Today we’re going to talk about Telegram. You can find lots of free messaging apps out there. However, finding a free messaging app that is also secure, and has enough users to make it worth using, is a lot harder.
This Telegram review is not going to cut any corners and we will review the good and the bad aspects of this service. While it may have some good privacy options, an investigation out of Germany concluded that Telegram shares data with governments.
While Telegram is totally free and growing like crazy, we’d recommend considering all your other options before signing up. In this new and updated Telegram review, we’ll look at the privacy and security offered by the service to help you to decide if this is going to be a secure messaging app you should consider using.
Telegram pros & cons
+ Pros
- End-to-end (E2E) encryption
- Encryption algorithms: MTProto, a custom protocol
- Open source apps and Telegram Database Library
- Self-destructing messages
- Users can be logged in on multiple devices simultaneously
- Supports Two-Step Verification
- GDPR compliant
– Cons
- Registration requires a phone number
- E2E encryption only for Secret Chats
- Servers are not open source
- Logs IP Address and other user data (use a good VPN service)
- May be sharing data with government agencies
Now we’ll briefly touch on the main features of Telegram messenger.
Telegram messenger features
Here are some key features to consider when deciding whether Telegram is right for you:
- Code for the open source parts is available on GitHub
- Telegram apps for Android, iOS, Windows Phone, Mac OS, Windows, Linux, popular browsers
- In excess of 500,000 active users
For this review, we downloaded and tested Telegram desktop and mobile apps.
Telegram company background information
Telegram Messenger was created by brothers Nikolai and Pavel Durov in 2013. With over 500 million active users, it is one of the most popular messaging apps in the world. The company is headquartered in London, with the development team based in Dubai. The company is funded through a donation by Pavel.
Where is your Telegram data stored?
Telegram has a hybrid system for storing your data. By default, all your message data is stored on your devices. However, you can remove data from this local cache, and store it on Telegram’s servers. This allows you to balance your desire for privacy against the need for data storage space.
Those Telegram servers are located throughout the world as part of a distributed network.
Telegram third-party testing and audits
Telegram told us in an email that, “Multiple researchers and security experts have analyzed Telegram’s encryption.” As an example, the provided a paper from two researchers in Italy who examined the MTProto 2.0, as you can see here.
Nonetheless, we were not able to find any formal security audit or analysis that was conducted by a cybersecurity firm. This is in contrast to some of the other popular secure messenger services.
As we noted in both the Wire review and the Signal review, these encrypted messaging apps have undergone formal third-party audits.
Telegram messenger hands-on testing
For purposes of this Telegram review, I used the Telegram mobile app for Android, along with the Windows Desktop app. Since Telegram focuses on the mobile experience and requires you to join the service using a mobile device before you can use a browser or Desktop app, we’ll concentrate on the mobile side of things first.
Telegram Android app
Installing Telegram on an Android phone involves downloading the app and registering your phone number. This is similar to Signal messenger, which also requires a phone number to use the service. You can either download the app from the Google Play store, or download the Android APK directly from the Telegram website.
Once you finish installing and registering your account, you will be able to use the Telegram app to communicate with other Telegram users by text, voice, photos, video, group messaging, and channels (subscription broadcasts). File sharing is also supported.
Working with Telegram apps
Opening the Telegram app shows you a list of your Telegram contacts. If you’ve used any of the popular instant messaging apps, the interface should look familiar to you:
Tap a contact to see the full chat thread containing your conversation with that person, group, or channel. This is all pretty standard stuff; the kind of stuff you would expect to find on any of the best messaging apps. However, Telegram offers several other features that help explain why this is one of the most popular secure messaging apps.
Additional Telegram app features
Going beyond basic messages, Telegram has interesting and useful features like these:
- Groups – Supporting up to 200,000 members per group, Telegram group chats helped protesters get organized during the mega-protests of 2019. Apparently, both groups and channels were used by the protesters, resulting in a large DDOS (Distributed Denial of Service) attack against the service. Telegram stated that the IP addresses of the computers involved in the attack were mostly Chinese.
- Channels – Channels allow you to broadcast messages to an unlimited number of Telegram users. This feature was also apparently used during the Hong Kong protests. A recent addition to Channels is a way to view detailed statistics about channel viewership.
