Today we’re going to talk about Telegram. You can find lots of free messaging apps out there. However, finding a free messaging app that is also secure, and has enough users to make it worth using, is a lot harder.
WhatsApp used to be the choice of the masses, with over 1 billion users worldwide. Now with their privacy problems, millions of people appear to be abandoning WhatsApp in 2021. Telegram is one of the top alternatives and this Telegram review will give you everything you need to know.
Telegram is totally free and growing like crazy. When we reviewed it last year, there were over 200 million users. And their growth is accelerating. On January 12, Telegram founder Pavel Durov wrote on his Telegram channel that,
In the first week of January, Telegram surpassed 500 million monthly active users. After that it kept growing: 25 million new users joined Telegram in the last 72 hours alone.
In this new and updated Telegram review, we’ll look at the privacy and security offered by the service to help you to decide if this is going to be your WhatsApp replacement.
Telegram pros & cons
+ Pros
- End-to-end (E2E) encryption
- Encryption algorithms: MTProto, a custom protocol
- Open source apps and Telegram Database Library
- Self-destructing messages
- Users can be logged in on multiple devices simultaneously
- Supports Two-Step Verification
- GDPR compliant
– Cons
- Registration requires a phone number
- E2E encryption only for Secret Chats
- Servers are not open source
- Logs IP Address and other user data
Now we’ll briefly touch on the main features of Telegram messenger.
Telegram messenger features
Here are some key features to consider when deciding whether Telegram is right for you:
- Code for the open source parts is available on GitHub
- Telegram apps for Android, iOS, Windows Phone, Mac OS, Windows, Linux, popular browsers
- In excess of 500,000 active users
For this review, we downloaded and tested Telegram desktop and mobile apps.
Telegram company background information
Telegram Messenger was created by brothers Nikolai and Pavel Durov in 2013. With over 500 million active users, it is one of the most popular messaging apps in the world. The company is headquartered in London, with the development team based in Dubai. The company is funded through a donation by Pavel.
Where is your Telegram data stored?
Telegram has a hybrid system for storing your data. By default, all your message data is stored on your devices. However, you can remove data from this local cache, and store it on Telegram’s servers. This allows you to balance your desire for privacy against the need for data storage space.
Those Telegram servers are located throughout the world as part of a distributed network.
Telegram third-party testing and audits
Telegram told us in an email that, “Multiple researchers and security experts have analyzed Telegram’s encryption.” As an example, the provided a paper from two researchers in Italy who examined the MTProto 2.0, as you can see here.
Nonetheless, we were not able to find any formal security audit or analysis that was conducted by a cybersecurity firm. This is in contrast to some of the other popular secure messenger services.
As we noted in both the Wire review and the Signal review, these encrypted messaging apps have undergone formal third-party audits.
Telegram messenger hands-on testing
For purposes of this Telegram review, I used the Telegram mobile app for Android, along with the Windows Desktop app. Since Telegram focuses on the mobile experience and requires you to join the service using a mobile device before you can use a browser or Desktop app, we’ll concentrate on the mobile side of things first.
Telegram Android app
Installing Telegram on an Android phone involves downloading the app and registering your phone number. This is similar to Signal messenger, which also requires a phone number to use the service. You can either download the app from the Google Play store, or download the Android APK directly from the Telegram website.
Once you finish installing and registering your account, you will be able to use the Telegram app to communicate with other Telegram users by text, voice, photos, video, group messaging, and channels (subscription broadcasts). File sharing is also supported.
Working with Telegram
Opening the Telegram app shows you a list of your Telegram contacts. If you’ve used any of the popular instant messaging apps, the interface should look familiar to you:
Tap a contact to see the full chat thread containing your conversation with that person, group, or channel. This is all pretty standard stuff; the kind of stuff you would expect to find on any of the best messaging apps. However, Telegram offers several other features that help explain why this is one of the most popular secure messaging apps.
