What is Telegram tdata, and what is inside the folder?
Telegram tdata is the folder where Telegram Desktop keeps its local login: the authorization key that tells Telegram's servers "this device is already signed in", plus settings and cache. Copy the folder to another computer, open Telegram Desktop there, and the account opens with no code and no password. It is a key, not an account.
On Windows the folder sits under the app data directory of Telegram Desktop, and on macOS and Linux in the matching profile folder. Most of what is inside is cache. The part that matters is small: the files that hold the authorization key for each signed-in account, protected only by a local passcode if the owner set one. Telegram's servers never see the folder itself. They see a device that presents a valid key, and they treat it the way they treat your phone.
That is why a telegram tdata file sells. It is also why it gets stolen. In June 2026 Kaspersky described a script disguised as a Windows update that closed Telegram Desktop, zipped the tdata folder and sent it to the attacker through a bot. Their summary of the risk is the whole story of this page: the stolen key opens the account without a password or code, and keeps working until the real owner ends the session. Every shop listing that offers "tdata" is offering that same kind of key, and the shop rarely says where it came from.
The folder is not the only format. Automation libraries use a single .session file instead, and shops often ship that file with a companion JSON. The next section lays the formats side by side, because the format decides what you can and cannot do with the account later. If the reason you are looking is a sudden failure on an account you already run, how a checker reads working, limited, frozen and logged-out results is the faster place to start.
How do tdata, .session and session json differ?
All three carry the same thing, a live authorization key, in a different wrapper. Tdata is the Telegram Desktop folder. A .session file is a small database used by automation libraries. A session json is a text file that rides along with the .session and describes the device and app the key was created on. None of them is the phone number.
The difference shows up the day you try to secure the account. Whoever sold the key can keep a copy, and nothing in any of these formats lets you prove they deleted it. Only a phone number you control, plus your own password, turns a key into an account you own.
| Format | What it is | What opens it | Can the seller keep a working copy? |
|---|---|---|---|
| tdata folder | Telegram Desktop's local login folder, one or more keys | Telegram Desktop, or a converter | Yes, a copied folder works as well as the original |
| .session file | A small database holding the key and the data center number | Automation libraries and the tools built on them | Yes, the file can be duplicated freely |
| session json | A text file next to the .session: app id, device model, system and app version, language, sometimes the 2FA password and phone | The same tools, which read it to imitate the original device | Yes, and if it lists the 2FA password the seller knows that too |
| Phone number plus login code | A fresh sign-in on a number you hold | Any official Telegram app | Only if the seller still controls the number |
Read the session json closely before anything else. A field called twoFA or password means the seller set that password, and it is no longer a secret. A device model and app version that do not match the tool you plan to use mean the account will suddenly appear from a different device, which is one of the signals that leads to a security check. And a converter that turns tdata into .session, or back, does not make a new key. It copies the old one into a new wrapper, along with whatever access the old holder still has.
What do aged telegram accounts, telegram pva and verified telegram account really mean?
They are shop labels, not Telegram categories. Every Telegram account is phone verified at sign-up, so telegram pva describes all of them. "Aged" means the registration date is old, not that the account has a clean history. And a verified telegram account cannot be bought: Telegram says it does not verify user accounts at the moment, only channels, groups and bots.
Shop listings stack these words together, usually with a country code and a price per piece. Each one is answering a fear the buyer has, that a new account will be limited quickly. The table compares what the label promises with what Telegram's own rules and documentation say.
| Shop label | What the seller implies | What Telegram's side says |
|---|---|---|
| Aged telegram accounts | Old accounts are trusted and safe to send from | Limits follow reports and behavior; an old account that starts messaging strangers gets limited like a new one |
| Telegram pva | Phone verified, so it is "real" | Every account needs a phone number; the question is whether you control that number now |
| Verified telegram account | A checkmark or special trust | Telegram verifies channels, groups and bots of notable public figures and organizations, not user accounts |
| Telegram accounts for mass dm | Accounts that can send to strangers in bulk | Unwanted messages that get reported limit the sender to mutual contacts; no account type is exempt |
| Telegram automation accounts | Accounts built to run in scripts | Any account can use the API, under the API terms, which forbid flooding and spam |
| Warmed up | Pre-used so the account looks lived in | Telegram publishes no warmup rule; activity history does not change how recipients react to a cold message |
The "verified" row matters most for anyone selling to clients. Since January 2025 Telegram has also allowed approved third-party organizations to show their own verification icon on accounts and chats, but that icon is granted by the organization to people it actually vouches for, and Telegram's own page states plainly that it does not verify user accounts. A listing that sells a verified telegram account is selling either a misunderstanding or someone else's identity. Neither survives contact with a careful customer. For what limits actually look like from the inside, the two walls a limited account hits when it writes to people outside its contacts is the plain explanation.
Where do shop tdata and session files come from?
From three places, and a listing seldom tells you which. Farms register them in bulk on rented or virtual numbers. Recycled stock comes from numbers that were reassigned, with the old account taken over. The rest is stolen from real people's computers, the tdata folder lifted by malware. All three look the same in a zip file.
Each source carries its own failure. Accounts registered in bulk on rented numbers lose the number when the rental ends, so the day Telegram asks for a code on a new sign-in, nobody can receive it. Recycled accounts belonged to someone who may still have the app open on a forgotten tablet. Stolen accounts belong to a real person who can, at any moment, press Terminate all other sessions and take them back, and who may report the messages sent in their name.
