TgHacker
Sign In Sign Up
Recovery hub Hacked account Login code Password & 2FA Blocked or limited
Sign InSign Up
Prevention · Your own account

Set Up Telegram Two-Step Verification (Cloud Password)

This is the change that stops a stolen login code from being enough. A code can be phished or SIM-swapped out of your hands, but once you add a Cloud Password through Telegram’s built-in Two-Step Verification, the code alone no longer signs anyone in. Pair it with a recovery email you actually own, and give it a hint that reminds you without leaking anything.

Turn on 2FA nowSee how it defends you
No credentials, ever
We never ask for, store, or transmit your Cloud Password or login code.
Official channels only
Everything routes through Telegram's own apps, @SpamBot, and recovery email.
Zero retention
Nothing to store, because we never handle your account data at all.
Owner-only
Guidance for the account in your hand — never anyone else's.

Every step here you perform yourself, inside your own Telegram app under Settings > Privacy and Security. Nothing happens off-platform, and no setup service is involved.

Set your Cloud Password in six steps

1
Open Privacy and Security
In Telegram, go to Settings > Privacy and Security.
2
Tap Two-Step Verification
Tap Two-Step Verification and start setting a password; the button reads ‘Set Password’ or ‘Set Additional Password’ depending on your app.
3
Create a strong Cloud Password
Use a long, unique passphrase you don't reuse anywhere else.
4
Add a recovery email
Enter an inbox you fully control and confirm the code Telegram sends it.
5
Write a safe hint
Add a hint that jogs your memory but never spells out the password.
6
Check Active Sessions
Open Settings > Devices and end any session you don't recognize.

You'll need: your phone with Telegram open, 2–3 minutes, and an email inbox you'll still control in a year. Nothing else — no third-party 'authenticator', no setup service.

What happens when someone tries your code

  1. 1
    Someone requests a login code for your number
    Telegram sends the one-time code, usually to your other signed-in devices first. If a code arrives that you didn’t request, someone typed your number.
    ⏱ Seconds · A login code you didn’t ask for, in the “Telegram” chat.
  2. 2
    The Cloud Password wall stops them
    Even with the code, Telegram now demands your Cloud Password — which the attacker doesn't have.
    ⏱ Immediate · The intruder is blocked at the password screen; your account is untouched.
  3. 3
    You notice the code you didn’t request
    Stopped at the password screen, they get no access to your chats. An unfinished attempt may still show up in your session information, so the unrequested code is your cue to look. Don’t share it, and don’t answer anyone who asks about it.
    ⏱ Minutes · A code you didn’t ask for in the “Telegram” chat, and possibly an unfinished login under Devices.
  4. 4
    You check Devices anyway
    Open Settings › Devices and terminate anything you don’t recognise, from a device signed in for more than 24 hours.
    ⏱ 1–2 minutes · Every session in the list is one of yours.
  5. 5
    If YOU ever lose access, recovery email helps
    Tap “Forgot password” on the password screen and Telegram emails a recovery code to the address you set, so you can reset the cloud password yourself.
    ⏱ Minutes · A recovery code in the inbox you control.
  6. 6
    Last resort: the account reset
    With no password, no recovery email and no signed-in device, what’s left is the account reset. It DELETES the account and its cloud chats, sometimes after a wait, sometimes straight away.
    ⏱ Depends on the account · A screen you would only use once every other way in is gone.

Two-Step Verification has no expiry: it keeps asking for the password on every new login. It doesn’t undo sessions that are already signed in or protect a recovery mailbox someone else controls, so keep checking Devices and guard that inbox. The account reset stays the one destructive option, for when the recovery email and every signed-in device have failed.

Write a hint only you can use

In a normal login, Telegram shows your hint on the password screen right after the login code is entered. So whoever reads it usually already has your code: write the hint for an attacker as much as for you.

What someone who has entered your login code sees next. Your hint is on it.

“my daughter + year”
Gives it away

Names and birth years sit on your public profile and in old posts. Two searches and they have it.

“same as email”
Gives it away

Points straight at a password that has probably leaked somewhere. It also tells them where to try next.

“starts with K, 9 letters”
Gives it away

Shrinks the guess for them, and gives you nothing a real memory cue would.

“the walk to the lake”
Only you get it

A private memory with no answer anyone else can look up. It nudges only you.

“manager › “TG cloud””
Only you get it

Says where the password is stored, not what it is. Useless to anyone without your password manager.

A hint is optional. If you can’t write one that is useless to strangers, leave it empty and keep the password in a password manager.

