Is Telegram End-to-End Encrypted?

Not by default. Telegram's normal chats, groups and channels are "cloud chats": encrypted between your device and Telegram's servers and stored encrypted there, but not end-to-end encrypted, so Telegram's systems can technically access them. End-to-end encryption is available in secret chats, which you start deliberately for one-to-one conversations, and in Telegram's voice and video calls. If you want a Telegram conversation that only you and the other person can read, you need to use a secret chat.

This guide explains what that means in practice, why Telegram is built this way, how to use secret chats properly, and what no encryption can protect you from.

What end-to-end encryption means

Encryption scrambles a message so that only someone with the right key can read it. The question is who holds the keys.

• Client-server encryption protects a message on its way from your device to the service's servers, and from the servers to the recipient. The service can decrypt it on its servers, which lets it store your history and sync it to other devices.
• End-to-end encryption means the message is encrypted on your device and can only be decrypted on the recipient's device. The service in the middle passes along scrambled data it cannot read.

Both protect you from someone intercepting your connection, such as on public Wi-Fi. The difference is whether the service itself, and anyone who gains access to its servers or compels it to hand data over, could read your messages.

Before you start: what are you protecting against?

Encryption is one tool among several, and whether it matters depends on who you are worried about. Security specialists call this a threat model. It sounds technical, but it is just an honest answer to "protect what, from whom?".

• Strangers and scammers. For most people, the main risk is strangers seeing your phone number or profile, or tricking you into giving up your account. Privacy settings and two-step verification matter far more here than end-to-end encryption.
• Someone who takes over your account. If an attacker logs in as you, they see every cloud chat. Two-step verification and checking active sessions are the defence. Secret chats on your own device are not exposed by a login elsewhere.
• Someone with your phone in their hands. A partner, a colleague or a thief with your unlocked phone sees everything on it, including secret chats. A screen lock and Telegram's passcode lock are the defence.
• Interception on a network. Public Wi-Fi or a compromised network cannot read Telegram traffic in either chat type, because both are encrypted in transit.
• The service itself, or legal demands on it. This is the case where end-to-end encryption makes the real difference. Only secret chats and end-to-end encrypted calls keep content out of reach of the service.

If your worries are mainly in the first three, you can be well protected on Telegram with good settings. If the last one matters to you, use secret chats, or consider whether Telegram is the right tool for those conversations.

How a message travels in each type of chat

Following one message through each path makes the difference concrete.

A cloud chat message

1. You type a message on your phone.
2. Your app encrypts it for the trip to Telegram's servers and sends it.
3. Telegram's servers decrypt it, store it encrypted in their cloud storage, and prepare it for delivery.
4. The servers encrypt it for each of the recipient's devices and for your own other devices, and send it.
5. Every device logged in to either account shows the message, and it stays available in the cloud for search and for any new device.

A secret chat message

1. You type a message on the device where the secret chat lives.
2. Your app encrypts it with a key that only your device and the other person's device share. Telegram never had that key.
3. Telegram's servers pass the scrambled data along without being able to read it, and do not keep it as part of your cloud history.
4. Only the recipient's single device can decrypt and show it.
5. Your other devices never see it, and if a self-destruct timer is set, the message is removed from both devices after it runs out.

The key difference is step 3. In a cloud chat, the server is a participant that can read the message. In a secret chat, it is only a courier.

How to tell what kind of chat you are in

It is easy to open the wrong chat, because a secret chat and a normal chat with the same person appear as two separate entries.

• A lock icon appears next to the name of a secret chat in the chat list and at the top of the chat.
• The name is often shown in a different colour, depending on the app and theme.
• The chat's info screen shows the encryption key and the self-destruct timer option, which normal chats do not have in the same form.
• The message box may indicate that you are in a secret chat.

Before sending something sensitive, glance at the top of the chat for the lock. If it is not there, you are in the cloud chat.

Which Telegram chats are end-to-end encrypted

Here is the full picture, chat type by chat type.

• Private chats (normal): cloud chats. Encrypted in transit and stored encrypted on Telegram's servers. Not end-to-end encrypted.
• Secret chats: end-to-end encrypted. One-to-one only. Stored only on the two devices involved.
• Groups: cloud chats. Not end-to-end encrypted.
• Channels: cloud chats. Not end-to-end encrypted. Public channels are readable by anyone anyway.
• Saved Messages: cloud storage. Not end-to-end encrypted.
• Chats with bots: not end-to-end encrypted. The bot's developer receives and can read what you send to the bot.
• One-to-one voice and video calls: end-to-end encrypted.
• Group calls, voice chats and live streams: these have historically not been end-to-end encrypted. Telegram has been adding end-to-end encryption to some group call features, so check the call screen for an encryption indicator, such as emoji to compare, before assuming a group call is protected.