Additional Telegram app features
Going beyond basic messages, Telegram has interesting and useful features like these:
- Groups – Supporting up to 200,000 members per group, Telegram group chats helped protesters get organized during the mega-protests of 2019. Apparently, both groups and channels were used by the protesters, resulting in a large DDOS (Distributed Denial of Service) attack against the service. Telegram stated that the IP addresses of the computers involved in the attack were mostly Chinese.
- Channels – Channels allow you to broadcast messages to an unlimited number of Telegram users. This feature was also apparently used during the Hong Kong protests. A recent addition to Channels is a way to view detailed statistics about channel viewership.
- Instant View – Instant View is a system to, “…view articles from around the Web in a consistent way, with zero loading time.” If you receive a link via Telegram, you can tap the Instant View button to instantly see a version of the page that has been optimized for viewing in Telegram. Because the page is cached in Telegram’s servers, it downloads in a split second. Instant View isn’t available in the desktop versions of Telegram.
For reference, here’s an article viewed through Instant View on the Telegram Android app:
- Bots – Bots are computer programs that run in Telegram. They have a wide range of capabilities, and anyone with a reasonable level of programming skills can write and publish their own.
- Live Locations – Share your location live in a chat for 15 minutes, one hour, or eight hours. If multiple users share their live location within a group, they are shown on an interactive map.
- Telegram Passport – Telegram Passport is an encrypted way to store your identity documents on Telegram servers. Once stored here, you can easily share them with services that require real-world IDs.
- Persistent Conference Calls – In their final update of 2020, Telegram revamped their voice chat system to allow for persistent conference calls that individuals can leave and rejoin at will. While they joke that the update was delivered in time for remote Christmas carols, this update could become a major selling point in the age of COVID-19 lockdowns.
Now we will take a close look at using Telegram on your desktop.
Telegram Desktop clients
Installing Telegram Desktop on your desktop is just like installing any other app. It only takes a moment to download, and seconds to install. Once you do, Telegram opens and asks you to enter the telephone number you used to register your mobile app. Alternately, you can click the Quick log in using QR code link and follow those directions. Either way, you’ll soon see the familiar Telegram user interface translated onto your desktop.
Telegram officially supports the following desktop platforms:
- Windows
- Mac OS
- Linux (64 bit and 32 bit)
Here is a screenshot of the Telegram desktop app.
One drawback with the Telegram desktop app is that you won’t have access to all the same features and capabilities that you do on your phone. However, if nothing else, the Desktop app will be a lifesaver in those times when you need to send long text messages.
Aside from using the Telegram desktop app, there is also a Telegram web client here. (Be sure to use a secure browser that respects your privacy when using web clients.)
Support
Telegram’s support site takes the form of a huge FAQ page. This page (seen below) links to an immense amount of helpful information about Telegram. While working on this Telegram review, I was able to find the answers to any questions that came up by searching the FAQ.
Of course, I can’t guarantee that you will never need support from a live person. That shouldn’t be a problem, as Telegram offers you several ways to get in touch with their support team. Instead of listing out all the options here, just go to the Support section of that huge Telegram FAQ page.
How secure and private is Telegram
Telegram has taken a beating over the years due to doubts about its security model. The concerns target two main areas: E2E encryption, and MTProto security. Let’s examine each of these areas.
E2E encryption
The concern about Telegram’s E2E encryption is that it is not applied by default. Most chats (Cloud chats) on Telegram are securely encrypted while in transit between your devices and Telegram’s servers. Once chat messages arrive at the Telegram servers, they are encrypted using MTProto while at rest on the servers. However, Telegram can read chat data since it handles the encryption/decryption of messages at the servers.
Other secure messaging services such as Signal, apply E2E encryption on all communications by default. The service cannot read those messages. Only the sender and the recipient can read E2E encrypted messages. In other words, any service that uses E2E encryption for all their messages will be more secure than Telegram.
Telegram does support E2E encryption for two types of communications: Secret Chats, and voice calls. Secret Chats are chats that are not stored on Telegram servers, and are only accessible to the devices involved in the chat. Secret Chats should be as secure as MTProto, but users need to remember to turn them on.
