Telegram Passport Explained: What It Stores and Who Uses It

Telegram Passport is a feature that stores your identity documents and personal details inside Telegram, end-to-end encrypted with a password only you know, so you can share them with a service that needs to verify who you are. You fill it in once, and when a service asks, you choose exactly which items to send. Telegram says it cannot read the stored data, and services that use it are mostly ones with identity-check obligations, although few services have adopted it.

This guide explains what Passport stores, how the encryption and password work, what happens when a service requests your data, who uses it, the risks and scams to watch for, and how developers integrate it. Telegram has not changed Passport much in years, but menus move, so if something looks different in your app, use the descriptions here to find it.

What Telegram Passport is for

Many services must check a customer's identity before they can serve them: financial services, crypto exchanges, some marketplaces, and services that must confirm age or residence. The usual process is a web form asking for a scan of your passport, a selfie and a utility bill, typed in again for every service.

Passport aims to make that repeatable and private. You upload documents once into an encrypted store tied to your Telegram account. When a service that supports Passport asks, Telegram shows you a form listing what the service wants. You approve, and the data goes, encrypted, straight to that service.

Two things Passport is not:

• It is not verification by Telegram. Telegram does not check your documents or confirm you are who they say. The service receiving the data does its own checks. A phone number and email address are treated differently, because Telegram confirms those, as described below.
• It is not a login method on its own. It is a way of handing over documents. Signing in to a website with your Telegram account is a different feature; see our guide to adding Log in with Telegram to a website.

What Passport can store

Telegram's Bot API documentation lists the kinds of items a service can request. They fall into five groups.

Personal details

Your name, date of birth, gender, citizenship and country of residence. Telegram also supports storing your name in the language of your country of residence alongside the Latin version, which some services require.

Identity documents

• Passport
• Driver's licence
• Identity card
• Internal passport, used in some countries alongside or instead of a travel passport

For each, you can store the document number and expiry date, scans of the front and back where relevant, and a selfie holding the document if the service asks for one. A service can also request a certified translation of a document.

Address

Your residential address as structured fields: street, city, state, postcode and country.

Proof of address documents

• Utility bill
• Bank statement
• Rental agreement
• Passport registration
• Temporary registration

These are stored as files (scans or photos) rather than typed fields, with optional translations.

Contact details

Your phone number and email address. These are different from the rest because Telegram verifies them: your phone number is the one on your account, and an email address is confirmed with a code. A service receiving them knows they were checked.

You do not have to fill in everything. Most people add items only when a service asks for them.

How the encryption works

This is the part that makes Passport different from emailing a scan, so it is worth understanding.

End-to-end encrypted with your password

Telegram describes Passport data as end-to-end encrypted. Encryption and decryption happen on your device, in Telegram's open-source apps, using a key derived from your password. What reaches Telegram's servers is ciphertext that Telegram cannot read.

Which password

Passport is protected by your Telegram cloud password, the same one used for two-step verification. If you open Passport without one, Telegram asks you to create it. Each time you open Passport or share data, you enter that password.

The password is the only key

Because Telegram cannot read the data, it cannot recover it either. Telegram's app warns that if you reset your password, all documents uploaded to Passport will be lost. That is the trade-off of real end-to-end encryption: there is no "forgot password" that brings the data back.

Two practical consequences:

1. Set a recovery email for your cloud password. It lets you regain the password itself; the Passport data survives only if you avoid a full reset.
2. Keep your original documents. Treat Passport as a convenient encrypted copy, never as the only place a scan exists.

How data reaches a service

When you share, your app decrypts the items you chose, then encrypts them again for that specific service, using a key that only the service can unlock. Telegram passes the encrypted package along without being able to read it. The service decrypts it on its own servers.

Step by step: setting up Passport

The exact location varies by app. On most versions it is in the privacy and security settings.

1. Open Settings, then Privacy and Security.
2. Look for Telegram Passport. If you do not see it there, some apps only show it when a service first requests data; the setup then happens inside that request.
3. Enter your cloud password, or create one if prompted. Write it down somewhere safe.
4. Add the items you are likely to need: personal details first, then documents.
5. For each document, take clear photos in good light, with all four corners visible and no glare across the text.
6. Check each item for typos. A service comparing your typed details with the scan will reject a mismatch.

You can edit or delete any item later from the same screen. Deleting it removes it from Passport; it does not remove copies that services have already received.

