Telegram is one of the most popular messaging apps in the world, with over 900 million active users. It offers a strong set of privacy and security tools โ but almost none of them are enabled by default. Out of the box, strangers can see when you were last online, your profile photo, and potentially find your account by phone number. This guide walks you through every important setting, explains what it does, and gives you clear recommendations for locking down your account.
How Telegram Handles Encryption โ What You Need to Know First
Before diving into settings, it helps to understand what Telegram encrypts and what it does not. This matters because your settings choices work differently depending on the chat type.
Cloud chats (regular chats, groups, channels): These are encrypted between your device and Telegram's servers using MTProto encryption, but Telegram itself can technically access the content. Messages are stored on Telegram's servers so you can access them from any device.
Secret Chats: These use end-to-end encryption (E2E). Only you and the recipient can read the messages โ not even Telegram. Secret Chats do not sync across devices, do not support forwarding, and leave no trace on Telegram's servers. They also support a self-destruct timer.
For most everyday conversations, cloud chats are fine. For highly sensitive conversations, use Secret Chats. The settings in this guide apply to your overall account and affect cloud chats; Secret Chats have their own separate layer of protection.
Phone Number Privacy
Your phone number is tied to your Telegram account, but sharing it with everyone is unnecessary. By default, your contacts can see your number.
How to configure it:
- Open Telegram โ tap the hamburger menu (โฐ) or your profile icon
- Go to Settings โ Privacy and Security โ Phone Number
- Set "Who can see my phone number" to Nobody
- Set "Who can find me by my number" to My Contacts
Setting "find me by my number" to Nobody means no one can look you up by phone at all โ use this only if you want to be completely unlisted. Keeping it at "My Contacts" is the practical balance: people already in your contacts list can still find you, but strangers cannot.
Last Seen & Online Status
Your "Last Seen" timestamp tells others exactly when you were last active on Telegram. Combined with your online indicator, this gives away quite a lot about your schedule and habits.
How to configure it:
- Go to Settings โ Privacy and Security โ Last Seen & Online
- Set it to Nobody
Important trade-off: if you hide your Last Seen from someone, you will also not be able to see their Last Seen. This is Telegram's reciprocity rule.
Making exceptions: You can tap "Add Exceptions" to always-show or always-hide your status from specific people, regardless of the main setting. This is useful if you want family members to see you are online but hide it from everyone else.
Profile Photo Privacy
By default, anyone who finds your account can see your profile photo. This may be fine for most people, but if you prefer to stay more anonymous, you can restrict it.
How to configure it:
- Go to Settings โ Privacy and Security โ Profile Photo
- Options: Everybody, My Contacts, Nobody
- You can also set exceptions for specific users
A practical choice: set it to My Contacts so new contacts see your photo once they are in your contacts, but strangers see a generic avatar.
Bio / About Privacy
Your bio (the text under your name in your profile) is visible to others by default. If your bio contains personal details, restrict it.
How to configure it:
- Go to Settings โ Privacy and Security โ Bio
- Set to My Contacts or Nobody
Calls: Who Can Call You
Unwanted voice and video calls from strangers are a real nuisance. Telegram lets you restrict who can call you, and also lets you route calls through Telegram's servers to hide your IP address.
How to configure it:
- Go to Settings โ Privacy and Security โ Calls
- Set "Who can call me" to My Contacts or Nobody
- Enable "Peer-to-peer" โ set to Nobody to always use Telegram's relay servers (hides your IP address from the caller)
The peer-to-peer option is especially important for privacy-conscious users โ without it, the person calling you can potentially see your real IP address during a call.
Telegram Premium note: If you have Telegram Premium, you can also set calls to "Premium Users Only" โ a good middle ground between open and restricted.
Forwarded Messages: Protecting Your Identity
When someone forwards your message to another chat, Telegram by default includes a link back to your account. Anyone who sees the forwarded message can tap your name and visit your profile. You can disable this.
How to configure it:
- Go to Settings โ Privacy and Security โ Forwarded Messages
- Set to Nobody
With this set to Nobody, forwarded messages will show "Forwarded from a hidden user" instead of your name. Your messages can still be forwarded โ you just will not be linked to them.
Groups and Channels: Who Can Add You
A common annoyance (and sometimes a scam vector) is being added to random groups or channels without permission. By default, anyone can add you to groups.
How to configure it:
- Go to Settings โ Privacy and Security โ Groups and Channels
- Set to My Contacts
This prevents strangers from adding you to groups. If you want even stricter control, set it to Nobody โ though this means even your contacts will need to send you a group invite link instead of adding you directly.
Two-Step Verification (Most Important Security Feature)
This is the single most important security setting in Telegram. Here is why: Telegram login works by sending you an SMS code. If someone can intercept that SMS (through SIM-swapping, SS7 attacks, or access to your phone), they can log into your account. Two-step verification adds a second layer โ a password that only you know โ so the SMS code alone is not enough.
