Telegram is a free messaging app with text chats, groups, channels and voice and video calls on Android, iPhone, iPad, Windows, Mac, Linux and the web. Telegram Messenger Inc. provides the service; its parent company, Telegram Group Inc, is located in the British Virgin Islands.

Telegram’s founder financed the company for most of its history, and it now also earns money from Sponsored Messages in public channels and from the Premium subscription.

By default, Telegram chats are not end-to-end encrypted. Ordinary one-to-one chats and group chats, which Telegram calls cloud chats, are encrypted between your app and Telegram’s servers and stored in Telegram’s cloud, and the decryption keys stay with Telegram. End-to-end encryption covers only secret chats, which are one-to-one and have to be started separately, and voice and video calls.

Cryptography & Protocol

Telegram encrypts messages with its own messenger protocol, MTProto 2.0, which the major Telegram apps have used since version 4.6. In cloud chats the protocol encrypts traffic between the app and the server with AES-256 and SHA-256. The messages are then stored encrypted in Telegram’s cloud, and the decryption keys stay with Telegram.

Telegram states that cloud chat data sits in data centers controlled by different legal entities in different jurisdictions, with the decryption keys split into parts. According to Telegram’s FAQ, several court orders from different jurisdictions would be needed to force it to hand over this data.

Secret chats add a second layer of encryption between the two devices, and Telegram’s FAQ states that only you and the recipient can read those messages. End-to-end encryption is opt-in: a secret chat has to be started by hand, and ordinary chats stay cloud chats. A secret chat is tied to the device where it was started, its messages cannot be forwarded, and logging out deletes it.

Secret chats use a Diffie-Hellman key exchange between two users. Official Telegram apps replace the key after it has encrypted or decrypted more than 100 messages or after one week of use, and discard the old key. Discarding old keys this way gives secret chats forward secrecy: a later leak of a key cannot decrypt earlier messages.

Group chats are not end-to-end encrypted. Secret chats exist only between two people, so Telegram has no group end-to-end encryption, and every group chat is a cloud chat. Voice and video calls are end-to-end encrypted.

Metadata Privacy

Telegram uses the phone number as the sign-up identifier, and its FAQ describes the number as the only way for Telegram to identify a user. A username lets other people message you without knowing your number.

For contact discovery, Telegram stores your up-to-date contacts on its servers so it can notify you when one of them signs up.

The privacy policy states that Telegram may keep the IP address, devices, apps used and username history for up to 12 months. Telegram may also analyze messages in cloud chats with automated algorithms to stop spam and phishing, and moderators may check messages reported to them.

The privacy policy states that Telegram may disclose the IP address and phone number to authorities in response to a legal request, after a legal analysis of that request. Telegram’s FAQ states that it has “disclosed 0 bytes of user messages to third parties, including governments.”

Data of users who signed up from the UK or the European Economic Area is stored in data centers in the Netherlands.

On telemetry, the privacy policy describes aggregated data about how people use Telegram, which it uses to build features; one of those features can be turned off with the “Suggest Frequent Contacts” setting. The policy does not mention analytics or crash reports.

Transparency & Verifiability

All official Telegram apps are open source, under the GNU GPL version 2 or later for Android and iOS and the GPL version 3 for the other apps. The server code is not published. Telegram’s FAQ explains that publishing it would give no security guarantees for secret chats or cloud chats, because users cannot verify that the same code runs on the servers.

Telegram has supported reproducible builds since version 5.13, and calls the verification process experimental. On Android a user builds the app in Docker and compares it with the app extracted from the phone. On iPhone the check requires a jailbroken device, about 90 GB of free space and a macOS virtual machine with Xcode, because of Apple’s FairPlay encryption.

In 2022 four academic researchers presented an analysis of MTProto 2.0 at the IEEE Symposium on Security and Privacy, with a full version in the Journal of Cryptology in 2026. They described four attacks: two on the protocol specification, a timing side channel in three official apps, and an attack on the server’s key exchange that breaks its authentication and allows a man-in-the-middle attack. The same paper proves a modified variant of the protocol secure. This is academic research, not an audit commissioned by Telegram.

Usability & Reach

Telegram has apps for Android, iPhone, iPad, Windows, Mac and Linux, plus two web versions. Cloud chats are stored in Telegram’s cloud, so you can sign in on as many devices as you like at the same time and the history syncs across them; this multi-device use works for cloud chats only. This backup model means Telegram stores your history encrypted with keys that stay with Telegram.

Voice and video calls are end-to-end encrypted. A self-destruct timer is available for all messages in secret chats and for media in private cloud chats.

Secret chats do not sync: they exist only on the device where they were started, and logging out deletes them. A user who wants end-to-end encryption therefore loses the multi-device convenience that cloud chats offer.

Funding & Sustainability

Telegram’s funding model is mixed. According to its FAQ, founder and CEO Pavel Durov financed Telegram through most of its history. Sponsored Messages in public channels launched in 2021 and the Premium subscription in 2022.

Ads are chosen by the language of the content and a location approximated from the phone number or IP address. Telegram states that it does not use the contents of private chats or contact lists for ad targeting, and that private messaging will stay free, with no ads and no subscription fees.

Pros and Cons

Secret chats and calls are end-to-end encrypted
A secret chat's key is replaced after 100 messages or a week and the old one is discarded
All official apps are open source and support reproducible builds
Cloud chats sync across as many devices as you sign in on, all at the same time
Apps for Android, iPhone, iPad, Windows, Mac, Linux and the web
A username lets people message you without knowing your phone number
Telegram states it does not use private chats or contact lists for ad targeting
Private messaging is free, and Telegram states it will stay free

Ordinary chats, the default, are encrypted only up to Telegram's servers, and the decryption keys stay with Telegram
Group chats are never end-to-end encrypted
Secret chats are one-to-one only, stay on one device and are lost when you log out
A phone number is required, and Telegram stores your contacts on its servers
IP address, devices and username history may be kept up to 12 months and passed to authorities on a legal request
Automated algorithms may analyze messages in cloud chats to stop spam and phishing
Telegram's own protocol had four attacks described in a 2022 academic analysis
The server code is not published, and reproducible builds are experimental, with a very demanding check on iPhone

Our Rating

Cryptography & Protocol4.0/10
End-to-end encryption covers only one-to-one secret chats and calls; ordinary chats and all groups are encrypted only up to Telegram's servers, on its own protocol that a 2022 academic analysis found four attacks on.
Metadata Privacy3.0/10
A phone number is required, contacts are stored on Telegram's servers, and IP address and device data can be kept up to 12 months and passed to authorities on a legal request.
Transparency & Verifiability6.5/10
The apps are open source with experimental reproducible builds, but the server code is not published and the independent work on record is academic research, not a commissioned audit.
Usability & Reach9.0/10
Cloud chats sync across Android, iPhone, iPad, Windows, Mac, Linux and the web, with calls and a self-destruct timer; secret chats stay on one device and are lost when you log out.
Funding & Sustainability6.0/10
Founder-financed for most of its history and now earning from Sponsored Messages and Premium; ads use a channel's language and approximate location, never private chats or contacts.

Overall5.2/10

Cryptography & Protocol 30% · Metadata Privacy 25% · Transparency & Verifiability 20% · Usability & Reach 15% · Funding & Sustainability 10%

See our rating methodology →