Is Telegram Safe? An Evidence-Based Security Review

Telegram is one of the world's most widely used messaging apps, passing one billion monthly active users in March 2025. For everyday conversations, joining public communities, and following channels, it is reasonably safe when you understand one crucial fact: unlike Signal or WhatsApp, Telegram does not protect your messages with end-to-end encryption by default. Regular chats, every group, and every channel use client-server encryption, which shields your traffic from Wi-Fi snoopers but still lets the content reach Telegram's servers in a form the company can technically access.

That single architectural choice drives almost every serious safety debate about the platform. Security researchers at Royal Holloway and ETH Zurich, cryptographer Matthew Green, and the Electronic Frontier Foundation all converge on the same point: only manually started one-on-one Secret Chats and voice or video calls are end-to-end encrypted, and as of the EFF's January 2026 Encrypt It Already campaign, Telegram still has not made end-to-end encryption the default for direct messages. So the honest verdict is conditional. If you are an ordinary user who hardens a few settings, Telegram is acceptably safe. If you are an activist, journalist, or anyone whose messages could put them in danger, independent experts advise against relying on Telegram's defaults.

Telegram runs two different encryption schemes side by side. Cloud chats, the default for every private conversation, group, and channel, are encrypted between your device and Telegram's servers using the company's MTProto protocol, then stored in Telegram's cloud so your history syncs across devices. Telegram says this stored data is heavily encrypted, with decryption keys split across data centers in different jurisdictions, and that it does not use your data for advertising. Secret Chats work differently: they are end-to-end encrypted with keys generated on your devices through a Diffie-Hellman exchange, exist only on the two devices that started them, never touch Telegram's cloud backups, and support self-destruct timers.

The catch is what Secret Chats do not cover. They are only available for one-on-one conversations, never for groups or channels, and you must start one deliberately for each contact. Cryptographer Matthew Green documented that activating the feature takes multiple taps through non-obvious menus and requires the other person to be online, which means the vast majority of Telegram conversations, and literally every group chat, remain readable on Telegram's servers. A community answer on Security StackExchange captures the everyday confusion well: normal chats are encrypted in transit, so a network administrator cannot read them, but Telegram itself technically can. If default end-to-end encryption matters to you, see our Telegram vs Signal comparison.

Inside a Secret Chat you also get screenshot alerts and self-destructing messages, although Telegram itself cautions that screenshot detection cannot be guaranteed on every operating system and that nothing prevents someone photographing a screen with another device. You can read more about whether Telegram notifies screenshots in our dedicated explainer.

Safety is not only about message content. Telegram's privacy policy allows the company to collect metadata such as your IP address, the devices and apps you use, and your history of username changes, and to keep that metadata for up to 12 months for anti-abuse purposes. Signing up requires a phone number, although Telegram hides it from non-contacts by default and provides a dedicated Who Can See My Number setting introduced with its granular privacy controls.

The company's legal posture changed sharply in 2024. After CEO Pavel Durov was detained in France in August 2024 and charged with offenses including complicity in illegal content distribution and refusal to assist lawful interception, charges he denies, Telegram updated its terms. Since September 2024, the privacy policy states that Telegram may disclose a user's IP address and phone number to judicial authorities that present a valid legal order, with cases reported through its transparency channels. The BBC and the EFF both documented this shift, and the EFF noted it alarmed communities that had chosen Telegram precisely because it marketed resistance to government demands.

Telegram also has an inactivity self-destruct feature for accounts, and its FAQ recommends Secret Chats, 2-Step Verification, and an app passcode for anyone with real security concerns. Because public references currently disagree about the exact default self-destruct period, do not rely on any assumed value: open Settings and confirm the period yourself, alongside the metadata retention practices described in the privacy policy.

For most people, the biggest day-to-day danger on Telegram is not cryptography but other people. Groups can hold up to 200,000 members, bots can be created by anyone, and security vendors have documented thriving phishing markets, fraudulent investment schemes, and malware distribution that exploit that openness. Norton's review of the platform reached the same conditional verdict this page does, calling Telegram fairly safe for the average person while cataloguing the scam ecosystem that operates inside it. Our guide to common Telegram scams and how to avoid them covers the specific schemes in depth.

On the moderation side, Telegram has historically drawn criticism for a lighter touch than rival platforms, a factor in the 2024 French investigation. The company now reports blocking more than 40 million groups and channels during 2025, checking public images against child-abuse hash databases including the Internet Watch Foundation's, and publishing daily transparency reports. Its Terms of Service prohibit spam, scams, promotion of violence, and illegal pornographic content on public parts of the platform, and require users in the EU, UK, and Australia to be at least 18. Those rules matter for families: public discovery surfaces can still expose younger users to inappropriate communities, so the age limits deserve respect.

Many people use Telegram in a browser, and using Telegram Web safely raises one more question: what about extensions that add features, such as video downloaders? The honest answer is that an extension is only as trustworthy as its disclosures, and you should read them critically. Take the Telegram Video Downloader extension associated with this site as a worked example. Its Chrome Web Store listing (version 1.3.2, a Manifest V3 extension declaring storage and tabs permissions with host access limited to telegram.org pages) describes saving videos, images, and audio from Telegram Web with original filenames.

Rights matter as much as privacy. Telegram's Terms of Service prohibit scraping and the platform's rules protect content owners; saving media is appropriate only for content you created, own, or have explicit permission to keep, and channel owners' restrictions and copyright law apply regardless of what any tool makes technically possible. If that describes your use case, our guide on how to download Telegram videos you are authorized to save explains the process step by step.

So, is Telegram safe? For public communities, channels, and everyday chats, yes, provided you harden the settings above and treat strangers' links with suspicion. For sensitive one-on-one conversations, it can be acceptable if you deliberately use Secret Chats on trusted devices. For anyone whose safety depends on their provider being unable to read or hand over their communications, the expert consensus points elsewhere: Telegram's own materials frame the platform as secure, while cryptographers and digital-rights groups counter that without default end-to-end encryption most content remains technically accessible to the company, which since 2024 also discloses IP addresses and phone numbers under valid legal orders. Both positions are documented; which one governs your decision depends on what you have at stake.