Good Telegram account security starts with control of your phone number, private sign-in credentials and the devices that remain logged in. This guide covers the review steps an account owner can take in Telegram. It cannot recover an account or investigate a session for you.
Start with the active-device list
From a Telegram app you trust, open Settings → Devices or the equivalent session-management screen in your current version. Review each listed phone, computer and browser. End any session you do not recognize, and sign out of devices you no longer use.
If a device name or location looks unfamiliar, do not assume it proves a particular person or physical location. Network routing can affect location signals. Treat a session you did not initiate as a reason to secure the account, not as definitive evidence about who used it.
Keep at least one trusted session available while reviewing other devices. If you terminate every session and later cannot access your phone number or sign-in options, you may make account recovery more difficult.
Protect login codes and QR approvals
A Telegram login code is an authentication secret. Do not send it to a contact, bot, website, support agent or anyone who starts a conversation with you. A person who knows your phone number may still be unable to sign in without the required code and other protections, so keep those details private.
QR login also requires care. Approve a QR sign-in only when you personally opened a trusted Telegram login flow and intend to connect that device. A QR code in a chat, email or unfamiliar website is not a routine verification badge. See the safe login-code checklist and Web sign-in guide for those specific tasks.
Add or review two-step verification
Telegram’s two-step verification adds a password in addition to the login code for new sign-ins. Use a unique password that you do not reuse on other websites. If you configure a recovery email, secure that mailbox with its own strong password and available multi-factor protections.
Do not give the two-step password or recovery email code to a third party. If Telegram asks for the extra password after a code, that is a different step from code delivery. Follow the recovery options displayed by Telegram rather than using a service that promises to remove the password.
For detailed setup and recovery boundaries, see Telegram’s FAQ on two-step verification.
Check phone-number and discovery settings
Review who can see your phone number, who can find you by it and which profile details are public. Choose settings based on how you want contacts to discover you. A public username can make it possible to reach you without sharing your phone number, but it does not prove the identity of someone who contacts you.
Before sharing your username or joining a public group, consider what profile details are visible and whether the conversation is appropriate for that audience. Use Telegram’s privacy FAQ for current controls over number, contacts and discovery.
Understand what syncs across devices
Telegram cloud chats can appear across signed-in devices. Secret Chats are end-to-end encrypted and device-specific, according to Telegram’s FAQ; they are not part of the cloud sync. That distinction matters when replacing a phone or signing in on a desktop. Do not assume a missing Secret Chat means a new device is broken.
If you are setting up another device, use the device list in Telegram to check what to expect and how to review the new session.
If you suspect someone else accessed the account
Open a Telegram app you trust and review the device list.
Terminate sessions you did not initiate.
Change or enable two-step verification using Telegram’s current settings.
Secure the phone number and recovery email used for the account.
Ignore anyone asking you to forward a code or pay for account recovery.
If you cannot reach an active session, follow the recovery choices Telegram presents for your account. No website can bypass Telegram’s account protections.
Related Telegram help
Sources and editorial note
For current security controls, consult Telegram’s FAQ, applications directory and QR login documentation, then follow the instructions shown in your app.