Step by step: sharing data with a service

You do not start this from Telegram. A service that supports Passport shows a button on its website or app, often labelled with Telegram Passport.

1. Tap the button on the service. Telegram opens with an authorisation form.
2. Check the name of the bot or service making the request at the top of the form. It should match the service you were using.
3. Read the list of requested items. Each shows whether you already have it stored or need to add it.
4. Fill in anything missing. You can usually upload or photograph documents right there.
5. Enter your cloud password to decrypt your data on your device.
6. Tap the button to authorise. Only the listed items are sent.
7. Return to the service. It will tell you whether it accepted the documents.

If you change your mind before authorising, close the form. Nothing is sent until you confirm.

If a service asks you to fix something

Services can tell Telegram that a specific item has a problem, for example an unreadable scan or an expired document. Telegram then highlights that item the next time you open the request, with the service's reason, so you know exactly what to fix rather than starting again.

Passport compared with an ordinary upload form

Most identity checks ask you to upload photos on the service's own website. Here is how Passport differs, point by point, so you can judge which you prefer when a service offers both.

• Where your copy lives. With an upload form, your scans sit on your phone's camera roll or in a downloads folder, often unencrypted and synced to a photo cloud. With Passport, the copy you keep is encrypted inside Telegram and locked with your password.
• Typing it again. An upload form starts empty every time. Passport reuses what you stored, so details are consistent across services.
• What you are shown before sending. Passport lists exactly which items the service asked for, and sends nothing else. An upload form can ask for anything on any page.
• Who can read it in transit. Both normally use encrypted connections, but with Passport the data is encrypted for the specific service on your device, so even Telegram, which carries it, cannot read it.
• What happens after delivery. No difference. Either way, the service holds a copy under its own policy.

Passport therefore improves storage, consistency and transparency. It does not reduce what the service ends up holding.

Passport on Android, iPhone, Desktop and Web

Passport is part of Telegram's own apps, and the experience differs slightly by platform.

Android and iPhone

The mobile apps are the most complete place to use Passport. You can photograph documents directly with the camera, which is usually the easiest way to get a clear scan, and the selfie step uses the front camera. If you are asked to add a document during a request, doing it on your phone saves transferring files.

Telegram Desktop

Telegram Desktop supports Passport requests and lets you upload document files from your computer. It suits people who already have good scans saved as files. Taking a selfie holding a document is awkward on a computer, so if a service asks for one, you may find it easier to complete that step on your phone.

Web versions

Browser versions of Telegram have historically supported fewer features than the apps. If a Passport request does not open properly in a browser, open it with the mobile or desktop app instead. Our comparison of Telegram Desktop, Web and mobile covers the wider differences.

If you use more than one account

Passport belongs to one Telegram account and is locked with that account's cloud password. If you have several accounts in the app, check which one is active before authorising a request, so your documents go from, and are stored in, the account you intend. See using multiple Telegram accounts.

Getting documents accepted the first time

Most rejected identity checks fail on photo quality or mismatched details, not on Passport itself. A few habits avoid a second round.

Photographing documents

1. Place the document on a plain, dark surface so its edges are clear.
2. Use daylight or an even room light. Avoid a single lamp, which causes glare on laminated cards.
3. Fill most of the frame, with all four corners visible.
4. Hold the phone parallel to the document so it is not skewed.
5. Check the photo at full size before uploading: every character, including the small machine-readable lines at the bottom of a passport, should be legible.

Taking the selfie with a document

When a service asks for a selfie, it wants to compare your face with the document photo. Hold the document beside your face, not in front of it, with the photo page facing the camera. Remove sunglasses and hats, and make sure your face is evenly lit.

Typed details

Type your name exactly as it appears in the document's Latin-character fields, including middle names. If your document also shows your name in another script, add that version in the native-language fields when a service requests it. Dates must match the document, not how you usually write them.

Translations

Some services require a certified translation of a document that is not in a language they accept. A certified translation is one made by a translator or agency who attests that it is accurate, under rules that vary by country. Passport lets you attach translation files to a document. A photo of your own typed translation will not normally be accepted, so check what the service means by "certified" before paying for one.

Expiry dates

Store the expiry date with each document. When a document expires, update it in Passport with the new one. A service may ask again when a document it holds expires, and an expired document is a common reason for rejection.

