How to Audit Your Telegram Active Sessions (2026)

what you will end up with

You will have a clear picture of every device currently logged into your Telegram account, know which sessions are yours and which are not, and have revoked anything suspicious. The process takes under five minutes on a phone you control. No technical background required, but you do need physical access to your primary device (the one you use to receive OTP codes).

before you start

You need a phone or desktop with Telegram installed and a working login on your main account. The session audit works identically on Telegram for Android, iOS, and the desktop clients (Windows, macOS, Linux). Make sure you are running Telegram version 9.0 or later. Older builds have a simplified session view that hides the device fingerprint fields. If you are on a shared device or a cloud phone environment, confirm which account you are reviewing before you start, because the session list is per-account, not per-device.

# verify your telegram build version
# Android: Settings > About > App version
# iOS: Settings > About > Telegram version
# Desktop: Telegram menu > About Telegram
# minimum recommended: 9.0.x (2023 and later)

the step-by-step

open Settings, then tap Devices. On Android and iOS, tap the hamburger menu (three horizontal lines, top left), then tap Settings. Look for “Devices” in the list, usually between Privacy and Security. On desktop, go to Settings > Privacy and Security > Active Sessions. You will land on a screen titled “Active Sessions” with a list of every currently logged-in session. Each row shows an app name, a device name, and the approximate login time.
read the current session entry at the top. Telegram always pins “This device” at the top of the list. It shows your current app version, OS version, and IP address. The IP shown is your outbound IP, meaning the IP your device was using when this session last made an API call. If you are on mobile data, it is your carrier IP. On Wi-Fi it is your router’s public IP. Write this down or remember the format, because all other sessions below follow the same structure.
expand each session row to see the full fingerprint. Tap or click any session to see the detail view. You will see: app name and version, device model, operating system, IP address, and location (derived from IP via geolocation, not GPS). The location is city-level and can be wrong by one or two cities. A wrong continent is a red flag. You will also see the last active timestamp. A session that was active three minutes ago from a city you have never visited is a problem.
cross-check the IP address against what you know. If you use a VPN, your sessions will show the VPN exit IP, not your real location. That is expected. What is not expected: an IP sitting in a data center ASN (look up unfamiliar IPs at a public IP lookup or check the ASN with a WHOIS tool), an IP from a country you have no connection to, or a session showing a residential IP in a city you have never been to. Any of these patterns deserves a closer look before you dismiss it.
spot a rogue session using the four signals. A session is suspicious if any of these are true: (a) the device model is one you do not own; (b) the app version is much older than the current release (someone running a modified client often does not update); (c) the location is geographically impossible given your travel history; (d) the session is active at hours when you are asleep and you have no automation running. One signal alone is sometimes a false positive. Two or more together means act now.
revoke a specific session. In the session detail view, tap “Terminate Session.” Telegram will ask you to confirm. After confirmation, the session is invalidated immediately on Telegram’s servers. The device holding that session will be logged out the next time it tries to make an API call, usually within seconds. The person on that device cannot log back in without your phone number and a new OTP, which will arrive only on your registered SIM.
use “Terminate All Other Sessions” for a full sweep. If you find more than one suspicious entry, do not revoke them one by one. Scroll to the bottom of the Active Sessions screen and tap “Terminate All Other Sessions.” This kills every session except the one you are currently using. Telegram sends a notification to every terminated session. Anyone who had unauthorized access loses it instantly. This is the nuclear option and the right call if you cannot clearly identify every session in the list.
set up session expiry after the sweep. After terminating rogue sessions, go to Settings > Privacy and Security > Automatically Terminate Sessions. Set this to “1 month” or “1 week” depending on your operational needs. Sessions that go inactive longer than that threshold are terminated automatically. This closes the window for persistent low-activity sessions that an attacker might keep alive by sending a periodic heartbeat ping.

# if you want to script session monitoring via the Telegram Bot API,
# the getMe and getUpdates endpoints can confirm your bot session health.
# for user-account session auditing there is no official public API;
# the session list is only accessible through official clients.
# any third-party tool claiming to expose session data via API
# is either using unofficial MTProto wrappers or is a phishing kit.

change your Two-Step Verification password after a confirmed breach. If you found and terminated a session you did not create, someone had access. Revoking the session removes active access but does not change your credentials. Go to Settings > Privacy and Security > Two-Step Verification and update the password immediately. If you had no Two-Step Verification enabled, turn it on now. Without it, anyone who intercepts an SMS OTP can log into your account. That is a well-documented attack vector described in telegram-ota-update-targets-uyghurs-tibetans-and-others-who-speak-up/" target="_blank" rel="noopener">Citizen Lab research on targeted Telegram account takeovers.
document what you found before closing the screen. Before you leave the session list, screenshot or note down the IP addresses and device names of any sessions you terminated. If you are dealing with a targeted attack, this information may be useful when reporting to Telegram support or to your legal counsel. The session list does not retain terminated session history after you close it.

what can go wrong

The session list shows only one entry even though you are logged in on multiple devices. This usually means your other clients have not made an API call recently and Telegram is showing stale state. Force-close and reopen Telegram on your other devices, then refresh the session list. If the other sessions do not appear within a minute, those clients may have already been silently terminated by Telegram due to inactivity or an earlier forced logout.

