Short answer: Telegram’s two-step verification is a password you set on top of the SMS login code. Turn it on at Settings → Privacy and Security → Two-Step Verification → Set Additional Password, choose a password you will remember, and add a recovery email. Without it, anyone who intercepts your SMS login code owns your account — with it, the code alone is useless.
How Telegram login actually works
Telegram does not use passwords by default. You enter your phone number, receive a code by SMS or in-app, and you are in. Convenient, and a single point of failure: whoever receives that code becomes you.
Two-step verification adds a password that is requested after the code. It converts login into genuine two-factor authentication — something you have (the number) plus something you know (the password).
This matters more on Telegram than most apps because the account is the identity. Take it over and you inherit the person’s contacts, group memberships, channel admin rights, and — since cloud chats are not end-to-end encrypted by default — their message history.
Step 1: Set the additional password
- Open Telegram and go to Settings.
- Tap Privacy and Security.
- Tap Two-Step Verification (on desktop: Settings → Privacy and Security → Two-Step Verification).
- Tap Set Additional Password.
- Enter a password, confirm it, and optionally add a hint.
Make it strong and unique — a password manager entry, not a variation of something you use elsewhere. And make the hint genuinely useful to you and useless to anyone else.
Step 2: Add a recovery email — and verify it
Telegram will offer to add a recovery email address. Add one, and complete the verification.
This is the step where people get burned. Telegram’s password recovery runs entirely through this email. If you skip it, or enter an address and never click the confirmation link, there is no recovery path at all — and Telegram support cannot reset it for you. Your only option becomes deleting the account after a waiting period, losing all cloud chats.
Use an address you control and that has strong 2FA of its own — see our Google or Microsoft guides. And check your inbox for the confirmation now rather than assuming it worked.
Step 3: Understand what this does and does not cover
It protects: new logins from unrecognised devices. Someone with your SMS code but not your password cannot get in.
It does not protect: sessions already logged in. If someone has an active session on another device, the password does not evict them — which is why step 4 matters.
It also does not make your chats end-to-end encrypted. Telegram cloud chats are encrypted in transit and at rest but readable by Telegram; only Secret Chats are end-to-end encrypted, and they are per-device and not backed up. Two-step verification and encryption are separate questions.
Step 4: Audit active sessions
Under Settings → Devices (or Privacy and Security → Active Sessions), Telegram lists every logged-in device with location and last-active time.
Terminate anything you do not recognise. Also set Auto-terminate old sessions to the shortest period you find comfortable, so forgotten logins expire on their own.
Do this now, before assuming your account is clean. An intruder who logged in weeks ago is still there until you remove them.
Step 5: Reduce your exposure
Three more settings worth changing while you are in Privacy and Security:
- Phone number visibility — set “Who can see my phone number” to Nobody. Your number is the account identifier and the target of every takeover attempt.
- Who can add me to groups — set to My Contacts. This stops mass-add spam and scam group invitations.
- Passcode Lock — a local PIN or biometric to open the app. Protects against someone picking up your unlocked phone.
Also consider whether your SIM itself is protected. A SIM swap hands an attacker the login code, and two-step verification is then the only thing standing in the way. Set a carrier port-out PIN.
The scam you will actually encounter
The dominant Telegram attack is not technical. A message arrives from a contact’s account — already compromised — asking you to vote in a competition, join a channel, or “confirm” something. The link leads to a fake Telegram login page requesting your number and then the code you receive.
Hand it over and your account joins the chain, and the same message goes to everyone you know. Two-step verification breaks this: the code alone is no longer enough.
The rule stands regardless: never enter your Telegram code on any website, and never forward it to anyone. Telegram itself will never ask. More scripts in OTP scams.
Frequently asked questions
Can I use Google Authenticator with Telegram?
No. Telegram’s two-step verification is a password, not a TOTP code, so authenticator apps are not involved. Store the password in a password manager instead. For services that do use codes, see how TOTP codes work.
What if I forget the password?
Use the recovery email link. If you never verified an email, Telegram cannot reset it — you would have to delete the account and start again, losing cloud chats and channel ownership. This is why the email step is not optional.
Is Telegram two-step verification real 2FA?
Yes. The phone number code is something you have, the password is something you know — two different categories. See MFA vs 2FA.
Does it protect my Secret Chats?
Secret Chats are tied to a specific device and are not restored on a new login, so they are already protected from remote takeover. The password protects your cloud chats and account access.
How is this different from WhatsApp’s two-step verification?
Very similar in concept — both add a secret on top of the SMS registration code. WhatsApp uses a six-digit PIN, Telegram uses a full password, which is stronger. See WhatsApp two-step verification.
Should I turn it on if I only use Telegram occasionally?
Yes — arguably especially then. Dormant accounts are attractive precisely because a takeover goes unnoticed for a long time, and your contacts still trust messages from your name.
The bottom line
Two minutes: set the password, add the recovery email, click the verification link, then clear out old sessions and hide your phone number. The recovery email is the part that decides whether a forgotten password is a minor annoyance or the end of the account — Telegram genuinely cannot help you without it.
Securing other accounts too? Our complete guide to two-factor authentication covers the ladder, and our free 2FA code generator handles the services that use codes.