Telegram is as safe as you set it up to be. Most chats are encrypted between your device and Telegram’s servers, not end to end, so Telegram can in principle store and process them. Only secret chats are end to end encrypted. The app is also widely used by criminals, mainly because anyone can open a public channel or bot, so the main risks for ordinary users are scams, fake accounts and stolen login codes.
Is Telegram encrypted?
Yes, but not the way many people assume. Telegram’s FAQ says that “server-client encryption is used in Cloud Chats (private and group chats)”. That means the traffic is protected on the way to Telegram’s servers, but Telegram holds the messages so you can read them on any device. According to the same FAQ, “all messages in secret chats use end-to-end encryption”, which means only you and the other person can read them, and secret chats are tied to a single device.
Telegram says cloud chat data is stored in several data centers around the world, controlled by different legal entities in different jurisdictions, and that the decryption keys are split into parts and never kept in the same place as the data. Those are Telegram’s own claims about its design. Telegram’s FAQ also says that group calls, with up to 200 participants, are protected by end-to-end encryption. Regular groups, however, are not end to end encrypted.
| Question | Cloud chats | Secret chats |
|---|---|---|
| How is it encrypted? | Between your device and Telegram’s servers | End to end, only you and the other person can read it |
| Stored on Telegram’s servers? | Yes, so it works on every device | No, Telegram says it does not store secret chats on its servers |
| Which devices? | All your devices | The one device where you started it |
| Used by default? | Yes, including groups | No, you start one from the person’s profile |
What does Telegram know about you?
Telegram’s privacy policy says it stores your phone number and, to tell you when a contact joins, your up-to-date contacts. It may also collect metadata such as your IP address, devices and apps to protect your account, and says this metadata can be kept for 12 months at most.
The same policy says that if Telegram receives a valid order from the relevant judicial authorities that confirms you are a suspect in a case involving criminal activities that violate its Terms of Service, it will perform a legal analysis of the request and may disclose your IP address and phone number. So the app is not anonymous: the person you are talking to, and in some cases the authorities, can learn who you are. Telegram’s FAQ also states that it has “disclosed 0 bytes of user messages to third parties, including governments”.
Why is Telegram still legal?
A messaging app is lawful in most places, in the same way that a phone network is lawful even though criminals use phones. What is under legal review is whether the company met its obligations when its platform was used for crime. Telegram’s Terms of Service forbid scams, spam, promoting violence on public channels and offering illegal goods.
The clearest official source is the Paris public prosecutor. Its press release of 28 August 2024 says Telegram’s chief executive was placed under formal investigation (mis en examen) for a list of offenses, including complicity in administering an online platform that allows illicit transactions as part of an organized group, and refusing to hand over information requested by authorized authorities. It says the case began as a preliminary investigation in February 2024 and a judicial investigation opened on 8 July 2024. Being placed under formal investigation is not a conviction. According to a Bloomberg Law report of 10 November 2025, French authorities lifted his travel ban and the duty to report to a police station, and the investigation continues.
Telegram’s own EU page says the service has significantly fewer than 45 million average monthly active recipients in the EU, which is below the line for a “very large online platform” under the Digital Services Act. It also lists a form for reporting illegal content.
- February 2024Preliminary investigation beginsParis prosecutor’s office, per its press release.
- 8 July 2024Judicial investigation openedOpened by an introductory requisition.
- 28 August 2024Chief executive placed under formal investigationBail of 5 million euros, police reporting twice a week, no leaving France.
- 10 November 2025Travel ban and reporting duty liftedInvestigation continues, per Bloomberg Law.
How do criminals use Telegram?
The same features that make Telegram easy for ordinary people also help criminals: public channels with thousands of members, bots that run 24 hours a day, and a sign-up that needs only a phone number. In October 2024 the United Nations Office on Drugs and Crime reported that it had mapped data from thousands of Telegram underground marketplaces, groups and channels attributed to Asian organized crime networks. It said that several platforms run by regional criminal networks have come to dominate the illicit economy, particularly on Telegram.
For defenders the picture is wider. In our post on Telegram marketplaces and the shift of criminal activity after the 2025 forum closures, the monitored groups held 861,382 files, 363,596 of them combolists. We also explain how phishing kits can forward stolen logins to a bot, and how bots are used as command servers. For the wider underground, see the background guide on hacker and leak forums and our BreachForums takedown timeline.
Criminal use of the platform does not mean your own chats are at risk. The risk for you comes from what reaches you: unsolicited messages, fake support accounts, job or investment offers, and links that lead to a page that asks for your login code. Stolen accounts and passwords, such as those in stealer logs, can also end up for sale, which is why reuse of passwords is dangerous on any app.
How can you use Telegram more safely?
Telegram’s FAQ warns users not to give anyone their passwords, Telegram codes or bank account numbers, and says login codes should never be shared with anyone. The settings below are all in the app.
- Turn on 2-Step VerificationThen login needs both an SMS code and a password.
- Never share a login codeTelegram says not to give it to anyone.
- Check your devicesSettings, Devices, shows active sessions you can end.
- Use a secret chat for sensitive one to one talksCloud chats are not end to end encrypted.
- Treat unknown messages and bots with careDo not click links or share codes. The FTC advises checking with the company using contact details you already trust.
- Report spamUse the Report spam button; Telegram says moderators review it.
Bots in groups are in privacy mode by default and only see messages meant for them, according to Telegram’s FAQ, but some bots need that mode turned off to work and can then see all group messages. The member list shows which bots have message access. If you work in security, treat an unknown channel or bot as untrusted, do not join or buy anything, and tell your security team if your company name, staff logins or customer data are mentioned.
Sources
Platform facts come from Telegram’s own pages: the FAQ, the Privacy Policy, the Terms of Service, the EU Digital Services Act guidance and the spam FAQ. The French case is described in the press release of the Paris public prosecutor (in French) and in a Bloomberg Law report. The UN Office on Drugs and Crime published Transnational Organized Crime and the Convergence of Cyber-Enabled Fraud, Underground Banking and Technological Innovation in October 2024. Advice on scam messages comes from the US Federal Trade Commission and from CISA, which advises against clicking unsolicited links and verifying the sender through contact details you already trust.
Last checked against sources: 10 October 2026.