How to Check That a Telegram Installer Is Genuine

Why check the Telegram installer at all

Search for "Telegram download" and unofficial sites and ads appear alongside the real one. Some installers from such places look like Telegram but steal login data or quietly install something else. A minute of checking before you install tells you whether the file is genuine.

The surest step is to download from the official address in the first place.

What	Official address
Telegram Desktop for Windows, macOS and Linux	desktop.telegram.org
The native Mac app	macos.telegram.org
Every official app	telegram.org/apps

When you click download on the official site, the address changes from telegram.org to td.telegram.org while the file downloads. Both are Telegram's own.

Step 1: read the digital signature in Properties

The official Telegram Desktop installer carries a digital signature in the name of Telegram's company. Windows uses it to vouch for who made the file, and changing the file in any way breaks it.

1. Right-click the downloaded installer and choose Properties.
2. Open the Digital Signatures tab at the top.
3. Check that Name of signer reads Telegram FZ-LLC.

Step 2: a second look on the Details tab

The Details tab in the same window shows the file's description and copyright. For the official installer we checked, File description is Telegram Desktop Setup, Product name is Telegram Desktop and Copyright is Telegram FZ-LLC.

Anyone can copy these fields, so on their own they prove nothing. Always read them together with the signature in step 1.

Step 3 (optional): check the signature in PowerShell

If you are comfortable with a command line, right-click Start, open Terminal and paste the line below. The official file is named td-setup-win-x64- plus the version number, so the version is left as *. Change the folder if you saved it somewhere else.

Get-AuthenticodeSignature "$env:USERPROFILE\Downloads\td-setup-win-x64-*.exe" | Format-List Status, SignerCertificate

For the official installer we checked, the result showed Status : Valid and a certificate subject containing CN=Telegram FZ-LLC, issued by GlobalSign's EV code signing authority. If Status is anything other than Valid, do not install it.

Step 4 (optional): compare the SHA-256 hash with GitHub

The release pages of the official repository, github.com/telegramdesktop/tdesktop, list a SHA-256 digest next to each file. If your file was downloaded intact from Telegram, its hash matches the one shown for the same file name and version.

Get-FileHash "$env:USERPROFILE\Downloads\td-setup-win-x64-*.exe" -Algorithm SHA256

When we compared the installer downloaded from the official site with the digest on the matching GitHub release, the two values were identical. A match confirms the file is the one Telegram published; a mismatch means the file is incomplete or not the official one.

If a warning appears when you run it

A file with the official signature usually opens straight to the installer's first screen, Select Setup Language, even though it came from the internet. If instead you see Windows protected your PC or an Unknown Publisher warning, suspect the file first, and check the signature as in step 1 before going any further. When Windows warns about the Telegram installer covers that decision.

Downloading the Android APK

On Android the Google Play Store is the easiest route. Telegram also offers an official APK as an alternative; get it only from telegram.org/android or the official apps list, never from an APK passed around in chats or forums. See installing the Telegram APK on Android.

If you think you installed a fake

1. Uninstall that program and scan the whole PC with your antivirus.
2. In Telegram on your phone, open Settings › Devices and end every session you do not recognise.
3. Make sure Two-Step Verification is on, and turn it on if it is not.

The full steps for a suspected break-in are in the Security section.