Voice calls are automatically E2E encrypted, likewise making them as secure as MTProto allows.
MTProto security
MTProto is the custom mobile protocol designed by the Telegram team. While I am not qualified to comment on the security of the protocol, it has been criticized by numerous cryptography experts. Check out this Wikipedia link to get a better sense of the flak this protocol has taken over the years.
Telegram logs IP address and metadata
On the privacy front, Telegram can collect a decent amount of personal information, which it can keep for up to 12 months. According to their Privacy Policy, they,
may collect metadata such as your IP address, devices and Telegram apps you’ve used, history of username changes, etc.
They may use aggregated metadata from you to help them create new features for the service.
Finally, the company has the ability to read any of your Cloud Chat messages to investigate spam and other violations of their Terms of Service. They may share some of your personal data with other Telegram users you choose to communicate with and companies within the Telegram Group. If forced by a court order, they may provide your IP address and mobile number to the appropriate authorities. (We also discovered this in our ProtonVPN review.)
It would be wise to use Secret Chats and voice calls whenever you wish to share private information on Telegram.
There is also a section of the Privacy Policy titled, “Law Enforcement Authorities” that reads as follows:
If Telegram receives a court order that confirms you’re a terror suspect, we may disclose your IP address and phone number to the relevant authorities. So far, this has never happened. When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.
This is important to keep in mind when using Telegram.
Using a VPN with Telegram
As noted above, Telegram will record your IP address and keep it for up to 12 months. This links your identity up with your Telegram activity, chats, etc. Therefore you should take this into consideration based on your threat model and unique needs.
To hide your IP address when using Telegram, you can use a VPN (virtual private network). A VPN with Telegram will hide your IP address and location, while also encrypting your internet traffic. Some of our top-recommended VPNs include NordVPN, which is based in Panama, as well as Surfshark, and ExpressVPN, which are both based in the British Virgin Islands.
Note: A VPN is not a silver bullet that hides all your metadata. However, it will securely encrypt traffic between your device and a VPN server, while also concealing your true location and IP address. See these best VPN services for more options and info.
Using Telegram without your real phone number
While we’re on the topic of privacy, it’s also important to note that Telegram requires a phone number to create an account. This is a verification step to prevent bots and spammers from mass-registering.
Verification happens via a text message or phone call, and then you enter the verification code to begin using the service. But here’s the important privacy tip: you don’t have to use your phone number.
There are many anonymous SMS services you can find online that allow you to receive text messages to digital numbers. There are both free and paid SMS services available that you can find with a little bit of research (enter a search term like disposable SMS into your browser). You may have to try with a few different services and numbers before you can get a Telegram verification code to come through and work, but it will ensure your real phone number stays safe.
Registering with a disposable SMS number, and using a good VPN when you use Telegram will significantly increase your privacy.
Telegram business features
Like its main competitor for WhatsApp escapees, Signal, Telegram Messenger is only available as a single, free version. There are no pricing tiers, no extra-cost features, and no business-specific features.
Telegram prices = free
As mentioned above, Telegram is 100% free of charge. The company has stated that if they run low on money, they might add some non-essential premium features, but as of now, there is only the one, free version.
Telegram review conclusion
Telegram is one of the most popular messaging apps in the world with over 500 million active users. At the moment, it appears to be the primary destination for people who want an alternative to WhatsApp. Add in the fact that it is free, fast, and has tons of useful and fun features beyond basic messaging, and it’s easy to see why Telegram is so popular.
But popularity does not necessarily mean it is secure or a good option for privacy-conscious users. As I showed above, there are many experts in the cryptography community that have raised doubts about Telegram’s security. At the same time, the fact that end-to-end encryption is only available for Secret Chats and voice calls worries many of us.
Nonetheless, we have still given Telegram a mention in our roundup of the best secure messaging apps.
Is Telegram right for you?