- Bulk-registered on rented numbers: the key works, the number is gone, and the account cannot be recovered after any logout.
- Recycled numbers: the earlier owner's contacts, chats and sessions may still be attached.
- Stolen tdata: a real owner exists, and their contacts are about to receive messages they did not write.
There is also a legal side, and it does not depend on country. Using a login taken from someone else's computer is unauthorized access in most legal systems, and Telegram's Terms of Service ban spam and promoting illegal activity. That is why serious agencies do not run client work on bought keys at all. A pattern worth knowing from outside Telegram: the same account farms rent their stock for coordinated flagging campaigns, and how Facebook weighs a wave of identical reports from fresh profiles shows why platforms discount that volume rather than act on it.
What can you change on a bought account in the first 24 hours?
Less than buyers expect. A key that signed in recently cannot end the other sessions on the account: Telegram's API returns error 406, FRESH_RESET_AUTHORISATION_FORBIDDEN, if less than 24 hours have passed since the current session was created. So for the first day the seller's copy, and any older device, outranks yours.
This rule exists to stop exactly the takeover that a stolen key makes possible, and it cuts both ways. It protects real owners from a thief who just stole their tdata. It also means a buyer cannot lock the seller out on day one. The table lists what each common first step does, and what it leaves untouched.
| Step a buyer tries | Result in the first 24 hours | What it does not fix |
|---|---|---|
| Terminate all other sessions | Refused with FRESH_RESET_AUTHORISATION_FORBIDDEN (406) | Every older session, including the seller's, stays signed in |
| Set or change the 2FA password | Needs the current password if one exists; the session json may list it | Sessions already signed in keep working without the password |
| Change the phone number | Needs a code sent to the new number and often a check on the old one | A rented old number may block the change entirely |
| Read Settings, Devices | Shows every active session with device and approximate location | Nothing; it only shows how many other holders there are |
| Message @SpamBot | Reports any current limit and its end date | It cannot say whether the account was used for spam last week |
Even after 24 hours, ending the other sessions only works if the seller has not ended yours first, and they had a full day's head start. This is the moment most bought accounts quietly change hands again. If you are trying to understand what an account's status is right now, without handing its key to anyone, the steps in the send limits a Telegram message sender has to run under and the plain-language ways to message someone on Telegram from an account you own are safer than any bulk checking tool.
Does telegram account warmup or more accounts stop limits?
No. Telegram account warmup changes how an account looks before it sends; it does not change what recipients do when a stranger writes to them. Limits come mostly from reports and blocks. Ten warmed accounts sending the same cold pitch collect ten sets of reports, and Telegram connects accounts that share devices, networks and message text.
The word warmup comes from email, where a new sending domain earns a reputation with mailbox providers over weeks. Telegram has no such public score and publishes no warmup schedule. What it does publish is the spam FAQ: accounts that send unwanted messages and get reported can lose the ability to write to anyone who is not a mutual contact, for a few days on a first offence and longer after that. An account's age or chat history does not appear anywhere in that rule.
So what are telegram accounts for mass dm actually buying? Mostly a short delay before the first limit, spread across more keys, each with the ownership problems described above. The cost is not only the price per account. It is the reports filed against your brand name and the link in your pitch, which follow every new account you switch to. A useful test: if a campaign needs a steady supply of fresh accounts to keep running, the recipients are telling you something the accounts cannot fix. Why bulk sends from one personal account end in a limit covers the mechanics, and the risk attached to each bulk messaging route compares the routes that do not burn accounts.
What about telegram automation accounts for support or bots?
Legitimate automation does not need bought keys. Telegram's apps hold up to three accounts side by side, four with Premium, and a business can register its own numbers, one per role, and give each a 2FA password only the team knows. For anything that talks to many people at once, a bot is the tool Telegram built for it: people start it themselves, it can message everyone who did, and its limits are documented. See what a bot can send to the people who pressed Start. When a team runs several accounts of its own, the four ways to merge DMs from several accounts into one inbox replaces the session dashboards that shops push, and one privacy and 2-Step Verification baseline applied to every team account keeps each key where it belongs.
What should you run outreach on instead of bought telegram tdata?
Accounts you registered on numbers you control, a channel, a group with clear rules, and a bot people opt into. That stack sends to people who asked, so reports stay low and accounts last. It also means every login key exists in exactly one place: your own devices.
A case from this autumn shows the trade. A crypto education brand came to us with 40 "aged, warmed" accounts bought as tdata and a plan to message members of competitor groups. By the end of the first week, 26 were limited, 9 had been signed out by someone else, and two had changed their profile photos overnight. We moved the team to four accounts on their own numbers, one per staff member, and put the outreach on a channel and broadcast list for people who already joined. Six weeks later all four accounts were still working, and replies per month were higher than in the bought-account week. The figures are from one client and are illustrative, not a promise.
If you need volume, build the list first. How bulk messaging services handle consent explains the opt-in part, and what adding members to a group in bulk actually permits and which contacts a privacy setting lets you add to a group set the limits on growing a group fast. For first conversations, start from comment triggers and the DM automation platforms allow, write a first message that reads like a person, and keep a cadence from how often a DM list tolerates hearing from you.
The larger program is where most of the gains are. How we plan cold outreach around reply rates, which outreach steps are safe to automate and the seven outreach types and the rule each one answers to cover the planning side. If the push is tied to a token or product date, plan it with a launch calendar built on a channel, a group and an opt-in bot, so launch week does not depend on keys someone else can switch off.