Introduction
Sessions is an open-source guard for your Telegram account. You whitelist your real devices, arm it, and from then on any login that isn't you gets kicked out automatically, around the clock, while hostile password resets get declined. We built it because we kept watching the same thing happen to people we knew, and the only advice anyone ever gave was "be more careful." Vigilance isn't a security model, so we built one instead.
The Problem
If you live on Telegram, especially in crypto, you've seen it: a friend's account gets taken over, and minutes later "they" are DMing everyone scam links. The fake Microsoft Teams installer, the malicious Calendly link, the "please forward me your login code," the fake trading bot. The vectors keep changing, but the outcome is the same: one wrong click and your account is gone, even with 2FA enabled.
And the damage doesn't stop with you. A hijacked account becomes a weapon: it drains your wallet, locks you out by resetting your 2FA password, and scam-DMs your entire audience from your trusted name. For someone who relies on Telegram for their day to day, that's not an inconvenience, it's your livelihood destroyed in one bad afternoon.
Telegram does give you tools, an active-sessions list, a "terminate all other sessions" button, two-step verification. But they're all manual. They only help if you happen to be awake, looking, and faster than the attacker. Most people aren't, which is exactly why this keeps working.
The Solution
Sessions is a session firewall for Telegram.
Sessions does not prevent the attack itself. Nothing reliably stops every phishing link, fake bot, or malicious QR code from fooling a human on a bad day. What Sessions does is make the break-in worthless. However an attacker gets in, a phished login code, a QR-login scam, a fake trading bot you connected, a session stolen by malware, a SIM swap, it all ends the same way: a new session on your account. The moment a login that isn't you appears, Sessions detects and evicts it, in seconds, before they can drain you, message your contacts, or lock you out. It also blocks the hostile 2FA-password reset attackers use to take over.
Now the part we refuse to spin: to guard your account, Sessions does hold your Telegram session. We are not going to pretend otherwise. But it is sealed with AWS KMS so it can only be unlocked inside an attested enclave running our exact published, open-source code. Our own servers can't read it, the code can only do account management, and you can revoke it any time. And you don't have to take our word for a word of that: the code is open source, and a live attestation lets you (or an AI) verify the exact thing holding your account. Bounded, attested, and revocable.
Key Features
- Auto-eviction of unauthorized logins. Any device that isn't on your whitelist gets kicked automatically, around the clock.
- Blocks hostile 2FA-password resets. Stops the attacker move that locks you out of your own account.
- Open-source and verifiable. The full list of what it can ever do is one public file, and a live hardware attestation proves the exact code that's running. Don't trust us, verify it.
- Sealed, and we can't read it. Sessions holds your session to protect it, but it's sealed so only the attested enclave running the published code can use it. The host and the operator can't decrypt it, and you can disconnect any time.
- You hold the authority. Arming, changing your keep-list, and removing the guard all require your signature, so even we can't change your guard's policy without you.
- Bounded by design. The code can only do account management. There is no method in it to read your messages, see your chats, or change your password.
Conclusion
Telegram account takeover isn't going away, the attacks only get more convincing. You can't make yourself un-phishable, but you can make being phished survivable. Sessions kills the attacker's session before it costs you anything, and it's open enough that you never have to just trust us.
It's free to arm and takes a few minutes. Lock down your Telegram at sessions.fyi, or read exactly how it works and verify it yourself.