The short answer
- 1All Telegram client apps are open source, and iOS and Android have reproducible builds.
- 2The server code is not published, because nobody could check that the same code runs on the servers.
- 3Secret chats do not depend on the server; cloud chats do rely on trusting it.
In this article
What is open, and what is not
Telegram's FAQ says all of its client apps are fully open source, and that it offers verifiable builds for iOS and Android. The server code is not published.
| Part | Published? | What anyone can check |
|---|---|---|
| Client apps (desktop, Android, iOS and others) | Yes, source code | Read the code to see what the app does |
| The app you install from App Store or Google Play | Reproducible builds | That it was built from the exact same source code Telegram publishes |
| Encryption and API | Fully documented at core.telegram.org | How the protocol is supposed to work, open for review by security experts |
| Server | No | Nothing, which is the point of the next section |
Why the server code stays closed
The FAQ's reasoning is short. Publishing server code would give no security guarantee, for secret chats or for cloud chats, because unlike an app on your phone, there is no way to verify that the same code is actually running on the servers. Code you cannot check against what is running proves nothing.
For secret chats, the FAQ adds, you do not need the server code at all: the point of end-to-end encryption is that it must be solid however the servers behave. Ordinary cloud chats are different; they are encrypted between your device and Telegram's servers, so they do rely on trusting the service. That difference is explained in Telegram encryption explained in plain words.
What reproducible builds actually do
- Someone builds the app themselves from the published source code, following the official instructions at core.telegram.org.
- They compare the result with the app downloaded from the store.
- If the two match, the store app contains nothing that is not in the public source.
Ordinary users are not expected to do this. What protects them is that anyone can, and that a mismatch would be visible. For Windows, a simpler check is the installer's digital signature; see checking that the installer is genuine.
What it means for you
- Verifiable builds cover official apps only. A modified APK or a "Plus" version is outside all of this; see fake Telegram APKs.
- Found something wrong? Security issues go to the bug bounty; see Telegram's bug bounty.
- Need the strongest protection? The FAQ recommends secret chats in official or verifiable open-source apps, with Two-Step Verification and a passcode.
FAQ
Is Telegram open source?
Its client apps are fully open source, with reproducible builds for iOS and Android. The server code is not published.
Why doesn't Telegram publish its server code?
Its FAQ says there is no way to verify that the same code runs on the servers, so publishing it would prove nothing.
What is a reproducible build?
A way to rebuild an app from the published source and confirm the store version is identical.
Sources
At a glance
- 1Open
Client apps, plus documented encryption and API.
- 2Closed
Server code, which could not be verified anyway.
- 3For you
Official apps only; secret chats for sensitive talk.
Updated