- Instant View – Instant View is a system to, “…view articles from around the Web in a consistent way, with zero loading time.” If you receive a link via Telegram, you can tap the Instant View button to instantly see a version of the page that has been optimized for viewing in Telegram. Because the page is cached in Telegram’s servers, it downloads in a split second. Instant View isn’t available in the desktop versions of Telegram.
- Bots – Bots are computer programs that run in Telegram. They have a wide range of capabilities, and anyone with a reasonable level of programming skills can write and publish their own.
- Live Locations – Share your location live in a chat for 15 minutes, one hour, or eight hours. If multiple users share their live location within a group, they are shown on an interactive map.
- Telegram Passport – Telegram Passport is an encrypted way to store your identity documents on Telegram servers. Once stored here, you can easily share them with services that require real-world IDs.
- Persistent Conference Calls – In their final update of 2020, Telegram revamped their voice chat system to allow for persistent conference calls that individuals can leave and rejoin at will. While they joke that the update was delivered in time for remote Christmas carols, this update could become a major selling point in the age of COVID lockdowns.
Now we will take a close look at using Telegram on your desktop.
Telegram Desktop clients
Installing Telegram Desktop on your desktop is just like installing any other app. It only takes a moment to download, and seconds to install. Once you do, Telegram opens and asks you to enter the telephone number you used to register your mobile app. Alternately, you can click the Quick log in using QR code link and follow those directions. Either way, you’ll soon see the familiar Telegram user interface translated onto your desktop.
Telegram officially supports the following desktop platforms:
- Windows
- Mac OS
- Linux (64 bit and 32 bit)
Here is a screenshot of the Telegram desktop app I tested out on Mac OS.
One drawback with the Telegram desktop app is that you won’t have access to all the same features and capabilities that you do on your phone. However, if nothing else, the Desktop app will be a lifesaver in those times when you need to send long text messages.
Aside from using the Telegram desktop app, there is also a Telegram web client here. (Be sure to use a secure browser that respects your privacy when using web clients.)
Support
Telegram’s support site takes the form of a huge FAQ page. This page (seen below) links to an immense amount of helpful information about Telegram. While working on this Telegram review, I was able to find the answers to any questions that came up by searching the FAQ.
Of course, I can’t guarantee that you will never need support from a live person. That shouldn’t be a problem, as Telegram offers you several ways to get in touch with their support team. Instead of listing out all the options here, just go to the Support section of that huge Telegram FAQ page.
How secure and private is Telegram?
Telegram has taken a beating over the years due to doubts about its security model. The concerns target two main areas: E2E encryption, and MTProto security. Let’s examine each of these areas.
E2E encryption
The concern about Telegram’s E2E encryption is that it is not applied by default. Most chats (Cloud chats) on Telegram are securely encrypted while in transit between your devices and Telegram’s servers. Once chat messages arrive at the Telegram servers, they are encrypted using MTProto while at rest on the servers. However, Telegram can read chat data since it handles the encryption/decryption of messages at the servers.
Other secure messaging services such as Signal, apply E2E encryption on all communications by default. The service cannot read those messages. Only the sender and the recipient can read E2E encrypted messages. In other words, any service that uses E2E encryption for all their messages will be more secure than Telegram.
Telegram does support E2E encryption for two types of communications: Secret Chats, and voice calls. Secret Chats are chats that are not stored on Telegram servers, and are only accessible to the devices involved in the chat. Secret Chats should be as secure as MTProto, but users need to remember to turn them on.
Voice calls are automatically E2E encrypted, likewise making them as secure as MTProto allows.
MTProto security
MTProto is the custom mobile protocol designed by the Telegram team. While I am not qualified to comment on the security of the protocol, it has been criticized by numerous cryptography experts. Check out this Wikipedia link to get a better sense of the flak this protocol has taken over the years.
Telegram logs IP address and metadata
On the privacy front, Telegram can collect a decent amount of personal information, which it can keep for up to 12 months. According to their Privacy Policy, they,
may collect metadata such as your IP address, devices and Telegram apps you’ve used, history of username changes, etc.
They may use aggregated metadata from you to help them create new features for the service.
Finally, the company has the ability to read any of your Cloud Chat messages to investigate spam and other violations of their Terms of Service. They may share some of your personal data with other Telegram users you choose to communicate with and companies within the Telegram Group. If forced by a court order, they may provide your IP address and mobile number to the appropriate authorities. (We also discovered this in our ProtonVPN review.)