The answer to this question all comes down to your threat model and unique needs. If your biggest concerns are getting away from WhatsApp while having access to the largest number of users, Telegram could be a good choice.
But if privacy and security are at the top of your list, there are other secure messaging services to consider that we have reviewed:
The line “Encryption algorithms: MTProto, a custom protocol” needs to be moved from the Pros column to the Cons column. Making up your own algorithm is a big red flag. As you’ve already noted in your review, MTProto has been heavily criticized by experts. MTProto has zero security proofs behind it, and “The Most Backdoor-Looking Bug I’ve Ever Seen”:
https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-the-most-backdoor-looking/
Telegran is dangerous until they replace MTProto with something that the crytographic community says is good.
Hi Heinrich, I appreciate what you’re trying to do with your website but, frankly, I don’t understand how you could even mention Telegram in a list of “secure messengers”. From an honest and thorough review I would have expected that it clearly states that this is mainly marketing speech on Telegram’s part. Because, as it stands, Telegram is *less* secure than WhatsApp and Telegram users are exposed much more, since almost no one enables “secret chat” for every single one of their conversations. (And the encryption protocol should probably not be trusted and has been critiqued many times before, compare https://en.wikipedia.org/wiki/Telegram_(software)#Reception .) Meanwhile, all one-to-one and group conversations on WhatsApp are (said to be) encrypted by the Signal protocol.
Beyond encryption, Telegram and WhatsApp are probably comparable, security-wise:
– The Telegram app, too, uploads all your contacts to their servers
– As with WhatsApp, with Telegram there is no meta data protection comparable to Signal’s “Sealed Sender” functionality
– Behind Telegram there are rather shady investors these days that are close to the Kremlin, compare https://en.wikipedia.org/wiki/Telegram_(software)#Monetization
PS: How come the subtitle to this article says “37 Comments” when I really only see a single comment here?
On the comments, we’re having an issue with the comment form. However, I think I have it fixed now.
I like the old comments better. It’s easier to go through all of them without having to click previous or next.
I was wondering telegram has no authority to remove users off any groups or channels right? So whoever can ban user comes from the host of the group itself? And if the group delete your ID all the chats disappear?
“server is closed source,” is NOT a con. The most secure; hell ONLY secure systems are CLOSED SOURCE. Anyone trotting out the “open source is safe” line is NOT to be trusted.
I also find it hilarous that “academic” papers are considered sub-standard to FOR-PROFIT companies who have an agenda. WOW!
The open-source cult needs to grow up. Socisalism has failed; learn.
Exactly the same thing I was wondering. Open source “security” lies in that it is auditable by everyone. But in praxis it means, that noone is doing it. Also there were cases where malicious code was pulled directly (by small parts) to main open source project.
Oh and having “open source” server does not mean that the servers are running the open source code or that they are not running anything else above that.
You don’t even know the difference between “open source” and socialism, or between closed source and for-profit.
For anything related to encryption it is extremely important that outside experts be able to examine the algorithm as well as the implementation. Open source is not anti-business. Google, Apple, Microsoft, IBM, and Intel all make open source software.
I just heard on Pimpy’s investment channel, that BILL GATES has just purchased Telegraph? Did he mean Telegram? Has anyone else heard anything about this?
probably referring to telegraphapp.com some no name social network
I just tried to install Telegram and they refused me because Facebook took me off for a couple weeks. The only explanation they gave was I did not meet their community standards. Probably too political. They let me back on a week ago but Telegram wouldn’t accept me because of Facebook.
What kind of BS is this? Why are you spreading fake news? It’s simply too stupid to say things like that. Telegram does not care what you do on Facebook. lol.
Maybe you should come up with some evidence?
You know FB mines and sells everything.
You know Twitter mines and sells everything.
You know Robinhood mines and sells everything.
You know Google mines and sells everything.
Telegram says the DON’T mine and sell anything…plus private chat E2E encryption
If it comes out they do mine and do sell – well that’s what the UNINSTALL button is for…
I want review about BiP messenger app.
