How to Set Up Two-Step Verification on Telegram

Two-step verification adds a password that Telegram asks for after the login code whenever you sign in on a new device. You turn it on in Telegram's Privacy and Security settings, choose a password, add an optional hint and a recovery email. It is the single most effective step you can take to protect your account.

This guide shows how to set it up, how to choose a good password and recovery email, and what to do if you forget the password.

Why two-step verification matters

Signing in to Telegram normally takes one thing: a code sent to your Telegram app or by SMS. If someone tricks you into sharing that code, or intercepts it, they can get into your account.

With two-step verification on, they also need your password. A stolen code on its own is no longer enough. That is why every channel admin, group owner and anyone who uses Telegram for work should have it switched on.

To understand why codes get stolen so often, read why you must never share a Telegram login code.

Before you start

Have these ready:

• A password you have not used anywhere else.
• Access to an email address you check and control.
• A safe place to store the password, such as a password manager.

How to turn on two-step verification

Menu labels can change between app versions. If a name differs, look in your app's privacy or security settings.

1. Open Telegram's Settings.
2. Go to Privacy and Security.
3. Tap Two-Step Verification.
4. Choose to set a password.
5. Enter your new password, then enter it again to confirm.
6. Add a hint if you want one. Keep it vague enough that it does not give the password away.
7. Enter a recovery email address.
8. Telegram sends a code to that email. Enter it to confirm the address.
9. You should see a message confirming that two-step verification is on.

From now on, signing in on a new device will ask for your login code and then this password.

Choosing a good password

Your Telegram password protects everything in your cloud chats, so make it strong.

• Use a long passphrase. Several unrelated words are easier to remember and harder to guess than a short, complex string.
• Make it unique. Never reuse a password from email, shopping or social media. If one of those leaks, attackers try the same password everywhere.
• Avoid personal details. Names, birthdays and pet names are the first things people guess.
• Store it safely. A password manager is the best option. Writing it down and keeping it somewhere secure at home is better than forgetting it.

Choosing a recovery email

The recovery email is how you reset the password if you forget it. Choose carefully.

• Use an address you will still have in years to come.
• Make sure that email account has its own strong password and its own two-step verification.
• Do not use an address shared with other people.

If someone gets into your recovery email, they may be able to reset your Telegram password. Securing the email protects Telegram too.

Changing your password or recovery email

You can change either at any time from the same Two-Step Verification screen. Telegram asks for your current password first.

Change your password if:

• You think someone might have seen it.
• You reused it somewhere that was breached.
• You shared a device with someone you no longer trust.

Update the recovery email if you stop using the old address. A recovery email you cannot access is the same as having none.

What to do if you forget your password

If you forget your two-step verification password, use the "forgot password" option on the password screen when signing in.

• With a recovery email: Telegram sends a code to that address, and you can set a new password.
• Without a recovery email: getting back in can be slow or impossible, and you may lose access to some data. Telegram's options here can change, so check its help pages for the current process.

This is the main reason to add a recovery email and keep it up to date.

Other security steps to pair with it

Two-step verification works best alongside a few other habits.

1. Review your active sessions. In your settings, look at the list of devices logged in to your account. End any you do not recognise.
2. Set a passcode lock if your app offers it, so someone holding your unlocked phone cannot open Telegram.
3. Hide your phone number from strangers. See how to hide your phone number on Telegram.
4. Learn the common scams. Many attacks start with a friendly message. Our guide on how to spot Telegram scams covers the patterns.

For channel and group admins

If you run a channel or group, your account is a key to something other people rely on.

• Ask every admin to turn on two-step verification.
• Give each admin only the rights they need.
• Remove admins who no longer help run the channel.
• Never share a single admin account between several people. Add each person as their own admin instead.

A hijacked admin account can post scam links to your whole audience in minutes. Two-step verification makes that much harder.

Common mistakes

• Skipping the recovery email. It is optional, but without it a forgotten password can lock you out for good.
• Using a recovery email you rarely check. You may miss alerts or lose access to it.
• Reusing a password. A leak somewhere else becomes a leak here.
• Putting the password in the hint. A hint should remind you, not reveal it.
• Sharing the password with "support". Telegram staff will never ask for it.
• Turning it on and forgetting the password the same week. Save it in a password manager before you leave the setup screen.

FAQ

Is two-step verification the same as the login code?

No. The login code is sent to you each time you sign in. Two-step verification adds a separate password you choose, which is asked for after the code on new devices.

Will Telegram ask for my password every time I open the app?

No. It is asked for when you sign in on a new device. Day to day, your app opens as normal.

Can I turn two-step verification off?

Yes, from the same settings screen, after entering your current password. It is safer to leave it on.

What if someone already has my login code?

If two-step verification is on, they still need your password. Check your active sessions, end any you do not recognise, and change your password if you think it may also be known. If you have already lost access, see how to recover a hacked Telegram account.

Does two-step verification protect my secret chats?

It protects your account from being taken over. Secret chats are stored only on the devices where they were started, so a new login cannot see them anyway.

Will someone know if I have two-step verification on?

No. Other users cannot see whether you have it enabled.

Summary

Two-step verification takes a few minutes and blocks most account takeovers. Turn it on in Privacy and Security, choose a long, unique password, and add a recovery email you control and protect. Store the password somewhere safe, review your active sessions regularly, and never share your password or login code with anyone. For more on staying safe, read Is Telegram safe?.