Telegram cache on your own devices

A customer was handing a laptop back to a company he had stopped working for, and he asked me how to get Telegram off it properly. I told him to clear the cache and log out.

That answer was incomplete, and I gave it fast because it sounded like an easy question. Clearing the cache took the media. Logging out ended the session. The application directory was still sitting on that disk afterwards with the local message database inside it, and I had told a man who was about to hand hardware to people he had fallen out with that he was done.

He asked one more question he did not need to ask, which is the only reason we caught it.

I run managed Telegram hosting on dedicated hardware in Singapore, real handsets on real carrier SIMs, so a lot of my week is spent on machines that belong to other people. What Telegram leaves behind on those machines is more interesting than anything I find on the server side.

Two questions that keep getting merged

There is a server side question. What Telegram holds for you in the cloud, why there is no published quota, what gets removed first, and why an account that goes untouched for six months disappears and takes its one to one history with it. I have written that up separately.

This is the device side. The copy on the disk in front of you, under your user account, on that particular laptop or handset. Telegram’s retention policy has no authority over that copy. Your operating system does, and so does anybody with access to the machine or to its backups.

People assume the client is a thin window onto the server because their history reappears instantly on a new phone. Then the storage screen says 41 GB and the assumption falls over. A window would cost a few hundred megabytes. 41 GB is a copy.

What the client is actually holding

Telegram’s storage settings will break the number down by category: photos, videos, documents, music, voice messages, stickers and animations, and usually a large unexplained line called other.

Those are files on disk. Every image you scrolled past in a group. Every video that started playing on its own while you thumbed through a channel. Voice notes you listened to once, documents you opened, sticker packs somebody used at you in March. None of it was a decision. You scrolled, so the app wrote it down, so that the next time you scroll it opens instantly rather than going back out to the network.

Sitting next to the media is a database holding the messages themselves, the chat list, group membership and the local search index that keeps working when you are offline.

The media is what makes the storage number large. The database is where the actual exposure lives. Almost nobody holds both of those facts at once, which is why the conversation always starts with gigabytes and stops there.

To be fair before I complain: an app that refetched every image on every scroll would be unusable on a weak connection and expensive on a metered one. Every browser works the same way. The difference is that nobody keeps four years of private conversation in a browser cache.

Deleting the message does not reach the file

Anything cached is readable by anything that can read the device. Not by Telegram, and not over the network. By a person holding the open laptop, a repair technician, a process running under your user account, a backup job you configured once and forgot.

None of them need your number, your login code or your two factor password. The file is already decrypted on disk, because it has to be, because you asked to look at it.

The timing is where this gets unpleasant. You delete a message, for everyone. It leaves your chat, it leaves theirs, it goes from Telegram’s side. The image file stays in the cache folder, because the app removed a row and never went hunting for the file that row pointed at.

So a photo you retracted eight seconds after sending can still exist on a laptop a year later, with a timestamp, in a directory whose name means nothing to whoever opens it.

Secret chats sit under a completely different storage model and that distinction deserves its own treatment, which I have given it elsewhere. Everything here concerns ordinary cloud chats.

Your chat list is a view, not the filing system

The cache also ignores your housekeeping.

Leave a group and everything you already downloaded from it stays. Archive a conversation, clear the history on your side, mute it into silence: the files persist, because the cache is organised around files and the chat list is a view sitting above them.

Which is why the storage screen is such a poor guide to your exposure. The app shows six chats and a clean archive. The folder underneath holds media from thirty conversations, several of which you would struggle to name.

Shared hardware and the gap after logging out

The damage I actually see has nothing to do with attackers. It comes from shared machines. The office desktop. The family computer with one login and four users. A laptop lent to a relative for a fortnight.

Somebody signs in, uses Telegram for a week, logs out and considers it handled. Logging out ends the session. Removing the data is a second operation, and only the first one is obvious.

On desktop especially, the application data directory can outlive the session that created it. The account is disconnected, and everything downloaded while it was connected is still in a folder nobody thinks to open. Moving your account onto a new device is its own careful process and I have covered that separately, but the device you are leaving behind is the half people forget.

The two settings almost nobody sets

Telegram ships two controls that solve most of this, and both are effectively off by default, because the default is keep everything forever.

The first is a cache size limit. Name a ceiling, 5 GB or 10 GB or whatever suits the machine, and Telegram starts evicting the oldest media on its own once it hits that. No maintenance, no reminders, no 41 GB screenshot in six months.

The second is the keep media duration: three days, a week, a month, or forever. This one is the better of the two and it is the one nobody touches, because it sits a screen deeper and does not sound like it does anything. Set it to a week on a portable or shared machine and most of the problem stops existing, since media older than seven days leaves the disk and stays perfectly available from the server the moment you scroll back to it.

There is also automatic download, split by connection type and media type. Turning off automatic video download on wifi will change your storage curve more than any manual cleanup, because the quickest way to avoid storing something is to avoid fetching it.

Clearing costs you nothing

People hesitate over the clear cache button because the word cache gives a normal person no way to know whether their messages are inside it.

They are not. Clearing removes downloaded media. The messages stay, the chats stay, the account stays logged in, and anything you clear comes back down from the server the next time you open that conversation and scroll. The only real cost is bandwidth and a second of waiting, which is worth knowing before you clear 10 GB on mobile data.

The local database survives all of it. That is the separate item, and it goes when you log out of that device properly or when you delete the application along with its data. Two jobs, two buttons. Clear the cache when the disk is full. Log out and remove the app when the device is leaving your control. Doing the first and believing you have done the second is the easy mistake, because the number drops satisfyingly and the screen looks clean afterwards.

Backups copy the cache as well

If the device is backed up, so is the cache.

Your phone syncs to a cloud account overnight. Your laptop copies itself to an external drive, or to whatever your employer runs. Those processes have no idea what Telegram is. They see a directory of files and they copy the directory of files.

So the media now exists in a second location with its own access rules, its own set of people who can restore from it, and a retention policy that has nothing to do with anything you configured inside Telegram. It also outlives the handset. Clear the cache in March, put the phone in a drawer in June, and a backup taken in February is still sitting in an account you last opened on a machine you no longer own.

Worth separating, since the words collide: backing up your Telegram account is a different subject, about protecting the way back in, the number and the two factor password, and I have gone through that on its own. This is the opposite concern. This is data you never decided to keep, kept somewhere you never decided on.

What I cannot tell you

I can tell you the files exist, roughly where they live, and how to end up with fewer of them.

I cannot tell you what stays recoverable after you clear. Deleting a file marks space as reusable rather than scrubbing the disk, and database files in particular tend to leave readable fragments around for a long time. If your threat model includes somebody willing to run forensic tooling on the drive, a clear cache button is not the answer and I am not going to pretend otherwise.

I also cannot promise the layout holds still. Telegram has changed how much it keeps and where it keeps it across versions and platforms, so treat any specific folder path you read online, mine included, as something to verify rather than trust.

The shape does hold. The client keeps a full local copy, that copy answers to the device rather than to Telegram, and the storage number is the symptom you happen to notice and the least important thing in the situation. 41 GB is an annoyance. A readable copy of a two year old conversation on a machine that belongs to somebody else is not, and nothing on that storage screen will ever mention it.

telegramvault.org is managed Telegram hosting on dedicated Singapore hardware, which keeps the account on a device that stays in a rack under settings somebody actually chose, instead of a laptop that gets lent out. Onboarding starts with a conversation about your setup, and the code TGYT gets you a discount when you start.

Get new guides and videos first — join the Telegram channel.