Telegram has been audited from third Partys see the mtproto1 audit:
https://courses.csail.mit.edu/6.857/2017/project/19.pdf
After that Telegram has changed the security issues in the new Mtproto Protocoll (mtproto2).
https://core.telegram.org/mtproto/description
As stated:”As of version 4.6, major Telegram clients are using MTProto 2.0. MTProto v.1.0 is deprecated and is currently being phased out.”
Regards.
Ok, so this looks like an academic paper from back in 2017. Do you know of any audits conducted by a reputable cybersecurity company?
Very well, clear post, I repost on my socials.
I have been using telegram since 2013, I am happy with that, the best thing is the customer/client/user should know how secure is, for normal everyday use is far better than whatsapp, as secure messaging app fails.
Hello guys
I hope so good !
In real time so in this time telegram is not secure and private , it’s looking facebook , it keep all moves ip , location , metadata , chats , and others , but if you are really want to use it you should use another number , but again if security and private is matter on you never use it !
Use SIGNAL FULLY ENCRYPTED , UNHACKABLE , FULLY SECRECY POLICY !!!
Good Luck
Best cheers ‘ .
I just tried to install Telegram and they refused me because Facebook took me off for a couple weeks. The only explanation they gave was I did not meet their community standards. Probably too political. They let me back on a week ago but Telegram wouldn’t accept me because of Facebook.
Barbara, thats not possible. There is no connection between Telegram and Facebook.
You say
„ Finally, the company has the ability to read any of your Cloud Chat messages“
but Telegram says
„ 3.3.1. Cloud Chats
…
All data is stored heavily encrypted and the encryption keys in each case are stored in several other data centers in different jurisdictions. This way local engineers or physical intruders CANNOT get access to user data.“
??
Still, Telegram has the keys, not the user, and therefore Telegram itself has the ability to read these messages, even if the physical data center does not.
Hi Sven! I have few special questions of the privacy to ask you or Heinrich. Please, write me to my post.
You know that the other part should always have a set of encryption keys right?
Btw – they have never handed out the keys to anyone. That’s why Telegram is banned in Russia.
Do they really log the IP? Sorry for the sarcasm – but you are logging the IP from the user on this site – right? You can trace every comment made on this site back to the user. Even Signal log ip’s – I don’t know who does’nt. It’s a simple tool – not everything is because they would track you down.
The best thing with Telegram is the fact that I can choose E2E on some messages and have the comfort to write with the same person (in the same chat window), on iphone, iPad, Windows or Linux. That’s the best thing with cloud chats – and it’s encrypted.
“Has not shared any Transparency Reports”
See the Telegram Privacy Policy:
“8.3. Law Enforcement Authorities
If Telegram receives a court order that confirms you’re a terror suspect, we may disclose your IP address and phone number to the relevant authorities. So far, this has never happened. When it does, we will include it in a semiannual transparency report published at: https://t.me/transparency.”
Source: https://telegram.org/privacy#8-3-law-enforcement-authorities
Thanks for this info. We have updated the review and included this section from the privacy policy.
Except for court orders that expressly forbid you from notifying your users that your have had to hand over data. So “never happened” means “never happened that we can tell you about”.
As for me: a service, that is equally hated by FSB, FBI and other secret services around the world is already a guarantee for the highest security standards possible.
That’s the final word for me.
How can you write an app review without detailing the permissions an app requires on your phone?
The permissions required by ‘Telegram’ are extensive and possibly intrusive.
I agree. When installing Telegram on my iPhone, it required access to my contacts to proceed. I quit and tried to remove from my phone. Couldn’t delete the app. Still trying to get it off my phone. Not super swift with tech. I’ll get it figured out.
you dont have to give contact permission https://www.howtogeek.com/711226/how-to-use-telegram-without-sharing-your-contacts/
Downloaded Telegram with the intention of eventually switching from Messenger, hadn’t used it but was notified of a log in from different location and device, couldn’t change settings WITH my phone number and email address so it must have been altered (I assume) by other person(s), so won’t be using and have deleted. Conclusion: Telegram security is a joke.
