Table of Contents
How Passkey Technology is Changing Login Methods
The Cost and Delivery Challenges of SMS Verification Codes
How the Telegram Passkey Feature Works
Security Advantages of Passkeys Over Verification Codes
How to Set Up and Use Passkeys on Telegram
Syncing Passkeys Across Devices
The Market Impact of Telegram Introducing Passkeys
Other Security Innovations in the Telegram Ecosystem
Choosing a Better Telegram Client Experience
Telegram introduces passkeys for login, replacing SMS verification codes and solving issues with high costs and delivery failures. This new feature represents a significant advancement in secure authentication methods for messaging apps. As internet applications increasingly prioritize user account security, passkey technology is becoming an industry standard, and Telegram, as a privacy-focused platform, is at the forefront of this.
How Passkey Technology is Changing Login Methods
Passkeys are an authentication method based on public-key cryptography. Unlike the traditional username-and-password model, passkeys use on-device biometrics or a PIN to verify a user's identity. This approach eliminates dependence on a central password database, significantly reducing the risk of data breaches. When logging in, users simply need to use their fingerprint, facial recognition, or device PIN, allowing the system to verify their identity quickly in a safe and convenient manner.
Traditional login processes require users to remember complex passwords, whereas passkeys shift this burden from the user to the device. A user's biometric data is stored locally on their device and is never uploaded to a server. This means that even if Telegram’s servers were attacked, attackers would not be able to obtain the user's biometric information or original authentication data.
The Cost and Delivery Challenges of SMS Verification Codes
SMS verification codes were once the most common two-step verification method in internet applications. However, this method has multiple real-world problems. First is the cost issue—telecom operators charge for SMS services, and apps have to pay for every verification code message sent. As the user base grows, this cost becomes quite significant. Many apps operating in developing countries have found that verification code costs have become one of their largest expenditure items.
Secondly, unstable SMS delivery plagues users worldwide. In areas with poor network signals, users may have to wait several minutes to receive a code. In some cases, the code may never arrive at all, forcing users to request it repeatedly, which further exacerbates the cost pressure on operators. For international users traveling across different countries and regions, SMS delivery issues are even more severe due to roaming charges and local carrier restrictions. There are also users who, for privacy reasons, are unwilling to provide a real mobile phone number, making it impossible for them to log in using SMS verification codes.
How the Telegram Passkey Feature Works
The passkey implementation for Telegram is based on the WebAuthn standard, an open standard developed by the FIDO Alliance. When a user first registers a passkey on Telegram, the system generates a pair of keys on the user's device: a public key and a private key. The private key never leaves the user's device, while the public key is sent to the Telegram server.
The authentication process during login becomes extremely simple. After the user enters their phone number or username, Telegram sends a challenge to the user's device. The device verifies the user's identity via local biometrics or a PIN, and then uses the private key to sign the challenge. The device sends the signature back to Telegram, and the server uses the public key to verify the authenticity of the signature. If the signature is correct, the login is successful. The entire process is usually completed within seconds and does not require any network request to retrieve a verification code.
Security Advantages of Passkeys Over Verification Codes
Passkeys are far superior to SMS verification codes in terms of security. SMS codes are susceptible to man-in-the-middle attacks; malicious third parties can intercept codes via SIM swapping, carrier account takeovers, or SS7 protocol vulnerabilities. These types of attacks happen frequently in reality, and there have been several high-profile cryptocurrency wallet thefts caused by intercepted verification codes.
Passkeys completely avoid these risks. Because the authentication process occurs entirely on the user's device, attackers cannot intercept or forge the verification even if they control the user's network connection. Biometric features are unique—everyone’s fingerprints and facial features are different, which makes impersonation nearly impossible. Even if an attacker knows the user’s account information and public key, they cannot complete the login without the private key.
Furthermore, passkeys prevent issues with password reuse and weak passwords. Users no longer need to create and memorize complex passwords, relying entirely on the security of the device itself. Modern smartphone secure chips (such as Apple’s Secure Enclave or Android’s Titan M2) provide hardware-level protection for private keys, exponentially increasing the difficulty of an attack.
How to Set Up and Use Passkeys on Telegram
Enabling passkeys in the Telegram app is very simple. Users enter the settings menu, find the Security and Privacy options, and then select the Login options or two-step verification section. Telegram will provide an "Add Passkey" option. After clicking it, the system will request the device to perform biometric authentication or PIN verification to confirm that the owner is performing the action. Once authenticated successfully, the system will generate a passkey pair.
Users can create different passkeys for multiple devices. For example, you can create one on an iPhone and another on an Android phone. Each device has its own independent key pair. When logging in from a new device, users can verify using a passkey from an existing device and then register a new passkey on the new device. This flexibility ensures that users are not locked out of their accounts if they lose a device.
