Telegram Accounts, Start to Finish

Telegram's defaults are permissive in ways that surprise people who assume messaging apps are private by default. Setup is trivial; the settings afterwards are where the work is.

Creating an account

You need a phone number. Telegram sends a code by SMS, or in-app if you are already signed in elsewhere.

Enter your name. A username and profile photo are optional and can be added later.

That is the whole process. The account is tied to the number, and moving to a new number is possible from within the app.

The settings to change immediately

Set a two-step verification password. Settings, Privacy and Security, Two-Step Verification.

This is the single most important setting. Without it, anyone who obtains your SMS code — through a SIM swap, an intercepted message, or access to your number — can take the account. With it, they also need the password.

Add a recovery email while setting it, because there is no other way back if you forget it.

Review who can see your phone number. Settings, Privacy and Security, Phone Number. The default allows more visibility than most people expect. Set it to Nobody, and separately choose who can find you by your number.

Set a username. With a username, you can be contacted without sharing your number at all. This is the practical way to use Telegram without exposing your number to groups and strangers.

Last seen and online status. Default is Everybody. Note the reciprocity rule: if you hide yours, you cannot see other people's.

Profile photo visibility. Also Everybody by default.

Who can add you to groups. Change this from Everybody to My Contacts. It is the setting that stops you being dropped into large unsolicited groups, which is otherwise a persistent nuisance.

Active sessions. Settings, Devices. Review what is signed in and terminate anything you do not recognise. Set the auto-terminate period for old sessions.

The thing about encryption

Ordinary Telegram chats are encrypted in transit and stored on Telegram's servers, where the company can technically access them. This is what enables the cloud sync that makes the app convenient across devices.

Secret Chats are end-to-end encrypted, device-to-device, not stored on servers, and not synced. They are started deliberately, work only between two devices, and support self-destructing messages.

Group chats are never end-to-end encrypted.

If you specifically need end-to-end encryption by default, that is a reason to use a different app for those conversations. Telegram's strengths are elsewhere: large groups, channels, bots, file sizes and cross-device sync.

Useful things that are not obvious

Saved Messages is a chat with yourself, and it works as a personal notepad and file store synced across devices. Forward anything into it.

Message scheduling. Hold the send button to schedule.

Edit and delete for everyone, without a time limit in most cases. Deleting removes the message from the other person's device too, which is unusual among messaging apps.

Folders to separate work, personal and channels. Settings, Folders. On a busy account this is the difference between usable and not.

Auto-delete timers can be set per chat, for everyone in it.

Deleting an account

The detail that catches people: deletion is done through Telegram's website, not in the app. There is no delete button in the settings.

Go to the account deletion page on Telegram's site, enter your number, receive a confirmation code in the app, and confirm.

What happens: messages, groups you created, contacts and your account are removed. Messages you sent to others are removed from their chats as well. This is immediate and irreversible.

Self-destruct is the alternative. Settings, Privacy and Security, Delete My Account If Away For. Set a period — the shortest is one month. If you do not open Telegram in that time, the account deletes itself. Useful as a dead-man switch, and worth noticing if it is set shorter than you intend, because it will eventually fire.

Before deleting: export your data. Settings, Advanced, Export Telegram Data on desktop. You can select chats, media and files, and it produces a browsable archive.

Recovering an account you have lost access to

If you have the number, you can sign in again with an SMS code. If you also set two-step verification, you need the password, and the recovery email if you forgot it.

If you have lost the number and did not set a recovery email, there is no recovery path. Telegram cannot restore access without one of these, by design.

This is worth acting on in advance rather than discovering afterwards.

Mistakes people make

Not setting two-step verification. Without it, anyone who obtains your SMS code owns the account. SIM-swap attacks target exactly this.

Setting it without a recovery email. There is then no way back if you forget the password.

Assuming chats are end-to-end encrypted. Ordinary chats are not. Only Secret Chats are, and group chats never are.

Leaving "who can add you to groups" as Everybody, then wondering why you keep appearing in large unsolicited groups.

Looking for the delete button in the app. Account deletion is done on Telegram's website.

Forgetting the self-destruct timer, which defaults to a set period of inactivity and will eventually fire.

The short answer

Set two-step verification with a recovery email, set a username so you need not share your number, restrict group additions to contacts, and review active sessions. Five minutes, and it covers nearly everything.