The short rule: unless you started a secret chat or are in a call that shows an encryption check, assume the conversation is a cloud chat.

How cloud chats are protected

"Not end-to-end encrypted" does not mean "unprotected". Cloud chats are encrypted between your device and Telegram's servers using Telegram's own protocol, called MTProto, and stored encrypted on those servers. Telegram has said that it stores data across several locations and splits decryption keys so that no single place holds both the data and the keys. That is a claim about Telegram's internal arrangements, which users cannot verify for themselves.

What this protects you from:

• Someone on your network, such as an attacker on public Wi-Fi, reading your messages in transit.
• Someone stealing a single server disk and reading it directly, if Telegram's arrangement works as described.

What it does not protect you from:

• Telegram itself, in principle, since its systems handle decryption to provide cloud features.
• Legal requests or pressure on Telegram, depending on what Telegram's policies allow it to share. Telegram's privacy policy describes circumstances in which it may provide some user data, such as IP addresses and phone numbers, to authorities in response to valid legal requests. Read the current version of the policy if this matters to you.
• Anyone who gets into one of your devices or your account.

Why Telegram is not end-to-end encrypted by default

Telegram made a deliberate trade-off. Cloud chats make possible several features that are hard or impossible with end-to-end encryption:

• Using many devices at once. You can log in on phones, tablets, computers and the web, and every device shows your full history immediately.
• Instant history on a new device. Lose your phone, log in on a new one, and everything is there. With device-only end-to-end encryption, history is tied to devices and backups.
• Huge groups and channels. Groups of up to 200,000 members and channels with unlimited subscribers would be very difficult to run with end-to-end encryption for every message.
• Server-side search and large file storage. You can search old chats and keep large files in the cloud without storing them on your phone.

Telegram's position is that users can choose: cloud convenience for everyday chats and secret chats when they need the extra protection.

The criticism

Security researchers and privacy advocates have long criticised this approach. The main points are:

• Defaults matter. Most people never change defaults, so most Telegram conversations are cloud chats. A messenger that encrypts every chat end to end by default protects people who never think about it.
• No end-to-end groups. Group conversations are often the most sensitive, and they cannot be end-to-end encrypted on Telegram.
• Custom cryptography. MTProto is Telegram's own design rather than a widely used standard protocol. Earlier versions received academic criticism; Telegram released MTProto 2.0 and has published documentation and run security contests. Opinions among experts still differ.

Some other messengers encrypt all chats, including groups, end to end by default. If that is what you need, our comparison of Telegram vs Signal for privacy covers the differences in detail.

Secret chats: how they work

A secret chat is a separate conversation with the same person, marked with a lock icon and usually shown in a different colour or with a padlock in the chat list. It has its own rules:

• End-to-end encrypted. Only the two devices in the chat can read the messages.
• Device-specific. The chat exists only on the device where you started or accepted it. It does not appear on your other devices or in the cloud.
• Self-destruct timers. You can set messages to disappear a set time after they are read.
• No forwarding. Messages in a secret chat cannot be forwarded.
• Screenshot alerts. On some devices, the other person is notified if you take a screenshot, and some systems block screenshots in secret chats. This depends on the phone's operating system and cannot stop someone photographing the screen with another device.
• Deletion on both sides. Deleting messages in a secret chat removes them from both devices.
• Not in every app. Secret chats are available in Telegram's mobile apps and in some desktop apps, but not in all of them. Check whether the option appears in the app you use.

Our guide to Telegram secret chats covers the features in more depth.

How to start a secret chat

The exact wording varies by app and version, but the steps are similar.

On Android

1. Open the chat or profile of the person you want to talk to.
2. Tap their name to open their profile.
3. Open the menu, usually three dots, and choose the option to start a secret chat.
4. Wait for the other person's device to come online. The chat is set up once their device accepts it.

On iPhone and iPad

1. Open the person's profile from the chat by tapping their name or photo.
2. Tap the more button, usually three dots.
3. Choose the option to start a secret chat.
4. Wait for the other person's device to come online and accept.

On desktop and web

Many desktop and web apps do not support secret chats. If you need one, start it on your phone. A secret chat started on a phone will not appear on your computer, because it lives only on the device that started it.

If you cannot find the option

• Make sure you are opening a private chat with a person, not a group, channel or bot. Secret chats are one-to-one only.
• Update the app.
• Try a different device: the option may not exist in your current app.

