How to Share and Import a Telegram Proxy Link (tg:// Format)

Someone pastes a long blue link into a channel, you tap it, Telegram pops up a dialog asking if you want to connect to a proxy, and suddenly your traffic is routing through a server you know nothing about. That link is a Telegram proxy link, and it carries everything Telegram needs to point your client at a different entry point. It also carries everything a stranger needs to watch where your packets go.

I run managed Telegram hosting in Singapore on dedicated hardware, real mobile IPs on Singtel, M1, StarHub, and Vivifi plus a Samsung cloud-phone fleet. Customers send and receive these links constantly, so I see both the clean version and the dangerous version. This walks through the exact format, how to build one, how to import it on each platform, and why importing a random one is a bad trade.

the link format explained

There are two link styles Telegram understands, and they do the same job. One uses the tg:// scheme that hands off directly to the app, the other uses an https://t.me/ URL that works from a browser or a chat and bounces into the app. Both encode the same parameters.

The parameters depend on the proxy type. MTProto is Telegram’s own proxy protocol, built to disguise traffic and slip past blocks. SOCKS5 is the generic proxy standard that almost everything supports. Here are both, in both schemes:

# MTProto (server, port, secret)
tg://proxy?server=HOST&port=PORT&secret=SECRET
https://t.me/proxy?server=HOST&port=PORT&secret=SECRET

# SOCKS5 (server, port, user, pass)
tg://socks?server=HOST&port=PORT&user=USERNAME&pass=PASSWORD
https://t.me/socks?server=HOST&port=PORT&user=USERNAME&pass=PASSWORD

Field by field, here is what each one means.

1. server. The hostname or IP of the proxy. For MTProto this is the box running the MTProto server. For SOCKS5 it is the SOCKS endpoint. This is the address your encrypted Telegram session will travel through.

2. port. The TCP port the proxy listens on. MTProto deployments often use 443 to blend in with normal HTTPS, but any port the operator opened is valid. SOCKS5 commonly sits on 1080 but again, whatever the operator set.

3. secret (MTProto only). A hex string that authenticates you to the MTProto server and keys the obfuscation. Modern secrets start with dd (a marker for the padded mode that resists traffic analysis) or with ee followed by a domain encoded in hex, which is the Fake-TLS mode that makes the connection look like a TLS handshake to a real website. The secret is not optional for MTProto. Without the exact secret the server will not talk to you.

4. user and pass (SOCKS5 only). Username and password for an authenticated SOCKS5 proxy. Some SOCKS5 proxies are open and take no credentials, in which case these fields are absent and the link is just server and port. If credentials are present they travel inside the link in plain text, which matters for how you share it.

If you want the protocol-level detail on what MTProto actually does to your packets, the breakdown is in what is an MTProto proxy, explained and what is the MTProto protocol, explained. For the practical choice between the two proxy types, MTProto vs SOCKS5 for Telegram lays out the trade-offs.

how to generate one

You cannot conjure a working link out of nothing. The link is just a wrapper around a proxy that already exists. So generation is really two steps: stand up a proxy, then encode its details into the link format.

1. Get the proxy details. From whoever runs the proxy you have four or five facts: the server address, the port, and either an MTProto secret or a SOCKS5 user and pass. If you run your own MTProto server (the official one or a community build), it prints the secret when it starts. If you use managed hosting, the panel hands you these values directly.

2. Fill in the template. Drop each value into the matching field. For an MTProto box at proxy.example.sg on port 443 with secret dd1a2b3c4d5e6f..., the link is:

tg://proxy?server=proxy.example.sg&port=443&secret=dd1a2b3c4d5e6f
https://t.me/proxy?server=proxy.example.sg&port=443&secret=dd1a2b3c4d5e6f

3. URL-encode anything unusual. If a SOCKS5 password contains characters like @, &, #, or spaces, they will break the query string. Percent-encode them: a space becomes %20, an @ becomes %40, an & becomes %26. The secret is already hex so it never needs encoding, but passwords often do.

4. Let the bot do it (the easy path). Telegram’s official @MTProxybot will generate the link for a registered MTProto server, and most MTProto server packages print a ready-to-paste link on startup. If you are sharing your own proxy, copy that output rather than hand-building the string, because a single wrong character in the secret means a silent connection failure.

The two schemes are interchangeable. Use https://t.me/proxy?... when you are posting somewhere that renders links, like a chat or a web page, because it is clickable everywhere and falls back to a help page if Telegram is not installed. Use tg://proxy?... when you want a direct hand-off to the app with no web round-trip.

how to import one per platform

Importing is mostly tapping the link and confirming. The manual entry path matters when you only have the raw values, or when you do not trust a link enough to tap it blind. Doing it by hand lets you read every field before you commit.

1. Android. Tapping a t.me/proxy or tg://proxy link opens Telegram and shows a connect dialog with the server and port visible. To enter it manually, go to Settings, Data and Storage, Proxy Settings, Add Proxy, then pick MTProto Proxy or SOCKS5 and type the fields. The full walkthrough with screenshots is in connect a Telegram proxy on Android.