Before you share: a quick checklist

Run through this each time a Passport form opens:

1. Did I start this from the service's own website or app, reached by a link I trust?
2. Does the bot named at the top of the form match that service?
3. Does the list of requested items make sense for what I am doing? An age check, for example, should not need a bank statement.
4. Am I in the right Telegram account?
5. Am I comfortable with this service keeping these documents for as long as its policy says?

If any answer is no, close the form. Nothing has been sent.

Troubleshooting

The button on the website does nothing

How to recognise it: you tap the Passport button and Telegram does not open, or a browser page appears instead.

1. Make sure Telegram is installed on that device and you are logged in.
2. On a computer, check that Telegram Desktop is installed; a browser cannot hand the request to an app that is not there.
3. If links from the browser do not open Telegram at all, our guide to Telegram links not opening covers the causes.

If it still fails, try completing the check on your phone instead.

Telegram says the password is wrong

How to recognise it: the form asks for your password and rejects it.

1. This is your two-step verification password, not your phone's lock code or an app passcode.
2. Check the keyboard language and caps lock.
3. Use the password hint if you set one.
4. If you have a recovery email, you can recover the password. Remember that a full reset without recovery deletes Passport data.

An upload fails

How to recognise it: a document photo will not attach, or the form shows an error after you select it.

1. Check your connection and try again.
2. Try a fresh photo taken in the app rather than a file from elsewhere; some file formats are not accepted.
3. If a file is very large, retake the photo at normal resolution.

The service rejects your documents

How to recognise it: the service says verification failed, or Telegram highlights an item with an error from the service.

1. Read the reason shown next to the highlighted item.
2. Fix only that item, using the photo tips above.
3. If the service gives no reason, contact its support. Telegram cannot see your documents and cannot tell you why a service declined them.

Deleting your Passport data

You can delete individual items, or all of Passport, from the Passport screen in your privacy settings. Deleting removes the encrypted copies Telegram stores for you. It does not reach copies that services already received; contact each service if you want those removed. Deleting your whole Telegram account also removes your Passport data, along with everything else, as explained in what happens when you delete your Telegram account.

Who uses Telegram Passport

When Telegram launched Passport, it pitched it at services with identity-check requirements, such as payment providers and crypto services, and said it planned to work with third-party verification providers in future. In practice, adoption has stayed limited. Most services that verify identity use dedicated identity-check providers on their own websites, and you are unlikely to meet the Passport button often.

That has two implications:

• There is little reason to fill in Passport in advance unless a service you actually use supports it. Adding documents only when asked keeps less of your data anywhere at all.
• A request to "verify with Telegram Passport" deserves a second look. Because the feature is uncommon, scammers can borrow its name to sound official. The genuine flow always starts from the service's own website or app and opens Telegram's built-in form; it never involves sending scans in a chat.

Is Passport safe to use?

The design is sound: end-to-end encryption, data sent only to the service you approve, and only the items it lists. The real risks lie elsewhere.

Risk 1: the service you share with

Once data reaches the service, it is under that service's control. Passport protects data in storage and in transit, not after delivery. Before you share, consider whether you trust the service with your documents at all, exactly as you would with a web upload form. Read its privacy policy for how long it keeps documents.

Risk 2: a weak or reused password

Anyone with your phone, your Telegram session and your cloud password can open Passport. A unique, strong password and a passcode lock on the app reduce that risk.

Risk 3: an unfamiliar bot asking for data

The authorisation form shows which bot is asking. A fake site can show a Passport button that opens a form for a bot impersonating a real service. If the bot name does not match, close the form.

Risk 4: scams using the Passport name

Common patterns include a "Telegram support" account asking you to "complete Passport verification" to keep your account, an "exchange agent" requesting scans to "unlock a withdrawal", and a job offer requiring ID "through Telegram Passport" before an interview. Telegram does not contact you in chats to ask for documents. Our guides on how to spot Telegram scams and Telegram task and job scams show these patterns in more detail.

Passport for developers

If you run a service that needs identity documents, Passport is one option. This section is conceptual; Telegram's Passport manual and the Passport section of the Bot API documentation are the authoritative references.

What you need

1. A bot created with @BotFather. The bot is the identity users see on the authorisation form. See creating a bot with BotFather.
2. An RSA key pair. You keep the private key on your server and register the public key with @BotFather for that bot. Telegram's apps use the public key to encrypt data for you.
3. A web page or app screen with a Passport button, using Telegram's published helper for websites or the equivalent in your app.

