Lock your account down: two-step verification, passcode, active sessions
What it is
Two-Step Verification asks for a password on top of the SMS code whenever someone logs in on a new device. A passkey lets you log in with your device's PIN, fingerprint or face instead of an SMS code. A passcode locks the app on this device. Devices lists every session, so you can end the ones you don't recognize.
How to do it
1. Settings › Privacy and Security › Two-Step Verification: set a password, a hint and a recovery email, then confirm the email with the code sent to it.
2. Settings › Privacy and Security › Passkeys adds a passkey.
3. Settings › Privacy and Security › Passcode Lock (iOS: Passcode & Face ID; Desktop: Local passcode), then set Auto-Lock.
4. Settings › Devices: tap a session to end it, or Terminate All Other Sessions. Under Automatically terminate old sessions, choose when idle devices get logged out.
5. In Settings › Privacy and Security, If Away For sets when an unused account deletes itself: 18 months by default.
Watch out
- Without a recovery email, a forgotten password can only be reset from a device that's still logged in, and the reset takes 7 days.
- A device that logged in less than 24 hours ago can't end your other sessions.
- The passcode is local: it protects this device, not your account elsewhere.
- Telegram knows you by your phone number. Even with a passkey, keep the account on a number you control.
With Gem
Gem has no part in your account security; these switches are yours alone. Nearby: ask @gembot to remind you once a month to check Settings › Devices.