Telegram adds passkey support for secure friction-less logins

Telegram has introduced support for passkeys in its latest update, marking a significant shift away from SMS-based login systems in favor of modern, phishing-resistant authentication methods.

The move to support passkeys brings Telegram in line with a growing number of platforms embracing the FIDO2 standard, a cryptographic login method backed by the FIDO Alliance and major industry players including Apple, Google, and Microsoft. With passkeys, Telegram users can now authenticate into their accounts using biometric data like Face ID or fingerprints, or a device PIN, instead of waiting for SMS codes that may be delayed or intercepted.

Passkeys are securely stored on the user's device and can be synced across platforms through password managers like Apple iCloud Keychain or Google Password Manager. Telegram emphasizes that this method is not only faster but also more secure, as the underlying cryptographic material never leaves the user's device and is resistant to phishing and SIM swap attacks.

Telegram, founded in 2013 by Pavel Durov, is one of the largest messaging platforms in the world with over 900 million monthly active users as of late 2025. The addition of passkey support follows previous efforts by Telegram to reduce its reliance on traditional networks and identifiers, including the introduction of decentralized usernames, anonymous account sign-up using blockchain-based numbers, and improvements to end-to-end encryption.

While passkeys greatly improve account security, Telegram warns that users should still maintain an active phone number linked to their account. This is due to legacy dependencies in the platform's architecture that still tie account identity to a mobile number, at least for now.

From a practical standpoint, enabling a passkey can be done through the app by navigating to Settings > Privacy and Security > Passkeys. The feature is available on all supported devices and can be set up in just a few steps. Once configured, users can enjoy seamless logins without relying on SMS, a boon for those frequently traveling, living in areas with unreliable cellular service, or concerned about the vulnerabilities of text-based authentication.