What is an MTProto proxy and how does it work in Telegram
How Telegram's protocol is built, what an MTProto proxy does with your traffic, what it can and cannot see, and how to read a proxy link.
Contents
MTProto is Telegram's own protocol for talking to its servers. An MTProto proxy, often called MTProxy, is a server that accepts this connection and passes it on. Below: how the protocol is built, what exactly the proxy does, what it can and cannot see, and what is inside the link someone sends you.
What MTProto is
Telegram's documentation defines MTProto as a protocol for accessing the server API from apps on mobile devices. Current apps use version 2.0; the first version is deprecated. The protocol has three layers, and a proxy only touches the last one:
- API queries. The top layer turns calls and responses into binary messages.
- Encryption. Every message is encrypted with AES-256 using an authorization key. The key is created with a Diffie–Hellman exchange and is never sent over the network.
- Transport. The bottom layer carries the encrypted data over an ordinary network protocol such as TCP, WebSocket or HTTP.
What an MTProto proxy does
A proxy is a relay. Instead of connecting to Telegram's data centers directly, the app connects to the proxy, and the proxy opens a connection to the right data center and passes data both ways. To the app it looks like talking to Telegram; to the network it looks like a connection to the proxy.
MTProxy is the name of the official implementation that Telegram publishes on GitHub. Other popular ones are mtg (written in Go) and telemt (written in Rust). Telegram's apps support two kinds of proxy: SOCKS5 and MTProto.
How the traffic flows
- The app takes the server address, port and secret from the link.
- It opens an obfuscated connection: the stream keys are derived from a random initial packet and the secret.
- The initial packet says which Telegram data center to connect to.
- The proxy connects to Telegram and forwards the encrypted data both ways.
The secret plays two roles. It works as a password — the proxy only accepts clients who know it — and in FakeTLS mode it also carries the domain the connection pretends to visit.
What the proxy can and cannot see
Your messages are encrypted with the authorization key, which the proxy does not have, so it forwards data it cannot read. Telegram's documentation says it directly: the proxy operator cannot see your Telegram username or account ID, your chat list or your activity.
What the operator can record is your IP address, the times you connect and the fact that you use Telegram. Telegram Desktop even warns you that checking the status of an unknown proxy exposes your IP address to its admin. So choose proxies by who runs them, not only by speed.
Proxy or VPN
| MTProto proxy | VPN | |
|---|---|---|
| What it carries | Telegram only | all traffic from the device |
| How you add it | a link or three fields in Telegram's settings | a separate app and a subscription |
| Other apps | go as usual | go through the VPN |
| Telegram calls | do not work through it | work |
| What the network sees | a connection to the proxy, obfuscated or looking like TLS | a connection to the VPN server |
A simple rule: if you only need Telegram, a proxy is simpler. If you need calls, other apps, or you are on a network that only lets through an approved list of addresses, you need a VPN.
What is in a proxy link
tg://proxy?server=proxy.example.com&port=443&secret=ee…
https://t.me/proxy?server=proxy.example.com&port=443&secret=ee…
All three parameters are required. server is the IP address or host name, port is the port, usually 443 like ordinary HTTPS sites, and secret is the key: 16 random bytes in hexadecimal, sometimes with a prefix and a domain.
Three modes
- plain — the stream is encrypted (obfuscated), but the start of the connection and the rhythm of packets are recognisable;
- dd — random padding is added so that packet sizes do not give the proxy away;
- ee — FakeTLS: the connection starts like an ordinary HTTPS visit to a real website, whose name is written into the secret.
The sponsored channel
The owner of an MTProto proxy may show one public channel in the chat list of everyone connected through it, to cover server costs. Telegram Desktop labels it as the proxy sponsor and explains that disabling the proxy removes it. The channel gives the owner no access to your chats or activity.
Where the proxy settings are
According to Telegram: on Android — Settings → Data and Storage → Proxy Settings; on iOS — Settings → Data and Storage → Proxy; in Telegram Desktop — Settings → Advanced → Connection Type; in the macOS app — Settings → Data and Storage → Use Proxy. You can keep several proxies, and Auto-Switch Proxies moves to the next one if the current one disconnects.
Limitations
- Telegram calls do not work through an MTProto proxy — the telemt FAQ calls this a limitation of Telegram's architecture.
- A proxy does not protect other apps on the device.
- A proxy has a limited lifetime: its address, port or traffic pattern can be blocked.
- A proxy cannot help on networks that only allow an approved list of addresses — the telemt FAQ lists such cases, from mobile allowlists to the Great Firewall in China and Iran during unrest.
FAQ
What is MTProxy in simple terms?
A relay server for Telegram. The app connects to the proxy instead of Telegram's servers, and the proxy passes the encrypted traffic on. MTProxy is the name of Telegram's official implementation; any proxy that speaks MTProto is usually called the same way.
Can the proxy owner read my messages?
No. Messages are encrypted with a key that only your app and Telegram's server have. According to Telegram, the proxy operator cannot see your chat list, your activity, your username or your account ID. They can see your IP address, when you connect and the fact that you use Telegram.
How is an MTProto proxy different from a VPN?
An MTProto proxy works only inside Telegram and is added with a link; other apps are not affected. A VPN carries all traffic from the device and needs its own app. Telegram calls do not work through an MTProto proxy, but do work through a VPN.
What does a proxy link consist of?
Three required parameters: server (address or host name), port and secret. The format is tg://proxy?server=…&port=…&secret=…, or the same link starting with t.me/proxy, which also opens from a browser.