Forgot Your Telegram Two-Step Password? Recovery With or Without Email

What should you check before trying to recover the password?

As of 4 November 2026, Telegram documents email recovery, a password reset from an existing signed-in session, and account deletion as distinct routes ^[1]. Start by checking what access remains, before accepting any reset warning.

• Can you still open this account on another phone, tablet or computer? Keep that session available: Telegram's non-destructive password-reset route requires an existing login ^[1].
• Can you open the recovery mailbox previously attached to this account? That is the address used for a password-recovery code ^[3].
• Are you facing a password prompt or a warning that the account will be deleted? Telegram's Android interface has separate password-reset and account-reset messages ^[2].

Write down the exact prompt, remaining access and any countdown, without copying secret codes into a message to someone else. This is general security information, not an individual assessment of a compromised device.

For example, start with a short private note: which device still opens the account, which mailbox you can access, and which screen is blocking progress. Do not include passwords in that note. Use it to choose the matching route below.

Is this the two-step password, a login code or the app lock?

Telegram's Two-Step Verification password is an additional account password; its local Passcode Lock is a separate PIN used to open the app and view chats ^[7]. Before looking for a reset, identify which protection is stopping you.

A login code is another part of authentication: Telegram's current documentation lists delivery through an existing Telegram session, SMS and, in some cases, a configured login email ^[9]. Therefore, receiving a code in an inbox does not by itself tell you which recovery stage you have reached.

Telegram's privacy policy explicitly distinguishes the login email from the password-recovery email and says they are stored separately ^[14]. Do not assume that changing one changes the other.

As a reading exercise, compare the words on the screen: a request for a login code, a request for the extra password, and an account-deletion warning should lead to three different decisions. Avoid moving forward merely because a button contains the word reset. First identify what the button proposes to reset.

How do you recover the password with a recovery email?

Email recovery requires an email already configured for password recovery; it is not an invitation to nominate a new mailbox after losing the password ^[3]. If you are logging in afresh, Telegram also requires successful completion of the login-code stage before this recovery route ^[1].

1. At the extra-password prompt, choose the forgotten-password option ^[2].
2. Request the recovery email through Telegram's recovery flow; the documented request works only when recovery email is configured ^[3].
3. Open that mailbox and enter the received recovery code in the recovery screen ^[4].
4. Complete the password-reset flow and set a new password when prompted; Telegram's recovery method supports new password settings ^[4].

Recovery replaces the forgotten credential rather than revealing the old password. Telegram describes the operation as resetting the two-factor password using the emailed recovery code ^[4]. Do not expect an email containing the password you originally chose.

If recovery does not complete, record the error wording and pause before switching to an account-deletion option. Keep the mailbox-recovery problem separate from the Telegram-password problem: first establish whether you can read the mailbox, then return to the appropriate Telegram screen.

Can you reset it without email if Telegram is still open?

Yes. Telegram's official Tips channel describes a seven-day password reset for people who remain logged in but cannot access their recovery email ^[7]. That same notice says the reset can be cancelled from any of their devices ^[7].

1. Use the account on the device where it is already signed in.
2. Open Settings, then Privacy and Security, then Two-Step Verification ^[7].
3. Choose the forgotten-password option and follow the offered password-reset route; Android's interface distinguishes this from resetting the account ^[2].
4. Read the confirmation carefully and record the displayed waiting period.
5. When the wait ends, return to complete the reset. Telegram documents a further reset request at that point, rather than promising that the password disappears automatically ^[1].

If a recent reset was cancelled, Telegram's Android messages can require another wait before a new request ^[2]. Follow the displayed status rather than repeatedly starting over.

As a practical precaution, leave the working session alone while following this route. Avoid experimental sign-outs simply to see whether the password has changed. Treat the countdown as part of an unfinished process until the app confirms completion.

What if you have neither recovery email access nor a signed-in device?

Do not equate starting again with recovering your existing data. Telegram documents account deletion as a separate operation, with either immediate deletion or a delay depending on the account's conditions ^[5]. The documented locked-out route still requires successfully providing the login code; it is not a way around that stage ^[1].

For deletion without the remembered two-step password, the documentation specifies a seven-day delay when the password was changed more than seven days earlier and the account was active within the preceding seven days; otherwise deletion can be immediate ^[5]. This is why a blanket promise of seven days of grace is unsafe.

