Is Telegram encrypted? What Telegram, ESET and Norton say

Cloud Chats are encrypted, and Telegram holds the keys

Telegram’s FAQ says the app supports two layers of encryption. Cloud Chats, which it says cover private and group chats, use server-client encryption, and Secret Chats add a layer of client-client encryption. The FAQ says all data is encrypted in the same way, whether it is text, media or files, and names 256-bit AES, 2048-bit RSA and Diffie-Hellman key exchange as the basis.

ESET describes the same default from outside. Its page says one-to-one chats, group messages and public channels use client-server encryption: the message is encrypted on your device, decrypted on Telegram’s servers so it can be delivered, then stored in the cloud. ESET adds that Telegram holds the keys to decrypt cloud chats, so the company could potentially access or share messages if legally compelled, or be targeted by hackers who want stored data. That is ESET’s reading. Telegram’s own wording is that cloud messages are “stored encrypted in the Telegram Cloud”.

The two accounts do not contradict each other. Telegram says all messages are encrypted, and ESET, Norton and Wire say the default chats are not end-to-end. Both describe one model: encryption between your app and Telegram’s servers, with the service able to decrypt on its side.

The FAQ gives a reason for the design. Restoring chat history on a new device, it says, “does not have an elegant solution” in the end-to-end paradigm, and it criticises WhatsApp and Viber for backups that can be decrypted. Telegram says it chose two kinds of chat instead: Cloud Chats as the built-in backup, and Secret Chats for what you do not want stored. It calls that separation the most secure solution currently possible for a massively popular messenger, which is a claim by Telegram about itself. ESET lists among its criticisms the proprietary protocol, end-to-end encryption that is not the default, and server code that is not open source. The FAQ answers the last point by saying that publishing server code would not give a guarantee, because the code running on the servers cannot be verified.

On requests from authorities, the FAQ says cloud data sits in several data centres controlled by different legal entities in different jurisdictions, and that the decryption keys are split into parts and kept apart from the data they protect. It says several court orders from different jurisdictions would be needed, and that Telegram has disclosed “0 bytes of user messages” to third parties, governments included. That is Telegram’s statement. The pages we read do not include an independent check of it.

Secret Chats: end-to-end, and tied to one device

Telegram says every message in a Secret Chat is end-to-end encrypted, so that only you and the recipient can read it, Telegram included. Messages cannot be forwarded out of a Secret Chat, and when you delete messages on your side, the app on the other side is ordered to delete them as well. Telegram’s protocol documentation adds that files sent in a Secret Chat are encrypted with one-time keys that are not related to the chat’s shared key, and that major Telegram clients have used MTProto 2.0 since version 4.6.

A Secret Chat is not part of the cloud. The FAQ says it is device-specific: start one on a phone and it exists only on that phone. If you log out, you lose all your Secret Chats, although your cloud messages stay. You can create as many Secret Chats as you like with the same contact. Logging out does not delete the messages on your partner’s device; the FAQ says to choose “Clear History” first for that.

To start one, the FAQ says to open the contact’s profile, tap the three dots and choose Start Secret Chat. Norton spells out the same route in three numbered steps, the first of which is shown here as two:

1. Pull up the contact and tap their profile picture.
2. Tap the three dots at the top right and choose Start Secret Chat.
3. Tap Start when Telegram asks whether you are sure.
4. Wait for the recipient to come online and agree to enter the Secret Chat.

Norton adds that the process has to be repeated for every new recipient.

Two settings sit on top of a Secret Chat. The self-destruct timer, set from the clock icon, works for all messages in Secret Chats and for media in private cloud chats. The clock starts when the message is shown on the recipient’s screen, and the message then disappears from both devices. In a Secret Chat the timer applies only to messages sent after it was set. The second setting is the key picture: after the Diffie-Hellman exchange Telegram generates an image of the chat’s key. If your friend’s image is the same, the FAQ says, no man-in-the-middle attack has succeeded. It advises comparing the two over a channel known to be secure, safest in person, and says newer apps also show a textual representation of the key.

On screenshots the sources differ. The FAQ says there is no bulletproof way of detecting them on some systems, notably some Android and Windows Phone devices, so an alert can be bypassed, and that a screen can be photographed with another camera anyway. Norton writes that in Secret Chats “screenshots are impossible”. We give the FAQ’s wording, since it describes Telegram’s own app.

