Prevention & Security Hub
Telegram Security Center — Harden Your Own Account Before Lockout
Many Telegram takeovers start with a shared login code, not a cracked password. Set up Two-Step Verification, keep a recovery email on file, audit your active sessions, and learn to refuse code-phishing — all with Telegram's official tools, for the account you own.
Harden my account nowAlready locked out? Start recoveryOwner-Only
Every step is for the account you own and are signed into — nothing else.
No Code Ever Asked
We never ask for your login code. Enter it only into a login you started yourself in an official Telegram app; never give it to a person, bot or page.
Official Tools Only
All guidance uses Telegram's own in-app settings, t.me and web.telegram.org.
No Account Access
This is a reference site; we hold no credentials and store no login data.
Accurate & Maintained
Real UI paths and behaviors, reviewed against current Telegram apps.
No bypass tools, no interception, no monitoring of anyone else — by design, not by promise.
Your ten-minute security checkup
Tick each item as you finish it in your own Telegram app. Every row links to the guide that walks you through it.
Nothing here is saved or sent anywhere: the ticks live only in this browser tab. All of it is done in Telegram’s own settings or with your own carrier and email provider.
📷 Two Step Verification Screen
Turn On Two-Step Verification
The single strongest lock on a Telegram account.
- Open Settings > Privacy and Security > Two-Step Verification and set a cloud password you'll remember.
- Add a recovery email in the same flow — the address you enter is what lets you reset the password later.
- The password hint you set appears on the sign-in screen — keep it a nudge, not the answer.
📷 Active Sessions List
Audit Active Sessions & Devices
See everywhere your account is currently logged in.
- Go to Settings > Devices (or Privacy and Security > Active Sessions) to list every session with app, platform, location and last-active time.
- Tap any unfamiliar session to end it, or use ‘Terminate All Other Sessions’ to sign out everything but this device. Do it from a device signed in for more than 24 hours; a brand-new session can’t terminate others.
- Set sessions to auto-terminate after 1 week, 1 month, 3 months or 6 months of inactivity.
📷 Login Alert Notification
Watch for Login Alerts
Telegram tells you the instant a new device connects.
- A service message from the official Telegram account arrives whenever your number signs in on a new device.
- If you didn’t do it, open Settings › Devices on a device signed in for more than 24 hours, terminate that session, then change your cloud password.
- Know where codes arrive: usually in the “Telegram” chat on your other signed-in devices, otherwise by SMS, a call or email, as the login screen offers. A code you didn’t request means someone typed your number.
📷 Qr Link Desktop
Link Desktop & Web Safely
QR login keeps the code on your own phone.
- On Telegram Desktop or web.telegram.org, choose 'Log in by QR Code' — the screen displays the code.
- Your already-signed-in phone scans it from Settings > Devices > Link Desktop Device.
- You never type or forward a code. The flip side: only scan a QR code shown on a screen you opened yourself. Scanning a QR someone sent you links THEIR device to your account.
FAQ
What does Two-Step Verification actually protect against?
It stops a stolen login code from being enough on its own. Without a cloud password, anyone who tricks you into sharing the one-time code — a common Telegram takeover method — can sign in. With Two-Step Verification on, they would also need a cloud password only you know, so a leaked code alone fails. Set it under Settings > Privacy and Security > Two-Step Verification. For how the login code and the cloud password differ, see our recovery FAQ.
Can you access or secure someone else's Telegram account for me, or get their login code?
No. This is an owner-only reference for the account you personally control and are signed into. We never obtain, intercept, or ask for anyone's login code, and neither does legitimate Telegram support — 'send me the code' is exactly how accounts get stolen. We don't offer 2FA bypass, session hijacking, chat monitoring, OTP interception, or access to any account you don't own. Everything here uses Telegram's own official settings.
How do I see every device logged into my account?
Open Settings > Devices (on some apps, Settings > Privacy and Security > Active Sessions). You'll see each session with its app, platform, approximate location and last-active time. Tap any device you don't recognize to end it, or use 'Terminate All Other Sessions' to sign out everything except the device in your hand. You can also set sessions to auto-terminate after a week, a month, three or six months of inactivity.
What is the safest way to add Two-Step Verification?
Go to Settings > Privacy and Security > Two-Step Verification and set a cloud password you can remember. Add a recovery email in the same flow — that address is what lets you reset the password later, and the hint you set appears on the sign-in screen. Keep the hint a reminder rather than the answer, and make sure the recovery mailbox itself has its own two-factor authentication.
Someone got a login code — did they take my account?
Not by itself. To get in, someone has to obtain your code and use it, by tricking you into sharing it or by receiving it on a hijacked number. Telegram usually sends the code to your other signed-in devices first, in the “Telegram” chat; otherwise the login screen may offer SMS, a call or email. A code you didn’t request means someone typed your number. If you get a new-login alert you didn’t cause, open Settings › Devices on a device signed in for more than 24 hours, terminate the unknown session, then change your cloud password. With Two-Step Verification on, a stolen code still isn’t enough: they would also need your cloud password.
Is QR login safe?
Yes, when you start it yourself. On Telegram Desktop or web.telegram.org you choose ‘Log in by QR Code’, the screen shows the code, and your already-signed-in phone scans it from Settings › Devices › Link Desktop Device. You never type or forward anything. The risk runs the other way: a QR code someone sends you, or one on a page you didn’t open yourself, may be their login screen, and scanning it signs THEIR device into your account. Only scan a code shown on a device you are setting up yourself.
Topic
Protect your account
Security CenterHarden the account before anything happensYou are here
Set up Two-Step VerificationAdd a cloud password in two minutesSIM-swap protectionStop a number port from becoming a takeoverMonitor your own accountWatch your own account for intrusionsSecure it today, not after the lockout
The best time to set a cloud password, save a recovery email, and clear out stale sessions is before anything goes wrong. Spend ten minutes in Telegram's official settings now, and a stolen code, a lost phone, or a phishing message stops being a crisis. If you're already locked out, start with the recovery safety center — owner-only, official channels, no login code ever shared.
Open the Recovery Safety Center