Our advice not to use your main account is not a joke. It is reality.
Main account
Your own app hash: 99% logged out
Bans just for low trust are frequent
Using it is a really stupid idea
Extra account on public pairs
Over a million accounts registered through these pairs
The pairs have been alive for 5+ years
Nobody can see anything of yours through them
01
Why not your main account
This is accurate information. We know exactly where the pitfalls of these problems are.
Your own app hash: 99% logged out
Logging in to my.telegram.org from an account you have no access to, to get an app hash, and then any request through that app hash means a 99% chance the account is logged out. You can check it.
Bans just for low trust are frequent
Accounts are banned simply because Telegram does not trust them, and such bans are frequent. You can check this too. Using your own account is a really stupid idea.
Copied session keys can be revoked
Running an imported TData/session key in Telegram Desktop and TgWitness at the same time can trigger AUTH_KEY_DUPLICATED. Telegram invalidates that authorization, so both copies need a new login. A dedicated account does not prevent this.
Fully quit the original client and keep it closed while using its imported session. For parallel use, sign in to TgWitness by phone or QR to create a separate authorization; other separately authorized clients can remain signed in.
Why TgWitness works through public app hash/app ID pairs
That is why we built TgWitness on public app hash/app ID pairs. By our logic, bans are less likely with them: more than a million Telegram accounts have been registered through these pairs, and many different programs work through them. By our logic, this is better than working directly with a personal app hash: these pairs have been alive for 5+ years for sure.
Your own new pair
Created at my.telegram.org from the account.
About 99% of accounts logged out
One new application, one account
Public pairs of the pool
The same pairs many programs use.
Over a million accounts registered
Many different programs
Working for 5+ years
Why nobody can see anything of yours through these pairs
The pair is a name, not a key
Telegram asks for the API ID and API hash when a program connects and when it requests a login code. They identify the application and give no access to any account; Telethon's documentation notes that one pair works with any phone number.
Your session key never leaves your server
Signing in creates an authorization key by a Diffie–Hellman exchange between your TgWitness and Telegram; the key itself is never sent. Telegram's documentation: after authorization the key becomes associated with the user, and every call with this key runs as that user. Other programs with the same pair have their own keys and cannot use yours.
Traffic is encrypted with your key
Every request and answer is encrypted with the session's authorization key, not with the API hash. Knowing the API hash decrypts nothing.
The owner of a pair sees nothing
Telegram has no method that lists accounts, sessions or messages by API ID. The owner of a pair sees only its app settings at my.telegram.org.
Only your account sees which app it is
Settings → Devices of your own account lists each session's app name and API ID, device, IP address and dates. Nobody else gets this list.
Forum list of official app pairs, published for registering accounts
03
Ways to create an extra account
A Telegram account needs a phone number that receives the login code. Choose by how long the account has to live.
Best choice
Prepaid SIM or eSIM
Lasts
As long as you keep it topped up
Watch out
The most reliable: Telegram accepts real mobile numbers best. A number the carrier takes back goes to someone else.
Virtual number app
Lasts
While the app keeps the number
Watch out
Telegram may refuse a virtual number, not deliver the code or limit the new account at once; some apps take back numbers that are not used.
Number rental
Lasts
The rental period
Watch out
When it ends, the number goes to the next customer.
One-time activation
Lasts
One code
Watch out
The number returns to the pool at once, often with a history of previous owners. Set the cloud password before anything else.
Whoever holds the number later can request a login code. A cloud password (two-step verification) stops them from signing in; without it the account belongs to the next owner of the number.
NEVER USE YOUR MAIN ACCOUNT! A dedicated account obtained this way is still safer than putting your primary Telegram account into TgWitness.
Warnings before purchase
This violates Telegram's Terms of Service.
Many accounts are mass-registered (auto-reg) or have an unknown history.
Some sellers may still have recovery access.
Accounts from such markets are frequently banned or restricted later.
Avoid marketplaces that openly sell stealers, phishing tools, or clearly stolen accounts.
Buying an account — even one advertised as auto-reg — from platforms that openly sell phishing tools, stealers, stolen sessions or accounts violates not only Telegram's Terms of Service but also the laws of most countries. This can later invalidate your evidence. Choose carefully.
If you use this option
Treat the account as disposable.
Terminate all other sessions, set a cloud password and change recovery methods immediately.
Use 2–3 accounts from different providers or accounts you registered yourself.
Premium, deletion and the seven-day delay
If the account has Premium, someone with access to the phone number cannot delete the account immediately. You receive a notification and have seven days before deletion.
This matters because your investigation depends on the account: you have time to prepare a replacement.
Fresh accounts and API credentials
If you obtain and use your own api_id/api_hash from a fresh account you registered yourself using a number from an SMS service, the account will be logged out on the first API request or session authorization. Keep this in mind when planning an investigation.
04
Creating the account
From a number to the first recorded chat.
Get a number
A prepaid SIM or eSIM when the account has to live long; a rental or a one-time activation for a short job. Services are listed below.
Register apart from your main account
Register in the official Telegram app on a separate device, emulator or phone profile, not next to your main account.
Lock it with a cloud password
Right away set a cloud password and a recovery email used nowhere else.
Close the privacy settings
Phone number Nobody, find me by my number My contacts, last seen, profile photos and bio Nobody or My contacts; turn contact sync off.
Keep it from self-destructing
Set account self-destruct to the longest period, so a stopped TgWitness does not cost you the account.
Give it a neutral profile
No name, photo, username or bio from your other accounts, no personal contacts.
Let it warm up
Join a few chats a day at first. New accounts that rush are limited first.
Share nothing with bots
Never press “Share phone number” or “Share location” for a bot. Open links and Mini Apps through a VPN or proxy on that device.
Connect it to TgWitness
In its own workspace, connect with Account → QR code, then press Sources → Investigation mode. The app is where you act, TgWitness is the record.
TgWitness