I’d simply like to point out that the main reason behind Telegram not applying E2E by default is that this would require a lot of footwork to get this to work with their multiple devices/sessions model, especially when many of the devices are subscribers to channels or participants to group chats. Every message sent would need to be encrypted for any receiver using the receiver’s public key while still making it possible for all others receivers participating to the same chat to decipher the message from all of their devices/sessions. It’s not impossible, but it adds significant complexity.
Yeah – that’s why some messages from Signal sometimes does’nt go through to the recipient. That’s the main reason why im not using Signal at all – and because I don’t have the ability to use cloud chats.
Do a Riot + Matrix review! The protocol is getting a lot of recognition for being decentralized and federated.
Telegram is the BEST messaging APP. It contains many really useful and interesting functions, very functional. Animated sticks, you can hide your phone number, so much more is Telegram growing, today there are already 400 million active users.
However, all these really useful functions come at a price, your privacy and security. It is a double-edged sword, or you choose high security and privacy or choose to open it to have useful functions. I prefer Signal, although the app is not as usability, but the team has been making the app much more functional and practical in recent times and all this without giving up privacy and security.
In addition, most people are not concerned or unaware of the need for security or privacy in the online world. If it’s good and practical, they don’t care, as long as it works.
Telegram is a great piece of Software and it’s the direct WhatsApp competitor. Unfortunately it’s privacy policy is somewhat shady. On the other hand, it has a lot of features that make it the most complete IM around. It’s very “social” without being a social network, it has channels, bots and chat options are really cool: you can hide your number to people you don’t want to know it; hide your online status; use a nickname to call without revealing your number (very useful if you use it for work if you have to contact many people); and the desktop version is great!
I love Telegram and I use it very often but, to be honest, I wouldn’t use it to share sensitive data like passwords or banking infos.
Telegram is simply THE BEST messenger app in terms of functionnalities! I didn’t find better!
BUT, as stated here, end-to-end encryption is not by default, that is soooo disturbing..
Think: Why would they not activated E2E by default ? 😉
That’s why I went on Signal, even if you could create a private conv with Telegram, I don’t really trust (russian/dubai, not open source..) them as much as Signal, especially because they didn’t put E2E encryption by default. Even Whatsapp does it!
@Karapacha: They can say what they want you know lol As stated here, messages are encrypted on their servers, it means they have the keys to decrypt them.
Because it’s rare that I use E2E encryption. I like to do conversation on iPhone, iPad and windows – and go from one device to another. With E2E I’m stucked on 1 device.
Think again….Can you chat with the same person on iOS, Android, Windows and Linux on the same time? Can you go to your PC and chat with the same person in the same chat window that you did on your iOS device? Not on Signal – but you can on Telegram.
So Einstein – that’s the reason why. Now – go take your pills against paranoia.
Someone has to fund the Signal servers too (encryption cost more resources to host). eventually not enough people will be donating to Signal and they will run out of borrowed money and the service will slow down even more then it already has.
Telegram states on their website that no one can access content of chats on their servers, even not Telegram itself btw which isn’t mentioned in the review above.
Another advantage of Telegram compared to Signal is that you can delete any chat, photo, file, link etc sent to another person for both parties at any time which puts the user in full control of content and history – huge advantage compared to Signal which doesn’t offer that; it offers only time limited self destroying messages.
You may also add to Pros: russian government for more than a years tries to block Telegram in russia where it is the main too for opposition coordination. They blocked literaly millions of IP addresses, broke some of their own services (because those depend on blocked Amazon services) but they were not able to block Telegram.
Another thing that you forgot is that Telegram has a two factor authentication, which protects your account to be stollen by SIM swap. This what authorities in Russian try to do to capture Telegram accounts of activists and read their messages on other devices. They failed for everybody who has 2FA set up.
A secure system that you do not administer is not trust worthy.
https://www.businessinsider.com/internal-report-showed-dhs-collected-protester-messages-wapo-2020-7