How to Enable Two-Step Verification in Telegram

Open Settings → Privacy and Security → the cloud password entry (labelled Two-Step Verification or Cloud Password depending on the version), set a password, write a hint and — this part matters — add a recovery email. From then on, signing in on a new device requires that password in addition to the SMS code.

The setup takes a couple of minutes and defends against the most common hijacking method: intercepting the login code. Below are the steps, plus the details that cost people access to their own accounts.

What the cloud password protects against

By default, signing into Telegram is confirmed with a code sent by SMS or as a message in the app. That code can be intercepted — through mobile network weaknesses, a SIM swap, or plain social engineering where someone is talked into reading the digits out.

A cloud password adds a second barrier: even with the code, a stranger can't get in. It's the only built-in defence against a profile being taken over through the phone number.

Enabling it on your phone

Open Settings and go to Privacy and Security.
Choose the entry for two-step verification or the cloud password.
Tap to set a password and enter it twice.
Write a hint — a short phrase that will remind you of the password.
Add an email address for recovery.
Open the email from Telegram and enter the confirmation code.

Until that emailed code is entered, the protection isn't fully configured — see the step through to the end.

Enabling it on a computer

In the app for Windows, macOS and Linux, open the settings, go to the privacy section and find the same two-step verification entry. The sequence is identical: password, hint, email, confirmation.

The setting belongs to the account rather than the device, so there's no need to repeat it on your phone.

The recovery email is the key step

Telegram lets you skip the email, and that's exactly where accounts get lost. Without a recovery address, a forgotten password can't be reset: all that remains is an account reset, which deletes the profile along with every conversation, contact and subscription.

The requirements for that address are simple but worth following:

the mailbox must be working and accessible to you at any time;
ideally it has two-factor protection of its own;
avoid an address on a work domain that could be switched off when you leave the job.

Choosing a password and a hint

This password isn't a one-time code — it's used rarely, but exactly when you're signing in on a new device. The sensible approach is a long, unique string kept in a password manager, not in the notes app of a phone that could go missing along with the account.

The hint is displayed on the password screen, so it must not give the password away. "Same as my email" or "first pet" are poor choices. A short reference only you understand works better.

Changing or disabling the password

The same settings section lets you change the password, edit the hint, update the recovery email or turn the protection off entirely. All of those require the current password.

Disable it only deliberately: afterwards, a single SMS code is enough to sign in again.

If you forget the password

On the password screen, tap the forgotten-password link.
Check your email — a message with a reset link arrives.
Set a new password.

If you can't reach the email, Telegram offers an account reset. The wording is misleading: it isn't recovery but deletion of the profile and all its data. Roughly a week passes between the request and the deletion, and an ordinary login during that time cancels it — so if the password comes back to you, use it.

How this differs from the app passcode

The settings hold another option — a passcode that locks the app itself with a fingerprint, face or PIN. People often confuse it with two-step verification, but they do different jobs:

The cloud password protects the account from logins on other devices.
The passcode protects your conversations from whoever picks up your unlocked phone.

Neither replaces the other, and there's every reason to use both.

If you have several accounts

The protection is configured per profile: a password on your personal account does nothing for the second one. People running a personal and a work profile in the same app miss this regularly.

Work accounts especially deserve a password — client conversations and channel access run through them. If you set such a profile up for a project using ready-made Telegram accounts, enabling the cloud password and attaching your own recovery email is worth doing right after the first login, before any work starts.

Common mistakes

Skipping the recovery email. The costliest mistake: a forgotten password then means a lost account.
Writing an overly explicit hint. It's visible to anyone attempting to log in.
Storing the password in Saved Messages. Once you're locked out, it's out of reach.
Not confirming the email address. Without entering the emailed code, recovery may not work.
Giving the password to "support". Telegram's real support never asks for it.

FAQ

Do I have to enter the password every time I open the app?

No. It's only requested when signing into the account on a new device, not when opening Telegram normally.

Does the cloud password replace the SMS code?

No, it's added to it. The confirmation code comes first, then the password.

Will my active sessions be reset when I enable it?

No, devices where you're already signed in keep working. The protection applies to new logins.

Can I set a password without an email?

Technically yes, but it's risky: a forgotten password then can't be recovered.

What if the reset email doesn't arrive?

Check the spam folder and make sure the address is right. If the mailbox is inaccessible, email recovery won't work.

Does it stop someone reading my chats on my own phone?

No — that's what the app passcode and your device's screen lock are for.

Does two-step verification interfere with changing my number?

No. The number is changed from inside the account, and the password stays in force.

What happens if I enter the password wrong several times?

A delay appears before the next attempt. Nothing is deleted, and the hint stays available.

In short

Two-step verification in Telegram is switched on in the privacy section in a few minutes: password, hint, recovery email and an emailed confirmation. Don't skip the email — without it, a forgotten password is the same as a lost account. And keep the two jobs straight: the cloud password blocks logins from other devices, while the app passcode protects the conversations on your own phone.