CITT

    Scan results

    Telegram

    Android

    Pure instant messaging with end-to-end encryption, cloud sync across devices, and no ads. Features group chats up to 200k members, file sharing up to 2GB, secret chats with auto-destruct, and open source verification.

    CITT SCORE
    68
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Everyday messaging with standard Google integrations

    What It Means For You

    Messages are delivered through Google's Firebase infrastructure, and the device interacts with Google Play Services and SafetyNet. Payments processed through Stripe follow standard financial data handling. Usage data touches several Google-operated services, though no advertising or behavioral tracking SDKs are present.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    9 total
    1 Critical
    1 High
    4 Medium
    3 Low

    Network Security

    2 total
    1 Medium
    1 Low

    Code Security

    2 total
    1 Critical
    1 Medium

    Privacy

    1 total
    1 Medium

    Third-Party Risk

    2 total
    2 Medium

    Third-Party Services

    Firebase Cloud Messaging, Firebase Remote Config, Google Play Services, Google Play Billing, Stripe, Google Maps, ML Kit, SafetyNet, NanoHTTPD, ZXing

    Security Strengths

    • ✓Firebase Analytics explicitly disabled - zero user tracking
    • ✓Strong cryptography: AES-256, PBKDF2 100k iterations
    • ✓Secret chat end-to-end encryption with local media encryption
    • ✓WebView hardening: file access disabled, SSL errors rejected
    • ✓Modern dependencies with patched CVEs (Google Play Billing 7.1.1)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    social
    messaging
    privacy focused
    payments
    location
    camera
    contacts
    voip
    media sharing
    cloud storage

    Package

    org.telegram.messenger

    Version

    12.3.1 (Build 63852)

    Analysis Date

    Jan 31, 2026

    Classes Analyzed

    11,230

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 9 findings (1 critical, 1 high, 4 medium, 3 low)

    Network Security - 2 findings (1 medium, 1 low)

    Code Safety - 0 findings

    Privacy - 1 finding (1 medium)

    Privacy Concerns

    What Data is Collected

    Telegram collects device identifiers and usage information through Google Play Services and Firebase. Payment details are handled by Stripe when users make in-app purchases. User location may be accessed through Google Maps when location-sharing features are used.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Google (Firebase Cloud Messaging, Firebase Remote Config, Google Play Services, Google Play Billing, Google Maps, ML Kit, SafetyNet): Message delivery, app configuration, device security checks, and billing.
    • Stripe: Processing of any payments made within the app.
    • ZXing: QR code reading, processed locally on the device.
    • NanoHTTPD: Local network functionality within the app.

    No advertising networks or behavioral profiling services are embedded in this build.

    Understanding the Scores

    CategoryScore
    Security60/100
    Privacy75/100
    Data Security50/100
    Network Security85/100
    Code Safety70/100
    Data Collection100/100
    Data Sharing90/100
    User Control100/100

    Positive Security Features

    • Data collection exposure is minimal: the app scores 100/100 for Data Collection, reflecting that it requests only what is needed for core functionality.
    • Users retain strong control over their data, reflected in a perfect User Control score of 100/100.
    • No advertising or behavioral tracking services are included in this version of the app.

    Areas for Improvement

    • Local data stored on the device is not fully protected, meaning sensitive information could be exposed if someone gained physical access to the device.
    • Some network communications could be made more robust to better protect user data while it travels between the device and Telegram's servers.
    • Certain internal operations could be handled more securely to reduce risk if the app is running on a rooted or compromised device.

    About This Analysis

    This scorecard is generated through automated static analysis of the Android application binary. It reflects the security and privacy posture of this specific version and build.

    App Details

    FieldValue
    App NameTelegram
    Package IDorg.telegram.messenger
    Version12.3.1 (Build 63852)
    Scan DateJanuary 31, 2026
    PlatformAndroid

    Right of Reply

    Developer not yet contacted