Telegram authenticates using your phone number and an SMS code, making accounts vulnerable to SIM swapping. Two-step verification adds a full password as a second layer — protecting you even if someone intercepts your SMS code.
Enabling Two-Step Verification
- Open Telegram and go to Settings → Privacy and Security
- Tap Two-Step Verification
- Set a strong password (this is different from your phone PIN)
- Add a recovery email address
- Confirm your email via the link Telegram sends
Choosing a Strong Password
Unlike Instagram or Discord which use codes, Telegram's two-step verification uses a full text password. Make it at least 12 characters. Store it in a password manager — losing it locks you out for 7 days.
What It Protects Against
Without two-step verification, anyone who can receive an SMS to your number can log into Telegram. With it enabled, they'd also need your verification password — a much harder barrier to overcome.
How Telegram's Two-Step Verification Differs from Standard 2FA
Standard TOTP-based 2FA uses a time-based code from an authenticator app. Telegram's two-step verification is different: it is a password you create that must be entered in addition to the SMS verification code Telegram sends when you log in on a new device. The SMS code confirms you control the phone number; the two-step password confirms you know the additional secret. Together, they prevent SIM-swap attacks from being sufficient to take over your account.
Choosing a Strong Telegram Two-Step Password
Your Telegram two-step verification password should be different from your phone unlock code and from any other password you use. Since you only enter it when setting up on a new device (not during normal use), you can make it quite long and complex. A passphrase of four or more random words is ideal — memorable enough to recall if needed but long enough to resist brute force. Consider storing it in a password manager as a backup.
What the Two-Step Verification Protects
Telegram's primary login mechanism is your phone number — you receive an SMS code to verify it. Without two-step verification, anyone who can receive SMS messages to your number (including someone who has SIM-swapped it) can log in to your Telegram account and read all your non-secret chats. Adding a two-step password means an attacker also needs to know that password, which they cannot obtain just from controlling your phone number.
Telegram Secret Chats vs Regular Chats and 2FA
Regular Telegram chats are stored on Telegram's servers and accessible from any device. Secret chats are end-to-end encrypted and device-specific — they do not sync across devices. Two-step verification protects access to your account and therefore your regular chat history. Secret chats cannot be read even by someone with full account access on a different device.
Forgetting Your Telegram Two-Step Password
If you forget your password and have a recovery email set up, tap "Forgot password?" and Telegram sends a reset link to that email. Without a recovery email, you have two options: wait 7 days (after which Telegram will allow you to log in without the password, but your cloud-stored chat history will be deleted for security), or endure the wait. This is why adding a recovery email during setup is strongly recommended.
Troubleshooting Common Telegram 2FA Issues
Password not accepted: The two-step password prompt appears only after your SMS code has been verified on a new device. If Telegram rejects your password, make sure you are not typing an older password you recently changed. Updating to the latest version of the app also resolves most display issues, since very old clients sometimes show a confusing password entry screen.
Recovery email not arriving: Telegram sends the confirmation link to your inbox, so check the spam folder if it does not appear within a few minutes. Some email providers block messages from Telegram; adding the sending address to your contacts usually fixes this. Until the email is confirmed, your two-step password is only partially active — if you cannot recover via email later, you would face the full 7-day wait.
Forgetting the password on an old session: If you are still logged in on one of your own devices, you can change the two-step password from Settings → Privacy and Security → Two-Step Verification → Change Password without knowing the current one — the app does not re-prompt you on an active session.
Extra Steps to Protect Your Telegram Account
Two-step verification is the most important control, but it works best alongside other settings. Review active sessions under Settings → Devices periodically and terminate any you do not recognise — a session on an unknown device means someone else has your account even if they have not taken it over completely. Under Privacy and Security you can also restrict who can call you, add you to groups, or see your phone number, which limits what an attacker can learn about you before attempting a SIM swap.
Keep your recovery email itself protected with its own 2FA and a unique password, since it is the key to resetting your Telegram password. If you change phone numbers, update your Telegram profile and recovery email before deactivating the old number. Note that Telegram also offers a third-party "login protection" notification whenever a new device signs in — treat unexpected login alerts as an emergency and use the Log Out All Other Sessions option immediately.
Setting Up Two-Step Verification on Any Device
The path is nearly identical on every platform, but the wording differs. On Android, open Settings → Privacy and Security → Two-Step Verification. On iPhone the same menu lives under Settings → Privacy and Security. On Telegram Desktop, click the ☰ menu in the top-left, then Settings → Privacy and Security → Two-Step Verification. On web (web.telegram.org), click the ☰ menu, then Settings, then Privacy and Security.
Every client asks for the same three things: a password, a password hint, and a recovery email. The hint is optional but useful — it appears on the login screen when you enter the wrong password, so make it a private nudge ("the dog's name plus the year") rather than the answer itself.
What Login Looks Like on a New Device
When you sign in on a new phone or computer, Telegram first sends an SMS or in-app code to your number. Only after that code is accepted does Telegram ask for your two-step password — a deliberate order that reveals which layer is which: the SMS proves you control the number, the password proves you are the intended user even if the number is compromised.
If you have an active session on another device, Telegram may show a login notification there instead of (or in addition to) the SMS code. Approving it requires a tap, and then the password prompt still appears. That two-step gate also applies to Telegram's web client and to third-party apps such as Telegram X, so a stolen session token from one client cannot bypass the password.
Why Telegram Does Not Use an Authenticator App
Most services issue TOTP secrets so a standard authenticator app can generate codes. Telegram deliberately does not. Its account system is built around the phone number, and its second layer is a cloud password whose hash is stored server-side, tied to your account rather than to a device. Because the password is checked against Telegram's servers, it works on any client instantly — there is no secret to transfer when you switch phones, and no clock to drift out of sync.
The tradeoff is that the password is only as strong as you make it, which is why Telegram nudges you with a strength meter during setup and why a recovery email matters more here than it does for TOTP-based services. A short password can be brute-forced if an attacker has your phone number and the SMS code, so length genuinely matters for this specific method.
Keeping Your Recovery Email Healthy
The recovery email is the only remote reset path you have, so treat it like a spare key. Confirm it during setup, check that the confirmation link actually arrived (Telegram only marks the email as valid after you click it), and use an address you check regularly — a dormant mailbox you registered years ago is where reset links go to die. Until the link is clicked, Telegram will keep showing the email as unconfirmed on the settings screen, so a few seconds of verification saves you from discovering the gap during an actual lockout.
Change the recovery email whenever you lose access to that inbox, from Settings → Privacy and Security → Two-Step Verification. If the email itself is taken over, the attacker can reset your Telegram password and lock you out, so put 2FA on that mailbox too. The pairing works in both directions: Telegram protects the email's login; the email protects Telegram's recovery.