Before choosing that route, revisit the email-recovery option and check for a remaining signed-in device. If the screen warns about deleting the account, stop unless you have decided to accept that outcome. Telegram's policy says account deletion removes cloud messages, media, contacts and other stored account data and cannot be undone ^[14].

A new start should therefore be treated as a separate decision. Make that decision explicitly, rather than treating a destructive confirmation as another routine step towards recovering a forgotten password.

What if the recovery address is correct but you cannot open Gmail?

If the mailbox is Gmail, use Google's own account-recovery process first: it asks questions to establish account ownership and lets you reset the Google password when verification succeeds ^[10]. Recovering that mailbox is a separate task from resetting Telegram.

1. Open Google's account-recovery instructions yourself, and follow their recovery link ^[10].
2. Where practical, use a device, browser and location familiar to that Google account; these are Google's published recovery recommendations ^[11].
3. Answer as many ownership questions as possible. If asked for a previous password, Google recommends the most recent one you remember ^[11].
4. After regaining access to the mailbox, return to Telegram's recovery flow and request its recovery code ^[3].

For a work or school Google account, Google says the usual consumer steps may not apply and directs users to their administrator ^[10]. For another email provider, use that provider's own recovery instructions.

Google warns that it does not work with services claiming to provide account or password support ^[10]. Its security guidance also says it does not request passwords or verification codes through email, calls or messages ^[11]. Do not forward a Google recovery code to someone offering to repair Telegram.

What if the login code or recovery email does not arrive?

First identify which code is missing. Telegram chooses the login-code delivery method, and an existing Telegram session can receive it instead of SMS ^[9]. Check the destination indicated in the app before repeatedly requesting another message.

Telegram's login documentation also describes limits on repeated login attempts and conditions in which official mobile apps are needed for SMS delivery ^[9]. Follow the app's retry instructions. A delivery failure does not establish that your remembered password is wrong.

For the password-recovery stage, the documented request depends on having configured recovery email ^[3]. If you cannot identify or access that mailbox, return to the signed-in-device route instead of assuming that a new email address can be substituted.

Keep any help request focused: identify whether the failure concerns a login code, access to the mailbox, the recovery code, or the final reset. Include the error wording and approximate time. Omit the code itself, the password and private chat contents.

What should people in Iran watch for during recovery?

In a report published on 10 June 2026, independent security researchers at CERTFA described phishing targeting Iranian journalists and civil-society figures ^[12]. The attackers impersonated familiar people and used fake Telegram pages to collect a genuine login code and then the extra password ^[12].

The practical lesson is that a genuine incoming code does not make the page requesting it trustworthy: in CERTFA's documented attack, the criminals initiated the real login themselves ^[12]. Open your own Telegram app for recovery instead of following an unsolicited invitation, interview link or recovery offer.

If you have already shared credentials or see an unfamiliar session, also consult Pouyam's guide to recovering a hacked WhatsApp or Telegram account.

For people targeted through journalism, activism or human-rights work, Access Now's Digital Security Helpline offers free assistance to eligible civil-society users worldwide, with an initial eligibility check ^[13]. As of 4 November 2026, its published support-language list includes English but does not list Persian ^[13]. Check its current contact and eligibility information before seeking help. This is a support option, not a guarantee that Telegram can be recovered.

What should you check after regaining access?

1. Review devices. Telegram's Active Sessions feature lists signed-in devices and allows unwanted sessions to be closed ^[8]. Check the list deliberately rather than assuming a password change has finished the whole security review.
2. Restore the extra protection. Telegram's two-step password adds a check when entering the account on another device ^[8]. Complete the new-password setup rather than leaving it unfinished.
3. Protect the mailbox. When adding a recovery email, complete its confirmation-code step ^[2]. Telegram recommends a strong password and two-step protection for the recovery email account as well ^[6].
4. Preserve access carefully. Telegram warns that signing out removes Secret Chats from that device, even though cloud messages remain ^[6]. Avoid signing out merely as a password test.

Before putting the task aside, confirm which devices you intend to keep, where the recovery mailbox is, and whether the app reports the new password setup as complete. Make a private reminder to revisit these settings after changing your phone or mailbox.

If you need ordinary login assistance, Telegram's FAQ points to its support form; signed-in users can also use Settings and Ask a Question ^[6]. Describe the problem without including a password or a live verification code.