It would be wise to use Secret Chats and voice calls whenever you wish to share private information on Telegram.
There is also a section of the Privacy Policy titled, “Law Enforcement Authorities” that reads as follows:
If Telegram receives a court order that confirms you’re a terror suspect, we may disclose your IP address and phone number to the relevant authorities. So far, this has never happened. When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.
This is important to keep in mind when using Telegram.
Does Telegram share data with governments?
We have an entire article dedicated to the question of whether Telegram shares data with governments. But to summarize the situation, here are a few key points:
- Telegram claims on its Privacy Policy page that a mandatory disclosure of user data “has never happened.”
- However, a report from Germany’s Der Spiegel claims that Telegram is actively sharing user data with the German government. Additionally, Telegram is censoring content at the request of the German government (according to Der Spiegel).
- Telegrams Transparency Report channel does not include any information.
You can make of this situation what you will, but it does not look good for Telegram and privacy.
Using a VPN with Telegram
As noted above, Telegram will record your IP address and keep it for up to 12 months. This links your identity up with your Telegram activity, chats, etc. Therefore you should take this into consideration based on your threat model and unique needs.
To hide your IP address when using Telegram, you can use a VPN (virtual private network). A VPN with Telegram will hide your IP address and location, while also encrypting your internet traffic. Some of our top-recommended VPNs include NordVPN, which is based in Panama, as well as Surfshark and ExpressVPN.
Note: A VPN is not a silver bullet that hides all your metadata. However, it will securely encrypt traffic between your device and a VPN server, while also concealing your true location and IP address. See these best VPN services for more options and info.
Using Telegram without your real phone number
While we’re on the topic of privacy, it’s also important to note that Telegram requires a phone number to create an account. This is a verification step to prevent bots and spammers from mass-registering.
Verification happens via a text message or phone call, and then you enter the verification code to begin using the service. But here’s the important privacy tip: you don’t have to use your phone number.
There are many anonymous SMS services you can find online that allow you to receive text messages to digital numbers. There are both free and paid SMS services available that you can find with a little bit of research (enter a search term like disposable SMS into your browser). You may have to try with a few different services and numbers before you can get a Telegram verification code to come through and work, but it will ensure your real phone number stays safe.
Registering with a disposable SMS number, and using a good VPN when you use Telegram will significantly increase your privacy.
Telegram business features
Like its main competitor for WhatsApp escapees, Signal, Telegram Messenger is only available as a single, free version. There are no pricing tiers, no extra-cost features, and no business-specific features.
Telegram prices = free
As mentioned above, Telegram is 100% free of charge. The company has stated that if they run low on money, they might add some non-essential premium features, but as of now, there is only the one, free version.
Telegram review conclusion
Telegram is one of the most popular messaging apps in the world with over 500 million active users. At the moment, it appears to be the primary destination for people who want an alternative to WhatsApp. Add in the fact that it is free, fast, and has tons of useful and fun features beyond basic messaging, and it’s easy to see why Telegram is so popular.
But popularity does not necessarily mean it is secure or a good option for privacy-conscious users. As I showed above, there are many experts in the cryptography community that have raised doubts about Telegram’s security. At the same time, the fact that end-to-end encryption is only available for Secret Chats and voice calls worries many of us.
Nonetheless, we have still given Telegram a mention in our roundup of the best secure messaging apps.
Is Telegram right for you?
The answer to this question all comes down to your threat model and unique needs. If your biggest concerns are getting away from WhatsApp while having access to the largest number of users, Telegram could be a good choice.
But if privacy and security are at the top of your list, there are other secure messaging services to consider that we have reviewed:
This Telegram review was last updated on April 27, 2024.
Here’s a collection of facts (collected by Ukrainian activists) that Telegram is a tool of Russian intelligence:
kremlingram.org
This site which alleges it is about privacy should be ashamed for not providing scolding and scathing comments about Telegram. Any service which claims to be secure, encrypted, and values your anonymity but requires your mobile number (VOIP and virtual numbers won’t work) is a major red flag. Furthermore, as previously mentioned, they want the user to upload their contacts to their service (cloud) letting all your contacts know you’re also using Telegram and that’s another red flag.
