# Telegram password: Two-Step Verification, passcode and account security How to set, change and recover a Telegram password and lock out devices that should not be there. https://shiba-bank.com/en/guides/telegram-password Updated 2026-10-02 · 7 min read Telegram has two different passwords. The **cloud password**, which Telegram's FAQ calls Two-Step Verification, protects logging in: when you sign in on a new device you need it in addition to the code. You turn it on under Settings → Privacy and Security → Two-Step Verification. The **passcode** locks the app on one device, so nobody can open your chats on a phone they pick up. Only the cloud password stops someone who has obtained your login code, so set both. ## Cloud password vs passcode The cloud password is tied to the account and asked for at sign-in, after the code. The passcode lives on one device only and is asked for when the app is opened. Telegram's FAQ sets the passcode under Settings → Privacy and Security (on iPhone the item is called "Passcode & Face ID"). Neither replaces the other. ## How to set a password on Telegram 1. Open Settings → Privacy and Security → Two-Step Verification and choose to set a password. 2. Pick a password you do not use anywhere else. 3. Telegram offers a hint for it. Add one, but not a hint that lets a stranger guess the password. 4. **Add a recovery email.** Without it a forgotten password is slow and risky to deal with (see below). Telegram may ask you to confirm the address with a code from an email. You change the password in the same section. If you have forgotten the current one you cannot change it, and need the reset described below. > **Important:** Never give your login code or cloud password to anyone, including "support" or an "admin". Telegram does not ask for them. Only a scammer asks for them, whatever the reason given — see the guide to [Telegram scams](https://shiba-bank.com/en/guides/telegram-scams). ## Forgot your Telegram password or can't remember the cloud password: what to do What you can do depends on whether you set a recovery email and whether you are still signed in somewhere else. - **You have a recovery email.** On the password screen choose the forgotten-password option. A code arrives by email; once you enter it the cloud password is removed and you can set a new one. - **No email, but the account is open on another device.** Start a password reset. According to Telegram's API documentation a **7-day timer** starts. During those days the owner can cancel the reset, with a button in a message from Telegram's service account or inside the app. After seven days the password is removed. - **No email and you are signed in nowhere.** The remaining route is resetting the account, and it is costly. As the app itself says, an active account protected by a password is deleted after a week, and all your chats, messages, media and files are lost. You end up with an empty account. If the real owner cancels the reset, the app tells you to try again only after 7 days. So keep the password in a password manager and check the recovery email in advance. > **Important:** The seven-day wait protects you as well. If you get a message about a password reset that you did not start, cancel it and end the other sessions straight away. ## Active sessions: how to end a stranger's login Settings → Devices (Telegram's FAQ also gives the path Privacy & Security → Active Sessions) lists every device where your account is open, with the IP addresses of the logins. End any session you do not recognise: select it and confirm. If there are many signs of a break-in, the app usually also lets you end all other sessions at once. Things worth knowing: - **The 24-hour rule.** A new session cannot end other sessions until a day has passed since it signed in (this is in Telegram's API documentation). If you logged in recently, you may have to wait. A thief who has just logged in cannot end your sessions either. - **Automatic clean-up.** The app has a setting to terminate old sessions automatically after a period of inactivity (its name and the periods depend on the app version), so forgotten logins disappear by themselves. - **Cloud password after a break-in.** Once you have ended the stranger's sessions, turn on or change the cloud password at once. Otherwise the thief can sign in again with a new code. - If your phone is stolen, Telegram's FAQ advises turning on Two-Step Verification, ending the session on the old device and asking your carrier to block the SIM card. ## Passkeys instead of SMS codes Since December 2025 Telegram lets you sign in with a passkey: instead of an SMS code you confirm with your device PIN or a fingerprint or Face ID. You create one under Settings → Privacy and Security → Passkeys, on any device. You can still request an SMS code with a passkey, so Telegram asks you to keep an up-to-date phone number that you control. For extra safety, add a cloud password too: it is asked at every sign-in. ## Why this matters for Stars and gifts Your Stars balance and gifts sit in the account, so whatever the owner can do, someone who gets in can do too: spend Stars, hand over a unique gift, write to your friends. A cloud password, a recovery email and a checked list of devices close off most account thefts. More on moving gifts: [NFT gifts on Telegram](https://shiba-bank.com/en/guides/telegram-nft-gifts). In the Shiba Bank bot, Stars and Premium are bought by @username: you do not sign in, share a code or a password, and the bot never asks for them. You can also keep Stars on the bot's wallet, separate from your Telegram account. [Buy Stars — Open the app](https://t.me/barboskich_stars_bot?startapp=site_ai_en_buy) ## Frequently asked questions ### How do I set a password on Telegram? Settings → Privacy and Security → Two-Step Verification, then set a password. Add a recovery email, or a forgotten password means a week-long reset. ### What does the cloud password do on Telegram? It asks for the password together with the code when you sign in on a new device. If someone gets your code from a message, they still cannot enter without the password. ### I forgot my Telegram password. What now? If you set a recovery email, choose the forgotten-password option and enter the code from the email. With no email, start a reset from another signed-in device: the password is removed after 7 days. If you are signed in nowhere, only an account reset is left, and it loses your chats. ### How do I reset the cloud password on Telegram? If you set a recovery email, choose the forgotten-password option and enter the code from the email. With no email, but with the account open on another device, start a password reset: according to Telegram's documentation it takes 7 days, and the owner can cancel it the whole time. If you are signed in nowhere, only an account reset is left, and it loses your chats. ### How do I change my Telegram password? Open Two-Step Verification and choose to change the password. You need the current password; if you have forgotten it, reset it first. ### Where can I see active sessions on Telegram? Settings → Devices. End any you do not recognise; if you suspect a break-in, end all the others and change the cloud password.