Telegram privacy settings that matter, and the order to do them in

Every “I have lost my account” message I have been sent came down to the same thing. A login code arrived as a text on a number somebody else could read. No exploit, no broken encryption, nothing you could write an interesting post about.

I host Telegram sessions on dedicated hardware in Singapore for people who need an account to stay reachable, so these reach me after the fact.

The menu is sorted backwards

The privacy screen opens on last seen, phone number, profile photo. Visibility settings. They feel like privacy, and they are where people spend their fifteen minutes.

Two step verification sits further down, under a name that sounds like friction on your messages. It is the only control on that page that decides whether the account is still yours next month.

So split the menu into two piles. One decides what strangers can see about you. The other decides who can take the account off you. Second pile first.

Set a cloud password

Settings, then Privacy and Security, then Two Step Verification.

Without one, the whole security model is that a six digit code arrives by text and whoever holds the SIM at that moment reads it. That is it. Same model your bank ran in 2012, same weakness: the number was never yours. You lease it from a carrier, and it goes back in the pool when you stop paying.

With a cloud password set, the code stops being sufficient. Someone holding your number hits a second prompt they cannot answer.

“Two step verification” sounds like something you type every time you open a chat, which is why people skip it. You do not. It applies when a new device signs in, a handful of times a year for most people.

Write it down on paper. I keep mine on paper. There is no support ticket that recovers a Telegram account, no human at the other end who can look you up. Lose the password and the recovery email together and the account is gone in a way very few things are gone.

The recovery email is where the account really lives

Setting the cloud password prompts you for a recovery email, and most people put in whatever address autocompletes.

Look at what that does. Anyone who reaches that mailbox can reset the password and sign in. Your account is now exactly as strong as that inbox, and no stronger.

A Yahoo address from 2011 with no second factor on it, sitting in some credential dump, is what stands between a stranger and six years of your chat history.

Use the mailbox you actually defend. Setting no recovery email at all is defensible, as long as you are honest that forgetting the password then ends the account permanently.

Who can find you by number

Now the visibility pile, starting with the one worth the most.

Your number is visible to your contacts by default, which is fine. Underneath it sits a separate control for who can find your account by searching the number. That is the one people miss.

Leave it open and your number becomes a lookup key. It has been on a Carousell listing, on an invoice, in a group chat you left in 2019, in whatever database your gym runs. Anybody holding it can pull up your profile, see your photo, and message you. Set it to My Contacts and that route closes.

One thing before you hide the number from everybody: people in a group can still tell the account exists, they just cannot see the digits. It removes a field, not your presence.

While you are in there, set group invites to My Contacts. The default lets anybody add you without asking, which is how you wake up in a channel of four thousand accounts advertising something in a language you do not read. Outsiders can still send you a link and let you decide.

The session list nobody opens

Go to Devices. Read the list properly.

On any account a couple of years old there is usually something that should not be. A phone that was traded in. A desktop client on a machine at a job you left. A browser session from the one time you used Telegram Web on a hotel PC.

Every one of those can read your cloud chats right now. No password prompt, no code. That is what a signed in session is, and the list stays invisible until you open it, so it accumulates quietly for years.

Terminate anything you do not recognise. Then cut the automatic termination setting down.

The default is six months. Long enough for a sold phone to sit in somebody else’s drawer, still signed in, still syncing, for half a year. One week is one of the options. I have never met anyone who picked it without being told to.

I run this check on managed accounts as routine and still turn up surprises. Nearly always a device that left the owner’s hands while signed in.

Last seen is symmetric, and exceptions are the fix

Hide your last seen and you stop seeing everyone else’s. Telegram built that deliberately.

So the choice is about more than your own privacy. Most people flip it, lose sight of the four or five they actually coordinate with, and flip it back inside a fortnight.

The way through is exceptions. Hide it from everybody, then add the handful who genuinely need to know whether you are around. You keep seeing them, they keep seeing you, the rest of the world gets nothing. That mechanism sits on most of these settings and nobody opens it.

Forwards carry a link back to you

By default, when somebody forwards a message you wrote, your name in the forward header is a live link straight to your profile.

So a line you typed in a group of twelve can land in a group of four thousand with a working route back to your account attached.

There is a setting that strips the link. Your name still shows, as plain text.

For anything work adjacent I turn it off. A message travelling further than you expected is normal. The link travelling with it is a separate thing you never agreed to.

What none of this covers

Ordinary Telegram chats are encrypted between your device and the servers, then stored on those servers so they can sync. That storage is the feature you rely on. It is why signing in on a new laptop hands you years of backlog in seconds.

It also means the contents live on hardware you do not own. No toggle in the privacy menu changes that, because it is how the product was built.

Secret chats are the end to end option and they cost you things. One device only. No cloud history. They vanish if you sign out.

I am not going to tell you to move everything across, because I have not done it myself. Just know which of your conversations is which. Plenty of people believe the whole app behaves the way secret chats do, and they make decisions on that basis.

The profile photo detail

You can restrict who sees your profile photo and you probably should. What catches people out is that a restricted photo still renders a placeholder with your initial, and your display name shows in any group regardless.

If the goal is to be hard to identify, the photo setting is a small piece. The name field does most of the work.

What actually goes wrong

Three patterns, and notice afterwards what is absent from all of them.

A number gets recycled. Somebody stops paying for a prepaid line, the carrier returns it to the pool, and months later a stranger’s phone buzzes with a login code for an account they have never heard of. Cloud password on, nothing happens. Cloud password off, they are in.

Somebody already has access to the SIM. A family member, a shared work handset, a phone in a drawer at the office. Text messages are not private to the account holder in the way people assume.

Then the stale session, which is the most common of the lot and the least dramatic. Nobody attacked anything. A device walked off still logged in.

Nothing on that list involves encryption breaking or a clever exploit. The failures are administrative, which is why all of them are preventable in about five minutes.

The five minute pass

In the order I would work it:

• cloud password on, written on paper, recovery email pointed at a mailbox you defend
• devices list opened, unknowns terminated, auto expiry cut from six months to one week
• who can find me by number set to My Contacts
• group invites set to My Contacts
• last seen hidden from everybody, with exceptions for the few it matters for
• forward link turned off if your messages get passed around

Where I had this wrong

For a long time I treated the phone number settings as the important ones. They sit at the top of the menu, they feel like privacy, and configuring them feels like progress.

Then I watched an account go with every one of those set perfectly. There was no cloud password, and the number had changed hands. All that careful configuration protected nothing, because it was answering a question nobody had asked.

The ordering above is deliberate. Settings that control what strangers see about you are worth an afternoon. The setting that controls whether the account remains yours is worth doing first, and Telegram buried it a level deeper than the rest.

If you want Telegram running on hosting that stays up, on dedicated hardware in Singapore, with the session hygiene above handled for you, that is what we do at telegramvault.org.

Get new guides and videos first — join the Telegram channel.