One might as well use WhatsApp instead.
Well, that’s mostly true, Kolom. Let me clarify.
You’re mostly correct that virtual numbers won’t work for receiving SMS, especially for shortcodes used in two-factor authentication (2FA), such as one-time passwords (OTPs) and short message service (SMS) codes. Many providers have disabled these features, and reactivating them often requires a costly subscription.
Additionally, virtual SMS services generally don’t work with Telegram for verification, including 2FA and multi-factor authentication (MFA). Even if premium services might offer some solutions, third-party SMS shortcodes typically won’t work with Telegram. This should be emphasized in a future updated review of Telegram by Alex.
Furthermore, the recent arrest of Telegram’s Russian founder raises additional concerns. This situation, coupled with ongoing issues around SMS verification and security, makes Telegram a platform that should be avoided. It’s more than just a controversy like Julian Assange’s case; these factors collectively suggest significant risks associated with using Telegram.
Reposting sorry had a spelling error…,. Still yet another article pandering to an apathetic public. Oh sure we could talk about Threema from Europe ,NO number required. All servers located .outside the US. in Zürich. For 2.99 you can have not mediocre and untrustworthy app based in the US. but a superior GDPR ISO 27001 Compliant app…The three apps mentioned here all use Google services in some way, the worst offender…its clear Americans are kept ignorant by trendy self congratulating articles like these..Raise your standards…maybe a complacent teenage would use them but any app headquartered in the states are subject to NSA laws who flagrantly violated privacy rights and still do GOOGLE is the worst.. Aren’t you tired of making them rich yet?
These apps as anyone knows are under no obligation to protect you’re data. read the terms of use! Please educate your selves. get together, stop believing these tired articles
If you want change YOU raise the bar stop waiting for these corporate shrills to do it for you https://restoreprivacy.com/secure-encrypted-messaging-apps/threema/
Here is a BIG BIG downside of Telegram.
Apart from getting the announcement “(contact) is on telegram” there are some basic flaws and they are the default settings. Why the hell would you want to have your contacts gone through or the number show by default (at the time etc) but the biggest failure is pinging and storage of your old details ie.
What you do is this: Grab someones number, stick it into Google Contacts. … Wait.
Then up comes their signal, telegram, whatsapp, Google Duo, and then sometimes their old telegram photo appears
yea, nah. ..
telegram has had a premium feature for a while now
Would love to see this site review some of the disposable SMS services that you mention. I suppose it’s not related to privacy, exactly, but I’d be interested in those that do not collect a lot of personal data.
Yep we will OldGuyinUS
Reviews here should be based on facts. Anyone can claim anything. But can they prove it? Telegram’s protocol (MTProto 2) has not been broken nor proven insecure in all those years it’s been in use. Nor has Telegram suffered from security scandals and breaches like e.g. WhatsApp and others. While at the same time Telegram is at the forefront of messengers, having and introducing more features than their competitors and leading in this market (even though it’s not backed up by Facebook or another such a giant). It’s pretty clear the team behind Telegram has been doing something, and actually a lot of things, right all those years. Kudos to them.
Bangladesh and
Thanks for this article. One thing i disagree with: Telegram’s E2E encryption is NOT a “Pro” as stated in this article, but a “Con”, due to major issues with its implementation: It is only available for “secret chats”, and NOT available on multiple devices. Having patchy privacy is worse than not having it at all, since it misleads users, who will make mistakes: Once one establishes a private channel, the unencrypted channel stays open, leading to an untrustworthy medium parallel to the private one. Search for a past message, and either one could come up. Move to another device, and only the insecure chat is to be found, leading to even more confusion and fragmentation of chats. Users forced to jump through hoops to have privacy will not have it: even if you do everything right the people you communicate with may make a mistake. The worst example: open a “secret chat” with someone, then call them from that same interface. The call goes through unencrypted!
Telegram servers should be forced to shut down. Lack of support, full of scammers, and I’m not digging deeper, but I believe that worse shit must be moved through that platform.
Privacy? Ok, but who controls that this privacy is being used with responsibility?
very becareful something in name of JSONARY on display and java no value from telegram it be hacked if you visit hello or fullstop from the unknown in telegram app it is from irgc and russia chineese hackers can be come in your system and infict your android device folder by name mo0b1le 2.1 GB of your internal hard
tell to all
good luck
Users are overly concerned about E2E for pyschological reasons that comes from such as this review or companies that promote E2E as default chat encryption.