How to verify a secret chat

End-to-end encryption protects you only if you are really talking to the right device. Telegram lets you check:

1. Open the secret chat.
2. Open the chat's info by tapping the name at the top.
3. Look for the encryption key. It is shown as an image and, in some apps, a set of emoji or characters.
4. Compare it with the other person's screen, ideally in person or on a call you trust.

If the keys match, nobody is sitting in the middle of the connection. If they do not match, stop using the chat and start a new one.

For one-to-one calls, Telegram shows emoji on both screens. Read them out to each other at the start of the call; if they match, the call's encryption is intact.

What happens to secret chats when things change

Because secret chats live on a single device, ordinary events affect them in ways that surprise people.

• You log out of Telegram on that device. Secret chats on it are deleted. Logging back in does not bring them back.
• You get a new phone. Secret chats do not move with your account. Start new ones on the new phone. If an old one held something you need, save it some other secure way before you switch.
• You reinstall the app. Usually the same as logging out: the secret chats are gone.
• You forget your Telegram passcode lock. Recovering access to the app on that device generally means logging out, which removes secret chats stored there.
• The other person deletes the secret chat. It is deleted on both devices.
• Either account is deleted. The secret chat ends.

None of these are flaws; they follow directly from the content never being stored in the cloud. But they mean secret chats are a poor place to keep anything you need to keep. Think of them as conversations, not archives.

Settings that make encryption worth more

Encryption protects content. These settings protect the account and the devices around it, which is where most real attacks happen.

1. Turn on two-step verification, so a stolen login code does not give anyone your cloud chats.
2. Check active sessions regularly and end anything you do not recognise.
3. Set a passcode lock on the Telegram app if others can get to your devices.
4. Use auto-delete timers in cloud chats where you do not want a permanent record. They reduce what is stored, even though the chat is not end to end.
5. Limit peer-to-peer calls to contacts or nobody if you do not want other people to learn your IP address during a call.
6. Never share your login code, whoever asks. See never share your Telegram login code.

Our Telegram privacy settings checklist walks through each of these and the rest of the privacy section.

What end-to-end encryption cannot protect

Encryption protects messages in transit and on servers. It cannot protect against everything, and these limits matter as much as the encryption itself.

The device

If someone has access to your unlocked phone, or to the other person's, they can read the secret chat, because the messages are decrypted there for display. Malware on a device can do the same. Use a screen lock and Telegram's passcode lock, and keep your devices updated.

The app

The app you use decrypts your messages to show them. A modified or malicious app can read and send them anywhere. Use official apps from official sources. Our guide on third-party Telegram apps explains the risks.

The other person

The person you write to can screenshot, photograph or retype anything you send, and can share it. Self-destruct timers reduce how long messages exist, not what the recipient can do while they exist. Only send what you would accept being kept.

Metadata

End-to-end encryption hides what you said, not that you were talking. Some information, such as who communicated with whom and when, has to pass through Telegram's systems for messages to be delivered at all. Telegram's privacy policy explains what it keeps. Even with perfect encryption, a pattern of who talks to whom, how often and at what times can reveal a lot, which is why people in high-risk situations care about metadata as much as content.

Your account

If someone takes over your Telegram account, they get your cloud chats and can impersonate you. They do not get secret chats stored on your devices, but they can start new ones in your name. Protect the account with two-step verification. See how to set up two-step verification.

Backups

Messages that leave Telegram, for example through screenshots, exported chats or saved files on your phone, are protected only as well as wherever they end up. A chat export on an unencrypted laptop is readable by anyone with that laptop.

Which should you use: cloud chat or secret chat?

Most people use both, depending on the conversation. Some examples to help decide:

Example: everyday chat with friends

Example. Planning a weekend, sharing photos, group jokes. Cloud chats are fine. You benefit from history on every device, and nothing here is very sensitive.

Example: sharing a password with a family member

Example. You need to send a relative the Wi-Fi password or a bank detail. Use a secret chat with a self-destruct timer, so the information exists only briefly on two devices. Better still, use a password manager's sharing feature for passwords you reuse.

Example: a journalist talking to a source

Example. The conversation could put someone at risk if exposed. A secret chat is the minimum on Telegram, with the keys verified in person. Many people in this situation choose a messenger that encrypts everything by default and collects less metadata, and they think carefully about device security. If you are in a high-risk situation, seek specialist digital security advice rather than relying on any single app.

Example: a team group discussing a project

Example. Groups cannot be end-to-end encrypted on Telegram. If the project involves confidential material, decide whether it belongs in a Telegram group at all, and keep sensitive documents in a properly secured system.