You terminate a session and it reappears shortly after. This is rare but it happens when someone has your login credentials and is actively re-logging in. Terminating is not enough if the attacker can get a new OTP. The fix is to immediately change your phone number’s SIM to a new one (if you suspect SIM swap), or transfer your Telegram account to a new phone number entirely. The telegram.org/api/auth" target="_blank" rel="noopener">Telegram core API auth documentation explains how re-authentication works at the protocol level.

The “Terminate All Other Sessions” button is grayed out or missing. This happens when you are viewing the session list while offline, or when Telegram’s servers are under load. Check your network connection. If the button is consistently missing across multiple restarts, update your Telegram client. Very old clients sometimes render an incomplete session management UI.

You accidentally terminate your own active session on another device you need. There is no undo. You will need to log back into Telegram on the affected device using your phone number and a fresh OTP. If the affected device is a remote cloud phone or an embedded deployment, you will need physical or remote access to that device to complete the login flow. Plan for this before you run a full session termination sweep.

how this looks on managed hosting

When your Telegram account lives on a telegramvault cloud phone, the session audit works the same way from the Telegram UI, but a few things look different. The “current device” session will show a Singapore-based IP from one of the SingTel, M1, StarHub, or Vivifi carrier ranges. That is expected and correct. The device model will show an Android hardware fingerprint from the physical handset in the Singapore farm, not your personal phone.

You still do the audit from your own copy of Telegram (on your phone or desktop), because the cloud phone’s session appears as one entry among all your telegram active sessions. If you see the Singapore session plus your own phone session, that is the normal two-session picture for a telegramvault deployment. Anything beyond those two warrants a look. You do not need to log into the cloud phone to run the audit; everything is visible from any authenticated session. The main practical difference is that you will not recognize the device model name on the cloud session, so note it down during onboarding and keep it somewhere you can check later. More context on the single-static-IP approach is in the post on dedicated vs shared mobile IPs.

recovery if you mess up

If you ran “Terminate All Other Sessions” and accidentally locked yourself out of a device you needed, the recovery path is straightforward: open Telegram on your primary SIM device (the one registered to the account), go through the login flow on the affected device using your phone number, and enter the OTP. You are back in within two minutes if you have your SIM handy.

If you cannot receive the OTP because your SIM was swapped or compromised, contact your carrier first to restore SIM control, then re-authenticate. Telegram support response times for account recovery requests are historically slow, often several business days or longer. Do not count on them for anything time-sensitive. The EFF’s guide on SIM swap protection covers the carrier-side steps in detail.

If you need to transfer your account to a new phone number after a breach, Telegram’s “Change Number” feature (Settings > Phone Number > Change Number) migrates your chats, contacts, and group memberships. It does not migrate your session history. All existing sessions on the old number are terminated automatically when the transfer completes.

For telegramvault customers: if something goes wrong during a session audit that affects the cloud phone session, reach out through the onboarding channel. The team can confirm the Singapore session fingerprint, validate the IP, and help you distinguish a real intrusion from a false alarm on the managed side.

Setting up Two-Step Verification. The single most impactful thing you can do after a session audit is enabling Two-Step Verification if it is not already on. It requires a password in addition to the OTP, and it is the difference between a one-minute account takeover and a meaningless attempt. The setup is in Settings > Privacy and Security > Two-Step Verification. Use a password manager to generate and store the password, not a memorable phrase.

Understanding why Telegram bans accounts. Rogue sessions are one source of account health problems, but they are not the only one. If someone used your account without your knowledge, they may have sent spam, joined restricted channels, or triggered rate limits that put your account on Telegram’s radar. The post on why Telegram bans accounts covers what behaviors trigger automated bans and what signals Telegram’s systems watch for.

Running Telegram from a fixed mobile IP. A consistent IP fingerprint makes anomalous sessions easier to spot, because every legitimate session shows the same ASN and city. If your account logs in from a different IP every time (VPN rotation, shared residential proxies), distinguishing a rogue session from a normal one becomes much harder. The post on BYO number Telegram hosting explains how fixed-SIM hosting changes the security posture.

Monitoring for account-targeting activity in high-risk regions. If you are operating from Iran, Russia, Azerbaijan, or any country where state actors routinely target Telegram users, session audits should be part of a regular routine, not a one-off response to something suspicious. Access Now’s Digital Security Helpline provides free support to journalists, activists, and civil society organizations dealing with targeted attacks, including Telegram-specific threats.

final word

Checking your telegram active sessions takes five minutes and costs nothing. The information is sitting there in your Settings, and most people never look at it until something goes wrong. If you find a session you did not create, the steps above will close it. If you want a hosting setup where the session fingerprint is stable and easy to audit because it never moves off a single Singapore mobile IP, the telegramvault waitlist is open.