Telegram's own Play Store listing calls itself a "highly secure" messenger. That's even true — just not for the chat you have open the first time you launch the app and write to someone. We wanted to know how many taps lie between "app installed" and "actually end-to-end encrypted". We counted.

What "cloud chat" really means

Open a new conversation on Telegram and you land in what's called a cloud chat. The name is more honest than it sounds: the content really does sit in Telegram's cloud, in a form Telegram can read. What's encrypted is the connection between your device and the server (transport encryption) — but on the server itself sits the plaintext, or at least something Telegram can turn back into plaintext on request. That's the same security level as pretty much any cloud storage: good against eavesdroppers along the way, worthless against the provider itself or anyone who comes knocking at the provider's door.

That's no secret — Telegram has never hidden it, it's right there in their own FAQ. The problem isn't the honesty. The problem is the order of things: secure is the exception, not the rule.

The road to real encryption — counted

To actually write end-to-end encrypted, you need a "Secret Chat". We took a freshly installed app and counted what stands between you and one:

  1. Tap the pencil icon to start a new conversation.
  2. Open the contact list and pick a person.
  3. Tap their name at the top of the chat to reach their profile.
  4. Open the three-dot menu.
  5. Select "Start Secret Chat" — a separate menu item, a separate conversation, a separate chat list.
  6. Wait for the other side to even notice the new, second chat, since it isn't the same one you were just writing in.
  7. Start writing over there — the history from the cloud chat doesn't come along.

Seven steps, one new conversation, one lost history. And that's only if you know this option exists in the first place — it's not in the main menu, it's hidden behind the other person's profile.

Why this is more than a nitpick

You could say: seven taps isn't a big deal. It isn't — for the person reading this article who now knows what to look for. For everyone else it's a hurdle that in practice almost never gets cleared. Security research has agreed for years: whatever isn't the default rarely gets actively chosen by the large majority. That's not a knock on users — it's how people deal with software, and any company that takes UX seriously knows it well.

Secret Chats on Telegram also lack a couple of things you'd expect day to day: they don't sync across multiple devices (a Secret Chat lives on exactly the device it was started on), and groups are excluded entirely — Secret Chats exist only as one-on-one conversations. Anyone writing in a group is always writing in cloud mode. There's no choice.

Why Telegram built it this way — staying fair

We don't want to suggest this happened out of malice. Cloud chats have real advantages: history is on every device at once, server-side search works years back, groups with tens of thousands of members are only technically feasible this way. End-to-end encryption for everything would have cost compromises Telegram apparently wasn't willing to make — more device management, slower server-side search, more complicated groups. That's a legitimate product decision. It just shouldn't be called a "secure messenger" when the secure option — the one almost nobody uses — is hidden behind seven taps.

And with us?

At HIY, that choice doesn't exist — and that's by design, not by inability. Every chat is end-to-end encrypted, because there's no second mode you could pick instead. The signing key sits in the device's security chip (more on that in our StrongBox article) and never leaves it. That costs us the same compromises Telegram wanted to avoid: there's no server-side full-text search over chat history at all, because we can't read the content in the first place. We think that's the right trade. But honestly: we also didn't have to choose between "offer a complicated choice" and "just decide" — that's easier for a new app than for one that's had hundreds of millions of users used to the cloud model for years.

Seven taps to "secure". We counted so you don't have to — and so it's clear what's actually meant when an app calls itself "encrypted": the default, or the menu item almost nobody finds.