Example: a public channel

Example. Channels are for publishing. Encryption is not the relevant question, since the content is meant to be read. Protect the admin accounts with two-step verification instead.

For channel and group owners

If you run a channel or group, encryption questions come up from members, and a few points are worth getting right.

• "Private" is not "encrypted". A private group or channel is one that people join through an invite link rather than search. Its messages are still cloud chats. Do not describe a private group as encrypted or secure to your members.
• Your admin accounts are the real risk. If an admin account is taken over, the attacker can read the group's history, post to the channel, change links and remove members. Every admin should use two-step verification, and you should keep a trusted second owner-level admin. Our guide on how to recover a hacked Telegram account covers what to do if it happens.
• Bots see what they are given. A moderation or analytics bot in your group can read the messages it has access to. Add only bots you trust, and give them only the rights they need.
• Set expectations in your rules. If members share personal information, remind them in the pinned rules that the group is not end-to-end encrypted and that anything posted can be seen and saved by other members.

What to do next

1. Decide which of your conversations, if any, would be harmful if the service or an account thief could read them.
2. For those, start secret chats on the device you actually use, and verify the key with the other person.
3. Turn on two-step verification and check your active sessions today.
4. Move anything you need to keep long-term, such as important documents, into storage you control and secure, rather than relying on a chat.

Common misunderstandings

"Telegram is encrypted, so it is private."

All Telegram chats are encrypted in some way, but only secret chats and calls are end-to-end encrypted. Privacy also depends on your settings, your devices and the people you talk to.

"Secret chats sync to my computer."

They do not. They exist only on the device that started or accepted them. That is part of how they stay end to end.

"Self-destructing messages cannot be saved."

The recipient can still photograph the screen, and on some systems take screenshots. The timer limits how long the message exists, not what the reader does with it.

"Telegram can read everything."

Telegram's systems can technically access cloud chats, but not secret chats or end-to-end encrypted calls. Whether and when Telegram accesses or shares data is governed by its own policies and the law.

"End-to-end encryption makes me anonymous."

It hides content, not identity. Your account is tied to a phone number, and metadata still exists.

Common mistakes

• Assuming a normal chat is end-to-end encrypted. Only secret chats and calls are, unless a call screen shows otherwise.
• Sending sensitive information in groups. Groups cannot be end-to-end encrypted on Telegram.
• Never verifying the encryption key in a secret chat that really matters.
• Starting a secret chat on one device and expecting it on another. Start it on the device you will actually use.
• Ignoring device security. A phone without a screen lock defeats any encryption.
• Using unofficial apps for sensitive chats. The app sees everything it displays.
• Forgetting two-step verification. An account takeover exposes every cloud chat at once.

FAQ

Are Telegram group chats end-to-end encrypted?

No. Groups are cloud chats, encrypted between devices and Telegram's servers but not end to end. Only one-to-one secret chats offer end-to-end encryption for messages.

Are Telegram calls end-to-end encrypted?

One-to-one voice and video calls are end-to-end encrypted, and both sides see emoji that should match. Telegram has been adding end-to-end encryption to some group call features; check the call screen for an encryption check before assuming a group call is protected.

Can Telegram read my messages?

Telegram's systems can technically access cloud chats, because they are decrypted on its servers to provide features like multi-device sync. Secret chats and end-to-end encrypted calls cannot be read by Telegram.

Why doesn't Telegram make every chat end-to-end encrypted?

Telegram chose cloud chats as the default so that history syncs instantly across many devices, large groups and channels work, and old messages can be searched. End-to-end encryption is offered through secret chats for conversations that need it. Many security experts would prefer end-to-end encryption by default.

Can I turn on end-to-end encryption for all my chats?

There is no setting that turns every chat into a secret chat. You have to start a secret chat for each conversation where you want it.

Are secret chats completely safe?

They protect message content between two devices, but not against a compromised or unlocked device, a malicious app, or the other person saving what you send. Verify the encryption key and keep your devices secure.

Summary

Telegram is not end-to-end encrypted by default. Normal private chats, groups, channels, saved messages and bot chats are cloud chats, encrypted between your device and Telegram's servers but readable by Telegram's systems in principle. Secret chats and one-to-one calls are end-to-end encrypted, and Telegram is adding encryption to some group call features. Telegram chose this trade-off for multi-device sync, large groups and cloud history, and it remains a point of criticism. For sensitive one-to-one conversations, start a secret chat on the device you will use and verify the key, and remember that encryption cannot protect an unlocked device, a malicious app or a recipient who saves your messages.