For as long as feature phones, sms and cell calls are not encrypted, and we still use it today in smartpones for normal communication and business. It is excessively concerned to think one must use E2E, because you are not going to send sensitive or secret information in chats either with messengers or sms. If you do send sensitive information there is private chat.
Whatsapp and Telegram is chosen as preferred messsengers by international businesses. It shouldn’t be a concern by ordinary users.
all voice calls in this “private” communicator go through Russian servers, I do not know how about chat ….
Hope that you dont belive allthing. to develob codes you can do somehing. so DO NOT DO as you want. Perfect codes as thertiary are almos done. Chips after tahat are useful as many other. So if there is thertyary .1 or more internet spying is useful. Please make peace not war.
There is something that is not wright. Sorry about language this. You see problem about seargh. I see problem about server and Who own them. It takes time to open algorithm but always all is open (i open all but takes time.). So Answer is siply. Chip inside your phone or pc force how your data is trasferd. All virusprotection are bull shit and loss money. Linux is trying to do something but as you know. There is some to do. 1. Own chips. 2. Doing mess where nowadays servers are useful. 4. Satellite. And perhaps best is to awoid all digital. 5. There is useful (perhaps not perfect) thertyary perfect codes. So this is my bread. Speed is not nessesary because there is allso 4, 5 codes. And what is best these are absolytely safe and cheap. Allso siply to transfer normally net. Net was to help people not war.
megusta
I was led here in search of information regarding SHA256/512 checksums to verify the integrity of the downloaded installation files (in my case it’s tsetup.4.10.3.tar.xz for Linux), and it seems that, after this so-called ‘secure’ communications app has been around for so many years, there still isn’t any way to verify the downloaded files, not even the source-code archives. What does that say about the integrity of Telegram?
Also, I didn’t see mention of the point that E2EE Secret Chats are not available on desktop versions of this app; well, certainly not on Linux.
So, in conclusion, I can see no justifiable reason to install Telegram on my system.
Use 2 factor check:
VirusTotal for cleanliness (I know, I know, owned by Stoogle, but use it anyways, returns EXCELLENT info plethora),
match file download location web page published checksum (on same web page(s) where you download file from) with checksum(s) returned by VirusTotal AND a third party localized application like ES FILE EXPLORER (choose downloaded install file and use its context sensitive menu to calculate its checksum(s) and compare to published checksum(s) from download web locale)
if both check out, install … don’t blow your brains out worrying about every little cog … with these two checks, you’ve conquered ~99% of nefarious probabilities …
This Telegram was founded and launched in Russia in 2013 by the brothers Nikolai and Pavel Durov. Previously, the pair founded the Russian social network VK.
“VK has long since become a company completely controlled by the Kremlin (and his Secret Services),” – says Sarkis Darbinyan, head of the legal department at Russian digital rights group Roskomsvoboda.
So, the chance that their state has access to all parts of Telegram is very high.
For example, VK (Kremlin Social Network) is now banned in the Ukraine, but they are still using Telegram, how ridiculous does it sound?
Are you on Telegram channel and do you think you are anonymous? Then I can tell you that the Kremlin has entered your Telegram Chat and all your conversations! It is now up to you whether you believe it or not.
Have fun!
Telegram is run by lefties. You get barred from leaving comments on channels for no apparent reason. And half the time you don’t know whether you’re contacting a real person or a machine.
Durovs were forced to sell VK and left Russia soon after that. The fact that Ukrainians are not afraid of Telegram is a quite clear sign of its reputation.
They are scammer… they are asking you to rate and review different platform… and after that not paying… they dont consider paytm as payment mode.
I do not think that Russian media like Vkontakte, Telegram, Mastodon, Fosstodon etc is free and can give you the leven of privacy you need. I can’t belive that. I think that everything in that country has been controlled by the KGB like secret services and they do everything to expand that control in the Western world.
Has anyone heard or saw the posts about the TRB system? I want to know if it is a scam. Has anyone bout the products and cashed them in?
Hi Heinrich
Thanks for your authentic insights.
My quarry is along with VPN as you advised, using ‘Telegram FOSS’ app from F-droid, has any more privacy benefit than official Telegram app ?
