Recovery reference

Telegram Recovery Glossary: The Terms That Decide Your Next Step

Telegram uses a very specific vocabulary, and two of its terms — the one-time login code and the optional cloud password — get confused constantly. This page defines both, plus every term you meet while recovering your own account, so you never take the wrong step or hand the wrong thing to the wrong person.

Jump to the glossary Login code vs cloud password

Owner-only, always

Every definition here serves recovering your own account — nothing else.

Official channels only

We point to Telegram's own apps, @SpamBot and recovery email, never third-party 'tools'.

We never ask for your code

No one on this site will ever request a login code, cloud password or OTP.

No account data collected

This is a reference page; it stores no Telegram credentials or messages.

These are neutral definitions, not a service that logs into your account.

The exact Telegram terms you'll meet while recovering your own account — tap any term to expand its definition.

Login code: The one-time code Telegram sends when you sign in with your phone number, usually to your other signed-in devices first; otherwise SMS, a call or email. Never share it: anyone who asks for it is trying to take over your account.
Cloud password (Two-Step Verification / 2FA): An optional standing password you set under Settings > Privacy and Security > Two-Step Verification. It is asked for only after the login code succeeds. It is not the same thing as the login code.
Recovery email: The optional email you attach to your cloud password. A masked hint appears on the password screen, and a recovery code is sent here if you forget the cloud password.
Active Sessions / Devices: Settings > Devices (Active Sessions) lists every device currently logged into your account. You can terminate any session you don't recognize, including all others at once.
@SpamBot: Telegram's official bot for account limits. If your account was restricted for spam, message @SpamBot to check the status and appeal — it has nothing to do with codes or passwords.
Self-destruct (account): A setting that deletes your entire account after a chosen period of inactivity. Once an account self-destructs, it and its cloud chats cannot be restored.
@handle (username): Your public @username, separate from your phone number. It lets people reach you without knowing your number and can be changed or released; losing it is not the same as losing the account.
Fragment: The official platform (fragment.com) where Telegram usernames and anonymous numbers are auctioned and registered on the blockchain.
QR login: A sign-in method on Telegram Desktop and Web: the new device shows a QR code, and your already-signed-in phone scans it to authorize the login.
Account reset: The last-resort option on the password screen when you have no recovery email and no signed-in device. It deletes the account and its cloud chats rather than recovering the password; sometimes Telegram holds it for a while first.
Secret Chat: An end-to-end encrypted chat stored only on the two devices involved. It is never in the cloud, so it cannot be recovered when you sign in on a new device.
Passcode / App lock: A local lock (Settings › Privacy and Security › Passcode) that locks the app on this device only. It isn’t your cloud password and plays no part in signing in.
[email protected]: Telegram's official email address for account-termination and deactivation appeals — used when the account itself, not just access, needs to be addressed.

Terms people mix up

Most wrong turns in recovery start with two words that sound alike. Here are the pairs, with the one-line way to tell them apart.

Login code

A one-time code Telegram sends when you sign in with your phone number on a new device.

Cloud password

An optional password you set yourself (Two-Step Verification). If it’s on, Telegram asks for it after the code.

If it arrived by itself, it’s the code. If you made it up, it’s the password.

Recovery email

“Forgot password?” sends a recovery code here when you forget the cloud password.

Login email

Some accounts receive their login code by email instead of SMS.

They can be the same address, but they’re separate settings with different jobs.

Password recovery

Getting past a forgotten cloud password: a code to your recovery email, or a reset from a signed-in device after a wait. The account stays.

Account reset

Offered on the password screen when nothing else is left. It deletes the account.

One keeps your chats, the other erases them.

Limit or freeze

You can still log in and read your chats, but some actions are blocked. @SpamBot, or the in-app notice on a frozen account, shows how to appeal.

Ban

If you can still open your chats, it isn’t a ban.

Cloud chat

Stored by Telegram and synced to every device you sign in on.

Secret chat

Lives only on the devices in it, never in the cloud.