We do

  • ✓ Walk you through Telegram's own Two-Step Verification screen
  • ✓ Explain the recovery-email and hint fields in plain language
  • ✓ Show you how to review and end logins in Active Sessions
  • ✓ Point you to official routes: @SpamBot, [email protected], t.me

We never

  • ✗ Ask for, store, or transmit your Cloud Password or login code
  • ✗ Offer a 2FA 'bypass', password 'remover', or third-party authenticator
  • ✗ Touch, access, or monitor an account that isn't yours
  • ✗ Intercept SMS/OTP, hijack sessions, or read anyone's chats

Prevention only, and only for your own account. Once 2FA is set, no support agent or bot ever needs your cloud password OR your login code — sharing either IS the takeover. We never store, request, transmit, or handle your credentials, and you need nothing beyond Telegram's built-in Two-Step Verification — reject any third-party 'authenticator' or setup service that requests them.

FAQ

What makes a strong Telegram Cloud Password?
A long, unique passphrase you use nowhere else — think four or more unrelated words, or a full sentence, rather than a short word with a number. Telegram's Cloud Password has no character limit that forces weakness, so length is your friend. Don't reuse a password from your email or other apps; if that account leaks, your Telegram shouldn't fall with it. Store it in a reputable password manager so you're never tempted to pick something guessable just to remember it.
Do I really need a recovery email?
Yes. It is the difference between a forgotten password being a two-minute fix and a catastrophe. When you add a recovery email on the Two-Step Verification screen, Telegram sends it a confirmation code so you know it works. If you ever forget your Cloud Password, “Forgot password” sends a recovery code to that inbox. Without one, a device that is still signed in can reset the password after a wait; with neither, only the account reset is left. The account reset deletes the account and its cloud chats. Depending on the account, Telegram either makes you wait or deletes it straight away; follow what the screen shows. Use an inbox you fully control and will still have in a year.
What should my password hint say?
The hint appears on the Cloud Password screen every time it's requested — including to anyone who has your login code — so it must never reveal the password itself. A good hint nudges only you: a private reference, an inside joke, the name of the manager entry where it's stored. A bad hint is 'my usual password', the first characters, or anything a stranger could act on. If in doubt, make the hint useless to everyone but you.
I forgot my Cloud Password — can you help me remove it or get back in?
No, and no legitimate service can. There is no 2FA ‘bypass’ or ‘remover’; anyone offering one is running the scam. The real paths are your own: “Forgot password” sends a recovery code to the email you set; a device that is still signed in can reset the password after a wait and keeps the account; only with neither is the account reset left. The account reset deletes the account and its cloud chats. Depending on the account, Telegram either makes you wait or deletes it straight away; follow what the screen shows. We never request, store, transmit, or handle your Cloud Password or login code. If someone asks you to share your password or code to ‘restore access’, that request itself is the takeover.
Will 2FA stop the 'send me the code' scam and SIM swaps?
It defeats the core of both. Telegram login is phone-number based: an attacker who phishes your one-time code or hijacks your number via SIM swap can normally sign in. With a Cloud Password enabled, the code is no longer sufficient — Telegram also demands the password they don't have. That's why this single setting neutralizes code-phishing and blunts SIM-swap takeover. Still never share your login code with anyone, and review Active Sessions periodically.
Where exactly is Two-Step Verification in the app?
Open Settings › Privacy and Security › Two-Step Verification; if it is off, the button offers to set a password. From the same Privacy and Security area you reach Devices to review logins. For account limits or spam blocks, contact @SpamBot on Telegram. All of these live inside Telegram or on t.me, never on a third-party setup site.

Topic

Protect your account

Security CenterHarden the account before anything happensStart here
Set up Two-Step VerificationAdd a cloud password in two minutesYou are here
SIM-swap protectionStop a number port from becoming a takeoverMonitor your own accountWatch your own account for intrusions

All recovery routes

Set it once, and you may never come back

Two-Step Verification is the prevention keystone: a strong Cloud Password, a recovery email you control, and a hint that reveals nothing. Together they stop a stolen login code from being enough on its own, and give you a way to reset a forgotten password through your own inbox. It takes a few minutes, it’s built into Telegram, and it costs nothing. Keep reviewing your devices and guarding that inbox, for your own account, through Telegram’s official channels.

Open Settings and turn on 2FA
We use cookies.
We use cookies to collect data to improve your experience on our website. Read our usage policy cookies You can your preferences at any time.