Regards
telegram is fine unless you are stupid or a spy, in which case you already have a surveillance team on your case
I very much dislike Telegram it is toxic and lots of frauds and scams on this platform. Not secure too and neither private. No Safety, No security, No Privacy and lots of piracy and other bad things on this platform. I use to have an account there, and a lady from Philippines duped me and I lost more than 200 USD. And I am so young, she has no love and no sense that this is not how to treat someone, specially of this age. This is the reality of the world. No wonder there are genocides and all kinds of violence and abuses, Now I don’t have an account on this platform. I won’t ever go back there.
How did the lady get the money from you? I’m asking because I have someone texting who I never knew before and wants me to get this app
Sorry to hear that. We older ones also get duped sometimes.
even im facing same problem,there is group going on here with fraud brand name and looting money,i entered in it seeing the brand name,i realized only than when i lost so much money,im complaining to that brand they says it is not we you just get hold of that people,as because of telegram app loopholes we cannot see there other information other than there ids which is of no use,please anybody help me identifing real identity of the id holder.
Great post as always
Please, do yo recommend changing telegram account number or create a new Telegram account with a new phone number??
thanks in advance
I usually find the messages I received on telegram opened and read. sometimes they try to unread it but it shows me that it was already read. so, bviously it looks like i have been hacked. do I need to deactivate my account? what else could the hackers see through my account?
Installed TM to android phone, rejected access to my contacts. Within one minute received a message from my neighbor. WTF? I guess TM downloaded all my contacts without my consent?
No. Your neighbour already had your number in thwir contacts and probably allowed Tg access. So Telegram announced to them that one of their contact just registered.
I can confirm that you can’t sign-up with Telegram using a VPN.
Virtual number services don’t work and there’s no workaround.
It was mentioned by someone to use autoficationsdotcom, but their website is suspiciously very vague with no information on how t use their service or of costs. They seem to be very sketchy with a huge ad for Trustpilot (which shouldn’t be trusted). When contacted about Telegram they said at the present time their service doesn’t work with Telegram.
Perhaps this site should do a review of TrustPilot and how your info is anything but private with them and they can’t be trusted?
Please, do yo recommend changing telegram account number or create a new Telegram account with a new phone number??
thanks in advance
I don’t feel comfortable providing my actual number to Telegram.
I tried many free online services that will generate a quasi SMS number to send verification codes. Unfortunately, none work as Telegram blocks all the ones I have tried, but otherwise for the most part many of these free services work for other apps like WhatsApp or services for SMS verification codes.
Perhaps someone can throw me a bone? Thanks
Yes autofications.com and use btc. Costs like $1 and you can verify any app with phone number that way. Totally worth it.
autofications.com and telegram don’t work with a vpn during the registration process. so much for [trying] to be anonymous with telegram.
You shouldnt. Just use Signal no # anymore this is outdated. it’s the only solution right now. NOT this telegram trash. The creators of Telegram are the same Russian brothers who made VK their FB.. which regularly seeks out people and persucutes them based on their online posts. Hard pass!
Signal requires working phone number for sms verification and they block temp online sms services like Telegram do. You also can’t hide your number in Telegram unless you use an unofficial fork which will probably be buggy
said that the super notorious sex crime in South Korea went within Telegram,
and South Korea’s officials publically claimed it’s impossible to reach staff and server of Telegram,they are not available in AE or UK or else?
An official told that in a TV show!
Delusion or amazing facts?
Thanks for this article, I’d heard different things about telegrams security.
I can’t find any comments on my use of it anonymously, in the sense that I can have it open, read messages but others ( on Telegram) don’t know that I have it open.
I couldn’t find any settings like I can on WhatsApp.
Please help.
I did go through their settings and looked for articles on line but no success.
Thanks for answering.
Another mark against Telegram is their censuring of those who disagree with government narratives.
https://freewestmedia.com/2021/09/29/italian-truckers-block-highways-to-protest-against-mandatory-jabs/
The pertinent comments are down the article a little.
Calling for execution is a grey area. Good to not say things like that but most content on telegram is not blocked. It is still the freest and most usable app for truth and free speech.
can people create a group chat without permission from me and broadcast to help others spy on me, without me being aware that others have been able to access the whole thing.????