Lose the phone: cloud chats survive, secret chats don’t.

The full A–Z of terms is above; these are the five pairs that cost people their accounts.

Owner recovery vs the shortcut

	Login code (one-time)	Cloud password (Two-Step Verification)
What it is	A single-use code that authorizes one sign-in on your phone number.	An optional standing password you set yourself to add a second step.
Do you create it?	No — Telegram generates and sends a fresh one each time.	Yes — you choose it under Settings > Privacy and Security > Two-Step Verification.
Where it arrives	Usually your other signed-in devices first; otherwise SMS, a call or email.	Nowhere — you type it from memory; a hint and recovery email can help.
When you're asked for it	Immediately, to begin any login.	Only after the login code succeeds, as a second step.
If forgotten or lost	Request a new one — old codes expire in minutes.	Use the recovery-email code, a reset from a signed-in device, or the account reset (which deletes the account).
Should you ever share it?	Never. Anyone asking for your login code is attempting to take over your account.	Never. Support never asks for it either — only phishers do.
Does Telegram support ask for it?	Never.	Never.

The login code proves it's your phone right now; the cloud password proves it's you across every login. They are two different things, and no one but you should ever know either.

FAQ

Which does Telegram ask for first — the login code or the cloud password?

With a phone-number login, the code comes first. You enter your phone number, Telegram sends a one-time code (usually to your other signed-in devices first; otherwise SMS, a call or email, as the login screen offers), and if you have Two-Step Verification enabled, it then asks for your cloud password. The code proves you hold the number; the cloud password proves you are the owner beyond the SIM.

What's the difference between the login code and the cloud password?

The login code is a single-use code Telegram sends when you sign in with your phone number, usually to your other signed-in devices first; otherwise SMS, a call or email, as the login screen offers. The cloud password is a standing password you created, asked for after the code when Two-Step Verification is on. One is temporary and delivered to you; the other is permanent and known only to you.

Someone says they can recover any Telegram account if I send them the login code — is that real?

No. That is the exact method used to steal accounts. The login code authorizes a sign-in, so anyone who gets it can log in as you. Telegram support never asks for it, and neither do we. This site only explains how to recover your own account through Telegram's official channels — we never obtain, intercept or ask for anyone's code, and we can't and won't access an account that isn't yours.

Where does the recovery email come in?

It’s the optional email you attach to your cloud password. A masked hint appears on the password screen, and if you forget the cloud password, ‘Forgot password?’ emails a recovery code there. No recovery email? A device that is still signed in can reset the password after a wait; with neither, only the account reset is left, and it deletes the account.

How do I tell whether a screen is asking for my one-time code or my cloud password?

The one-time code screen shows empty boxes and says a code was just sent to your phone or another session — it changes every login. The cloud-password screen asks for a password you set yourself and shows a masked recovery-email hint underneath. If the field expects the number texted to you, it's the login code; if it expects something you memorised, it's the cloud password.

What is @SpamBot and when do I use it?

@SpamBot is Telegram's official bot for account limits. If your account was restricted for spam — for example you can't message people who don't have your number — you message @SpamBot to check the status and appeal the limit. It is unrelated to login codes or cloud passwords.

Topic

How recovery works

Safety CenterThe line we don’t crossStart here What can’t be recoveredThe honest limits How we verify ownershipProof of ownership we ask for Assisted recovery serviceHands-on help for the verified owner “Hacking” an account: the honest answerWhy only your own account is recoverable Recovery FAQShort answers About TgHackerWho we are

Recovery glossaryTerms that decide your next stepYou are here

All recovery routes

Know the word, then take the step

Recovery goes wrong when the vocabulary does — a login code mistaken for a password, a reset mistaken for a rescue. With the terms straight, the next page in the cluster tells you exactly what to do for your own account, through Telegram's official channels only.

How we verify it's your account

Terms people mix up

Owner recovery vs the shortcut

FAQ

How recovery works

Related

Know the word, then take the step