Telegram tdata and .session files: what they are and how to use them

What tdata is

tdata is the folder where Telegram Desktop keeps login data and cache. The key parts are the key_data* files and the encrypted account data: the user ID, the main data center and the authorization keys for each data center.

If Telegram Desktop has a local passcode set, the folder's local key is encrypted with it. If not, the folder opens without any password at all. The passcode only protects this copy on disk: forget it and you'll have to log out and log in again.

Where tdata is stored

What a .session file is

A .session file is an SQLite database created by Telegram API libraries. It holds the data center number, server address and authorization key — and in Telethon's case, also a cache of contacts and chats, phone numbers included.

Library formats aren't compatible: a Telethon file won't open in Pyrogram and vice versa. There's also a text form — a session string with the same data in one line. Telethon's documentation warns plainly: anyone with this string can log into your account.

Why a session file is a key to the account

The authorization key is a 2048-bit key shared by the device and Telegram's server; it's never sent over the network. One account can have many keys — one per login.

Hence the main point: both a tdata folder and a .session file contain a ready key. With it, anyone can get into the account without the SMS code and without the cloud password — the password is only asked at a new login. There's one way to stop someone holding a copy: end that session under "Settings → Devices". More in the guide on getting logged out.

How to convert tdata to .session

This is usually done with the opentele library: it reads tdata and produces a Telethon session — and back. It has two modes:

• use the current session — the same key is copied, no new session appears;
• create a new session — a separate login happens, and one more entry appears in the device list.

Note that opentele's author no longer maintains it; the last release came out in January 2022. Convert on your own computer rather than handing files to third parties.

Why online converters are risky

A site you upload tdata or a .session file to gets the key to the account — with every capability described above. You can't verify it didn't keep a copy.

This isn't hypothetical: in 2025 researchers described malicious Python packages that quietly zipped the tdata folder and sent it to the attackers over Telegram. Account files are worth as much as a password.

One session, one place

If the same session is opened in two tools or on two servers at once, Telegram responds with AUTH_KEY_DUPLICATED and revokes it — you'll need a fresh login with your number. Need access from a second place? Log in there separately, as its own session.

How to store account files

• keep tdata and .session files in an encrypted archive or on an encrypted disk;
• turn on the Telegram Desktop passcode if you copy the tdata folder anywhere;
• don't keep session strings in notes, chats or public repositories;
• review your device list regularly and end sessions you don't recognize;
• never use one session in two places at once.

One more detail: every tool logs in with its own application ID (api_id), and it's visible in the session list. Telegram warns that accounts using the API to spam or inflate counters are banned forever — see the guide on spam blocks for what that looks like.