The request

Your button opens Telegram with a request that names your bot, lists the scope (the items you want and options such as selfies or translations), includes your public key, and carries a nonce: a unique random value you generate for this request. Request only what you genuinely need; users see the list and are more likely to decline a long one.

Receiving the data

When the user authorises, your bot receives an update containing a passport data field. It holds the encrypted items and a set of encrypted credentials. Your server:

1. Decrypts the credentials with your private key.
2. Checks that the nonce inside matches the one you issued, and has not been used before. Telegram's documentation warns never to accept the same nonce twice.
3. Uses the per-item secrets from the credentials to decrypt each item and download and decrypt each file.

Verifying and reporting problems

Passport hands you documents; it does not tell you they are genuine, except for the phone number and email, which Telegram has confirmed. Your own checks still apply. If an item is unusable, the Bot API's setPassportDataErrors method lets you tell Telegram which item and why, so the user is asked to fix just that.

Is Passport a good fit for your service?

Weigh it honestly before building it in.

Points in its favour:

• Your users are already on Telegram, for example because your service runs as a bot or a Mini App. Staying inside Telegram avoids sending them to a separate upload page.
• Consistent, structured data. Personal details arrive as fields, not as text you must read off a photo.
• Verified phone and email come with the request, saving you a separate confirmation step.
• A clear consent record. The user saw exactly which items you requested and approved them.

Points against:

• It does not check documents. You still need your own review or a separate checking service for authenticity, liveness and sanctions screening where those apply.
• Not everyone has Telegram, so you will need a second route for other customers anyway.
• Limited familiarity. Because few services use it, some users will hesitate or suspect a scam. Explain it on your page in a sentence.

A common, sensible pattern is to offer Passport as one option beside your normal upload form, and let users pick.

Compliance

Holding identity documents carries legal duties in most countries, covering storage, retention and access. Passport does not change those duties. This is general information, not legal advice; check the rules that apply to your service with a qualified professional.

Worked examples

These are illustrative scenarios.

Example: a straightforward share

Maria signs up for a service that offers Telegram Passport for identity checks. She taps the button, sees the service's bot named on the form, and is asked for personal details and a passport scan with a selfie. She has none stored, so she adds them in the form, enters her password and authorises. The service later asks her to re-upload the selfie because it was blurry; Telegram shows her exactly that item to fix.

Example: a scam stopped

Tom receives a message from an account called "Telegram Verification" saying his account will be limited unless he completes Passport verification by sending photos of his ID in the chat. He recognises that the real flow never runs through a chat, blocks the account and reports it. Our guide on how to report on Telegram shows how.

Example: a lost password

Ana forgets her cloud password and has no recovery email. To keep using her account, she resets the password, and her Passport documents are deleted as the app warned. She still has her original documents, so she simply adds them again when a service next asks.

Common mistakes

• Treating Passport as the only copy of a document scan.
• Forgetting the cloud password without having set a recovery email.
• Not checking which bot is asking on the authorisation form.
• Sending document photos in a chat because someone claimed it was "Passport verification".
• Filling in every item in advance when no service you use supports Passport.
• Assuming Telegram verified your documents. Only the phone number and email are confirmed by Telegram.
• For developers: accepting a reused nonce, or requesting more items than the service needs.

FAQ

Can Telegram see my Passport documents?

Telegram describes Passport as end-to-end encrypted, with encryption handled by its open-source apps using your password. Its servers store data they cannot read.

What happens to my Passport data if I reset my password?

Telegram's app warns that resetting the password deletes all Passport documents. Set a recovery email so you can recover the password instead.

Does sharing with one service share with others?

No. Each request is separate, and only the items listed on that request's form go to that one service.

Can I delete data a service already received?

Deleting it from Passport removes your stored copy, not the service's. Ask the service directly under its privacy policy and your local data protection rules.

Do I need Telegram Premium for Passport?

No. Passport is a standard feature and does not depend on Premium.

Is Telegram Passport the same as getting a verified badge?

No. The blue verification badge is for notable public accounts and is applied for through @VerifyBot. See how to get verified on Telegram.

Summary

Telegram Passport is an end-to-end encrypted store for identity details and documents, locked with your Telegram cloud password and shared only with services you approve, one request at a time. Telegram cannot read it and cannot recover it if you reset the password. Few services use it, so add documents only when a real service asks, always check the bot named on the form, and never send documents in a chat to anyone claiming to need "Passport verification".