Syncing Passkeys Across Devices
Modern operating systems provide cloud syncing for passkeys. Both Apple’s iCloud Keychain and Google’s Password Manager support syncing passkeys across devices. This means users can create a passkey on an iPhone and use the same passkey to log in on an iPad or Mac. Similarly, Android users' passkeys can be synced across multiple Android devices under a Google account.
This syncing mechanism maintains a high level of security. Even if passkeys are synced in the cloud, private key information is end-to-end encrypted, and cloud service providers cannot see unencrypted key content. Login operations on any device require local biometric verification; merely possessing the public key is not enough to complete a login. Therefore, cloud syncing provides convenience without compromising security.
Telegram Market Impact of Introducing Passkeys
Telegram’s launch of passkeys marks a new era for secure authentication in messaging apps. Globally, tech giants such as Apple, Google, and Microsoft have all committed to gradually phasing out passwords in favor of passkeys. By introducing passkeys at this time, Telegram—a communications app renowned for security—demonstrates its leading position in security innovation.
This move has had a ripple effect across the industry. Other communication apps have begun to accelerate the development of their own passkey support. Banks, financial services, and e-commerce platforms are also evaluating how to integrate passkeys. This trend will eventually reshape the entire internet's identity authentication system, eliminating users' password management headaches while significantly raising the level of cybersecurity.
Other Security Innovations in the Telegram Ecosystem
Telegram has not only revolutionized the login experience through passkeys, but has also implemented multiple security innovations within its platform. The end-to-end encryption offered by Telegram ensures the privacy of user messages—only the sender and receiver can read the content, and even the Telegram company itself cannot access encrypted data. Users can send self-destructing messages, setting a timer to ensure that sensitive information is not stored for the long term.
Telegram also supports multi-account login, allowing users to log in to multiple Telegram accounts on the same device and switch between them quickly without re-logging. This is especially useful for professionals who need to manage several accounts. Additionally, Telegram’s key management system allows users to have full control over account access permissions, enabling them to view all logged-in devices in settings and remotely log out of any suspicious devices.
Choosing a Better Telegram Client Experience
Although the official Telegram app is quite well-rounded, many users seek additional customization options and enhanced functionality. Turrit is a third-party client developed based on the official Telegram API, providing a more flexible experience for users. Turrit fully supports Telegram’s passkey login functionality while providing more customization options.
Turrit has several standout features. Its built-in AI translation supports real-time translation with 99% accuracy, allowing users to translate messages before sending or directly translate entire chat histories. For international users, this eliminates language barriers. The real-time page translation feature in Turrit allows users to directly translate external webpages and Instant View articles within the in-app browser, with an accuracy rate of up to 95%.
Turrit also provides Channel Flow and Video Flow features, letting users scroll through channel updates and video content just like browsing TikTok. Users can control video playback with gestures—swiping up or down to adjust volume and brightness, and left or right to control playback progress, providing an immersive viewing experience. The video download speed of Turrit is 20 times faster, with no limits on uploading and downloading.
Turrit has also optimized its interface design. Users can switch freely between a side navigation bar and a bottom navigation bar, choosing the layout that best suits their usage habits. Turrit allows users to change the app icon, selecting different colors and styles to match their phone's home screen theme. Regarding privacy protection, Turrit provides a privacy check feature, allowing users to view their account's privacy score and enhance privacy settings with one click.
Turrit supports keyword blocking and group message filtering. Users can choose words to block, automatically filtering out advertising messages and unwanted content. This is particularly useful when managing large groups or channels. Turrit also provides a group notes feature, allowing users to add private notes to groups that only they can see, facilitating management and quick identification of various groups. Turrit supports simultaneous login of 10 accounts, allowing users to switch quickly between multiple accounts and pin up to 10 chats.
The search functionality of Turrit has also been enhanced. The content search feature allows users to explore more groups, channels, and bots. Users can click "Explore" in the search bar to discover new results. This makes it easier for users to discover interesting content and join relevant communities. Turrit also provides the same cloud storage features as the official Telegram, with unlimited backups of user data in the cloud.
Using Turrit to access Telegram provides users with all the core functions of the official app, including the security of passkey login, while enjoying more customization and enhanced features. Turrit is completely open-source and transparent; users can audit its code to ensure there is no hidden tracking or data collection behavior. Many privacy-conscious users choose Turrit as their primary Telegram client.
Overall, the passkey feature introduced by Telegram represents a significant upgrade in secure authentication for messaging apps. The launch of this technology not only solves the cost and delivery problems associated with SMS verification codes but, more importantly, provides users with a safer and more convenient identity authentication method. With the popularization of passkeys, users no longer need to worry about password leaks, intercepted verification codes, or delivery delays. The overall security of the internet will be significantly improved, and user account security will be guaranteed as never before. Whether choosing the official Telegram app or a third-party client like Turrit, users can enjoy the benefits brought by this security innovation.