | Android users who saw the offer. |
| Inactivity timer (Step 034) | An abandoned account sitting there indefinitely. | Anything while you are still using the account. | Everybody — and the right answer is a long period. |
Read down the third column once before you read anything else. Most of the disappointment in this subject comes from a setting that worked exactly as designed while somebody expected it to do the job in the neighbouring row.
warning The two that can cost you the account
Almost everything above fails safely. Two do not, and both fail the same way: there is nobody to appeal to.
Two-step verification without a confirmed recovery address. The strongest single setting in the list becomes the reason you lose everything if you forget the password and never finished the second half. There is no support desk that can restore it, by design — a desk that could would be a desk that could be talked into it. Step 036 is the fifteen minutes that turns this from a risk into a protection.
A local passcode you have not written down. Milder, because your messages are in the cloud and you can sign in again. Still a bad afternoon, and worse on a desktop machine where secret chats live locally and do not come back.
There is a third item that is not dangerous but is frequently set wrong: the inactivity timer from Step 034. People shorten it, imagining it as a security feature. It is a data-loss feature with a security side effect, and the risk it manages — an abandoned account — is smaller than the risk it creates, which is your own archive disappearing during a long absence.
touch_app Try it now — five minutes
The order matters because each step makes the next one meaningful. Fifteen minutes covers most of the value in this module.
- Two-step verification, and confirm the recovery address in the same sitting Not on the list, then on it. Half-finished, this is the most dangerous configuration on the page — so do both halves before you close the app.
- Read the device list and end everything you do not need Old computers, a sold phone, a browser session from a conference. The unfamiliar entries matter; so do the finished ones.
- Walk the privacy screen once, top to bottom Who sees your number, who can find you by it, who can call you, who can add you to groups. Four decisions, each taking seconds, and together they remove most unwanted first contact.
- Make one decision about borrowed computers, and lengthen the inactivity timer Step 039's rule, decided now rather than in a hotel lobby. Then set the timer long, because the thing it can destroy is yours.
psychology_alt What no checklist covers
Accounts on this platform are overwhelmingly lost in one of two ways, and neither appears in any audit.
The first is somebody reading out a login code. It arrives as a message from a friend whose account was taken an hour earlier, or as a support agent who contacted you first, or as a buyer who needs to verify you before a sale. The code is always going somewhere reasonable-sounding. The rule that defeats all of it requires no configuration: a code is for the screen that asked for it, and every single person who contacts you wanting one is attacking your account, with no exceptions worth carving out.
The second is a password reused from a site that was breached. A cloud password that also opens an old forum account is not a second factor; it is a public string. A password manager fixes this permanently and is more valuable than half the rows in the table above.
An account with a perfect score and either of those habits is in worse shape than an ordinary account without them. Which is the honest note to end a security module on: the settings are the easy part, and they are not where this usually goes wrong.
help Common questions at this stage
If I only do one thing from this module, what should it be?
Two-step verification with a confirmed recovery email — treated as a single action rather than two. It is the only item that addresses losing the account rather than losing privacy, and the failure it prevents is the one you cannot undo. Everything else on the list changes how much somebody learns about you. This one changes whether the account is still yours.
Should I turn on everything, just in case?
No, and the reason is not effort. Several of these settings are reciprocal or have side effects — hiding your last seen hides everybody else's from you, a short auto-delete timer destroys your own record of a conversation, a proxy adds a party you have to trust. Switching on protections you do not need trades away something real for a defence against a threat that was not yours.
Does a proxy or a VPN make my messages more private?
Not from Telegram, which is the misunderstanding worth correcting. Both sit between you and Telegram's servers, so they change who can see that you are connecting and from where. They do not change what Telegram itself receives, and they do not add encryption to your messages, which are already encrypted in transit. Their honest use is reaching the service when a network blocks it.
How often should I repeat the review?
The device list twice a year, and the rest only when something changes — a new phone, a new job, a lost device, a number you are giving up. Security settings are not a subscription that needs renewing. The one genuinely periodic item is the list of what is signed in, because it accumulates without anyone touching it.
Is Telegram less secure than the messengers that encrypt everything end to end?
They make different trades, and it is worth stating both halves. Ordinary Telegram chats are encrypted in transit and stored in the cloud, which is what gives you a searchable history on every device and recovery after losing a phone. Secret chats, from Step 025, are end to end and live only on the two devices involved. So the answer depends on which property you want for a given conversation — and for most conversations, most people want the history.
My score on this list is low. How worried should I be?
Work out which of the four worries at the top of this page is actually yours, then look at the two or three rows that answer it. A reader whose only concern is a family member picking up their phone needs a device lock and a passcode, and is finished. A number out of a hundred would tell that person they are failing, which is both untrue and the reason the original scorecard framing was worth removing.
At a glance
- 1Know what each stops
Every setting blocks one kind of risk and leaves the others open.
- 2Two risky settings
Two-step without a recovery email, and a passcode you never wrote down.
- 3What no setting stops
Reading a code out to someone, or reusing a leaked password.
Updated