Groups, channels and calls

Norton says that for group chats end-to-end encryption is not available at all, and that Secret Chats are not offered in groups. ESET says groups and channels use client-server encryption, so Telegram can access them if required. Wire says the same of groups and channels and gives its own explanation: end-to-end encryption in a group needs a system that can distribute and rotate keys across every member. Wire sells a competing messenger, so we treat that explanation as its opinion and the rest as a description.

Calls are where the pages part. The FAQ says voice and video calls can be end-to-end encrypted, and that a call can become a group call of up to 200 participants, “also protected by end-to-end encryption”, which it says you can verify at any time. Wire agrees about one-to-one voice and video calls but writes that group video calls do not carry the same confirmed guarantee. The ESET and Norton pages we read do not discuss the encryption of calls.

The FAQ names one more exception to the cloud. Telegram Passport, where identity documents and personal data are kept, is stored in the cloud with end-to-end encryption, and the FAQ says that to Telegram this data is “random gibberish”.

What stays visible around the encryption

Norton says Secret Chats make the contents of messages undecipherable but can still leave some data exposed: the user name, the time a message was sent, the IP address and other device information. ESET says Telegram may log IP addresses, device information and login metadata to detect spam and suspicious activity, and that under its policy IP data is kept for no longer than 12 months. ESET also notes that a phone number is required to create an account, that contact syncing can be turned off, and that Telegram states personal data of users in the UK and European Economic Area is stored on servers in the Netherlands.

Norton also writes that since the 2024 arrest of Pavel Durov in France, the app has agreed to share such user information with law enforcement “more proactively”, when there is a legitimate legal request. That sits beside the FAQ’s “0 bytes” figure, which concerns messages. The pages we read do not say which data has been handed over.

Wire reports a third kind of exposure. It describes a June 2025 investigation by OCCRP and its partner Important Stories that found an identifier called auth_key_id in Telegram traffic, which someone watching the network could combine with an IP address to follow a device over time. Wire says a 2026 review by Symbolic Software confirmed that the identifier is visible and stays the same when a user changes network, and that following a device this way does not require breaking the encryption. ESET cites a 2025 IStories investigation of the ownership of Telegram’s network infrastructure, without mentioning this identifier. Because this reaches us through a vendor of a rival product, we pass it on as “Wire reports” and not as something we checked.

Encryption also does not say who is writing. Wire reports a 2026 phishing campaign that used Secret Chats to send fake security alerts, with 64 phone numbers found in the links, and says researchers could not confirm that every person was targeted or compromised. Wire’s point is that the channel was protected but the sender was not verified.

What the pages recommend

The FAQ says that for someone with reasons to worry about personal security, Telegram recommends Secret Chats only, in official or verifiable open-source apps, preferably with a self-destruct timer. It also recommends 2-Step Verification and a strong passcode on the app, both under Settings, Privacy and Security. With 2-Step Verification on, you need both an SMS code and a password to log in, and the FAQ says to protect the recovery email address as well.

Norton shows why that matters with a 2016 case in Iran. It says the group Rocket Kitten, which it links to the Iranian government, worked with state-controlled telecom providers to intercept Telegram’s SMS login codes, and that accounts protected by two-factor authentication would almost certainly not have been affected, because the attackers would also have needed a password.

The FAQ is plain about limits. It says Telegram cannot protect you if someone takes your unlocked phone without a passcode, if an IT department accesses a work computer, or from other people who get physical or root access. On a rooted or jailbroken device, it says, no application can be called safe, whatever the encryption.

ESET goes further for some readers. It says activists, journalists, whistle-blowers and anyone whose messages could put them at serious risk should not rely on Telegram for sensitive topics and should use a strongly audited end-to-end messenger such as Signal. For those who still choose to use Telegram it lists Secret Chats, an app passcode, two-factor authentication, a check of active sessions and turning off contact syncing. Telegram’s FAQ makes a separate claim about itself: that Telegram is more secure than mass market messengers like WhatsApp and Line.

What we did not use

We tested nothing in the app. We opened a Telegram Support Force manual, written by a group of volunteers, and did not use it. The pages we read do not say how to tell a Secret Chat from a cloud chat in the chat list, which data Telegram has handed over since 2024, or whether anyone at the company can read cloud history. On calls, only Wire speaks to the claim, repeating it for one-to-one calls and questioning group video calls, and the pages we read do not include a test of either. We could not date the FAQ.