How to enable it:
- Go to Settings โ Privacy and Security โ Two-Step Verification
- Tap "Set Password"
- Enter a strong password (use a mix of letters, numbers, and symbols โ and write it down somewhere safe)
- Enter the password again to confirm
- Add a recovery email address โ this is critical. If you forget the password, you need this email to recover access
- Verify your email by entering the code sent to it
What to do after enabling it:
- Store your password in a password manager
- Make sure your recovery email is secure and you still have access to it
- Test it by logging into Telegram on another device (optional but recommended)
If you forget both your password and lose access to your recovery email, you will permanently lose access to your Telegram account. There is no other recovery method.
Active Sessions: See and Remove All Connected Devices
Every device where you are logged into Telegram shows up as an active session. If you ever lost a phone, or want to check whether anyone else has access to your account, review this list.
How to check:
- Go to Settings โ Privacy and Security โ Active Sessions (or Devices)
- You will see a list of all logged-in devices with their type, location, and last active time
- To log out of a specific session, tap it โ Terminate Session
- To log out of all other sessions at once, tap "Terminate All Other Sessions"
Get in the habit of checking this occasionally, especially after using Telegram on a shared or borrowed device.
Passcode Lock: App-Level PIN or Fingerprint
In addition to your phone's lock screen, you can add a separate passcode to the Telegram app itself. This protects your messages if someone else unlocks your phone (for example, using face recognition while you sleep).
How to enable it:
- Go to Settings โ Privacy and Security โ Passcode Lock
- Enable it and set a 4-digit PIN or a longer alphanumeric code
- Optionally enable Touch ID / Face ID for quick access
You can also set an auto-lock time โ how long the app can be idle before requiring the passcode again.
Auto-Delete Messages: Set a Default Timer for New Chats
Telegram lets you set a global auto-delete timer for all new one-on-one chats. Once set, messages in new chats will automatically delete after the timer expires (1 day, 1 week, or 1 month).
How to enable it:
- Go to Settings โ Privacy and Security โ Auto-Delete Messages
- Choose a default timer: 1 day, 1 week, or 1 month
This applies to chats you start after enabling the setting. It does not retroactively change existing chats. To set a timer for an existing chat, open the chat โ tap the contact name โ Set Auto-Delete Timer.
Blocking Users
If someone is harassing you or sending unwanted messages, block them.
How to block:
- Open the chat with that person
- Tap their name at the top to open their profile
- Tap the three-dot menu (โฎ) โ Block User
Blocked users cannot:
- Send you messages
- See your profile photo, bio, or last seen
- Add you to groups or channels
- Call you
To view and manage your blocked list: Settings โ Privacy and Security โ Blocked Users
Reporting Spam and Scams
Telegram has a built-in reporting system for spam, scams, fake accounts, and inappropriate content.
How to report:
- In a chat: tap the three-dot menu โ Report
- In a group or channel: tap the group name โ Report
- For a specific message: long-press the message โ Report
Choose the appropriate reason (spam, violence, illegal content, etc.). Reports go to Telegram's moderation team. You can report and block simultaneously.
Sensitive Content Filter
Telegram has a setting that restricts sensitive content from appearing in public channels and searches.
How to enable it:
- Go to Settings โ Privacy and Security
- Scroll down to find "Disable Filtering" โ keep this OFF (filtering enabled) unless you specifically want to see all content
Recommended Settings Checklist
Here is a summary table of recommended configurations based on your privacy needs:
| Setting | Casual User | Privacy-Conscious | High-Risk |
|---|---|---|---|
| Phone Number visibility | My Contacts | Nobody | Nobody |
| Find by phone number | My Contacts | My Contacts | Nobody |
| Last Seen & Online | My Contacts | Nobody | Nobody |
| Profile Photo | My Contacts | My Contacts | Nobody |
| Bio | Everybody | My Contacts | Nobody |
| Calls | My Contacts | My Contacts | Nobody |
| Peer-to-peer calls | My Contacts | Nobody | Nobody |
| Forwarded Messages | My Contacts | Nobody | Nobody |
| Groups & Channels | My Contacts | My Contacts | Nobody |
| Two-Step Verification | Enabled | Enabled | Enabled |
| Passcode Lock | Optional | Enabled | Enabled |
| Auto-Delete Messages | Off | 1 week | 1 day |
Who is "high-risk"? Journalists, activists, whistleblowers, anyone in a hostile political environment, or anyone who believes they may be targeted. If in doubt, apply the privacy-conscious column โ it is a sensible default for most people who care about their digital safety.
Final Thoughts
Telegram gives you more granular privacy controls than almost any other mainstream messaging app. The defaults, however, are designed for convenience โ not privacy. Taking 10 minutes to go through Settings โ Privacy and Security and applying the settings in this guide will meaningfully reduce your exposure.
The most impactful things you can do right now, in order of priority:
- Enable Two-Step Verification โ protects against SIM swap and SMS interception attacks
- Hide your phone number โ prevents strangers from finding and contacting you
- Set Last Seen to Nobody โ removes a source of personal metadata
- Restrict who can add you to groups โ stops spam and scam group additions
- Review active sessions โ ensure no unauthorized devices are connected
Do these five things and you will already be significantly better protected than the average Telegram user.