2. iPhone. Same idea. Tapping the link triggers the connect prompt. Manual path is Settings, Data and Storage, Proxy, Add Proxy. iOS is fussier about background connections, so verify it actually connected before you rely on it, which connect a Telegram proxy on iPhone covers.

3. Desktop. On Telegram Desktop and macOS the link still works if Telegram is running, but the cleaner route is Settings, Advanced, Connection type, Use custom proxy, Add proxy. Desktop is where you will most often paste raw values from a panel. See connect a Telegram proxy on desktop.

On every platform, after import, test that it is actually carrying your traffic and not silently falling back to your real connection. A proxy that quietly fails open is worse than no proxy because you think you are covered when you are not. The method is in how to test if your Telegram proxy is leaking.

A proxy link is a credential. Treat it like one. Here is how to hand it out without burning yourself.

1. Know what you are giving away. When you share a SOCKS5 link with user and pass, those credentials are in the link in clear text. Anyone who sees the link can use your proxy, and on a metered or capacity-limited line, freeloaders degrade it for everyone. MTProto secrets are less sensitive than a password but still let anyone connect to your server.

2. Share narrow, not broad. Sending a link to one teammate over an end-to-end encrypted Secret Chat is fine. Pinning it in a 5,000-member public channel means thousands of strangers now route through your box, and you have no idea who they are or what they are doing through your IP.

3. Rotate after exposure. If a link leaks, change the secret or credentials and reissue. For MTProto, restart the server with a new secret. For SOCKS5, rotate the password. The old link goes dead, which is the point.

4. Prefer per-user secrets. Better MTProto setups issue a distinct secret per user so you can revoke one person without breaking everyone. Managed hosting does this for you. A single shared secret means one leak forces a rotation that kicks every legitimate user at once.

5. Do not post links that include real identity. The server hostname can reveal who you are or what infrastructure you run. If the proxy sits on the same IP as accounts you care about, sharing it widely links those accounts together in ways you may not want. This is part of why mass-shared free proxies cause account bans: everyone on that IP looks like one cluster.

the risk of stranger links

This is the part people skip. When you import a proxy link someone else posted, you are routing your Telegram traffic through their machine. Telegram’s content stays end-to-end encrypted in Secret Chats and transport-encrypted otherwise, so the operator cannot read your messages. But they can see plenty.

The proxy operator sees your real IP address, since you connect to them directly. They see connection metadata: when you are online, how much you send, the timing and size of your traffic, and which Telegram data centers you reach. With enough of that, traffic analysis can fingerprint behavior even without message contents. A malicious MTProto operator can also try to downgrade or interfere with the connection.

Free proxy links shared in channels are the worst case. You do not know who runs the box, why they run it for free, or what they log. Many are stood up specifically to collect IPs and usage patterns at scale, which is a cheap way to map who uses Telegram from where. If you are running multiple accounts, a hostile or simply careless operator can get all of them sharing one dirty IP, which is exactly the pattern Telegram flags. That is also a classic vector for session hijacking attempts, since the operator controls the path your auth traffic takes.

The rule is simple. Only import a proxy link from a source you would trust with your IP address and your online schedule, because that is precisely what you are handing them. A stranger in a channel does not clear that bar.

the managed-hosting angle

Most of the pain above comes from the same root: you are either trusting someone else’s box, or you are running your own and now you own the secret rotation, the per-user revocation, the IP reputation, and the uptime. Both are real work.

What we host is the boring, correct version of this. Telegram runs on dedicated SG hardware with the proxy already configured, so the link you get points at infrastructure that is yours, on a clean Singapore IP that has not been shared into a public channel. The IP underneath is a real mobile line on Singtel, M1, StarHub, or Vivifi, which is the address type Telegram treats most gently. Why that matters is covered in what a mobile IP is and why Telegram cares and the Singapore-specific case in the Singapore mobile IP advantage for Telegram.

You keep your own number (BYO-number), the secret is issued to you and rotated on request, and you are not sharing a line with anonymous freeloaders from a pasted link. For accounts where the IP and the session actually matter, that is the difference between a proxy you control and a proxy that controls you. If you want the full comparison of approaches including cloud phones, MTProto vs SOCKS5 vs cloud phone for Telegram breaks it down. The cloud-phone side connects to our wider mobile-IP network at singaporemobileproxy.com and the device fleet at cloudf.one.

For the canonical protocol reference, Telegram documents the proxy schemes at core.telegram.org.

final word

A Telegram proxy link is a small piece of text that hands your traffic path to whoever built it. Reading the format field by field takes thirty seconds and tells you exactly what you are connecting to: server, port, and either an MTProto secret or a SOCKS5 user and pass. Generate your own from a proxy you control, share it narrowly, rotate it when it leaks, and never import a stranger’s link unless you would trust that stranger with your IP and your schedule.

If you would rather skip the secret-rotation chore and the IP-reputation gamble entirely, that is what managed Telegram hosting on dedicated Singapore hardware is for. Mention code TGYT when you reach out. Start here.