We added the Account Settings Manager after the same support ticket kept coming back. A team had forty accounts. Half showed their phone number to everyone, and a few had two-step passwords that nobody could find. This page covers what the module changes, what Telegram refuses, and the one setting where a careless tool does lasting damage.
Can you change Telegram privacy settings for many accounts at once?
Not inside Telegram. The official apps hold three accounts per app, a few more with Premium, and even then you switch to each account and open Settings → Privacy and Security in turn. Nothing in the apps copies a privacy layout from one account to another.
The reason is where the settings live. The privacy chapter of the API docs describes every setting as a pair. A privacy key says what is controlled, such as last seen or the phone number. A list of rules says who it applies to. A client reads a key with account.getPrivacy and writes it with account.setPrivacy, and both calls belong to one logged-in account. The same page says a change is pushed to every session of that account, so the phone that owns the number shows the new setting almost at once.
So telegram privacy settings automation is a loop, not a master switch. A program holding signed-in sessions opens each one, sends the same requests, waits between them and reads the result back. A telegram bulk privacy settings run on fifty accounts is fifty separate conversations with Telegram, and each one can succeed or fail on its own. Any telegram privacy settings bulk change is judged by what it reports per account, not by a single green tick at the end.
A privacy settings bot is a different thing
One search tends to go the wrong way. Look for a telegram privacy settings bot or a telegram account settings bot and most results explain BotFather's /setprivacy command. It decides whether a bot in a group sees every message or only commands, and it has nothing to do with a person's account. A bot cannot change a user's privacy at all: the API reference marks these account methods as usable by users only.
What a telegram account settings manager writes on each account
Every option in the module starts on Don't change, so a run touches only what you pick. The privacy block covers thirteen keys. A preset at the top sets all of them to Nobody, Contacts only or Everybody in one step, and any key you set by hand overrides the preset, which means you can close everything and still leave forwarded messages linked to the account.
| Setting in the app | API privacy key | Values the module offers |
|---|---|---|
| Last seen and online | StatusTimestamp | Everybody, My contacts, Nobody |
| Profile photo | ProfilePhoto | Everybody, My contacts, Nobody |
| Bio | About | Everybody, My contacts, Nobody |
| Date of birth | Birthday | Everybody, My contacts, Nobody |
| Phone number | PhoneNumber | Everybody, My contacts, Nobody |
| Who can find me by my number | AddedByPhone | Everybody, My contacts |
| Forwarded messages | Forwards | Everybody, My contacts, Nobody |
| Groups and channels | ChatInvite | Everybody, My contacts, Nobody |
| Calls | PhoneCall | Everybody, My contacts, Nobody |
| Peer-to-peer calls | PhoneP2P | Everybody, My contacts, Nobody |
| Voice messages | VoiceMessages | Everybody, My contacts, Nobody |
| Gifts | StarGiftsAutoSave | Everybody, My contacts, Nobody |
| Who can message me for free | NoPaidMessages | Everybody, My contacts, Nobody |
Phone number, contacts and groups
A few rows behave differently from the way the app presents them. Telegram has no Nobody option for finding the account by its number, only Everybody or My contacts, so the module applies Nobody there as My contacts and says so in the report. That key and the phone number key together decide whether a stranger who holds the number can start a chat, which is how starting a chat with an unsaved number works, and whether they can look the account up from its phone number at all. The phone number key also limits what a member list gives away, and that is most of what a scraper can read about a member. My contacts means the people saved in that account's own contact list, the way adding someone as a contact puts them there, not everyone it has ever talked to.
The groups key decides who may add the account to groups and channels. On Nobody, anyone who tries gets an invite-link prompt instead of a direct add. It is the same wall your own accounts meet when you run bulk member adds into a group, and one reason member-add tools stall where they do. Closing the key does not take an account out of groups it already sits in. Getting out takes a mass leave across all groups, which is a separate job.
The rest of the form
Past the thirteen keys, the form covers the global privacy switches (archive and mute new chats from non-contacts, hide read receipts, Premium-only messages, archive behaviour), notifications for private chats, groups and channels, reaction alerts, sensitive content, auto-save, auto-download, sponsored messages, frequent-contact suggestions, synced contacts, a default auto-delete timer and a date of birth. The timer applies only to chats started after the change, and clearing old history is covered in our guide to deleting Telegram messages. Auto-download matters more on many accounts than on one. Left on, every account pulls each photo and video in its chats through the SOCKS5 or MTProto proxy assigned to it.
Names, bios, photos and usernames are not in this form on purpose. One value typed once would give every account the same identity, so they stay per account on the Accounts panel, where each username still has to pass Telegram's username rules.
How does telegram 2fa bulk work without locking anyone out?
Two-step verification is the setting where a bulk tool can do damage that lasts. Telegram implements it with the Secure Remote Password protocol, set out on the two-factor authentication page. The client derives a verifier from the password, and Telegram's servers never receive the password itself. Good for security, hard on operators. A password that was not recorded somewhere you control cannot be read back by anyone, Telegram included.
So the order of steps decides everything in a telegram bulk 2fa tool. Ours writes the new password into the account's JSON file first, beside the session file or TDATA folder that holds the login, and only then asks Telegram to set it. If Telegram refuses, the file is rolled back, so the record never claims a password the account does not have. Set random password gives each account its own 12-character password of letters and digits. Set custom password puts one password, at least four characters long, on every selected account. Convenient, yes, and it also means a single leak opens all of them.
Changing or removing a password needs the current one. When an account already has a password that its file does not store, the module stops on that account and says why instead of guessing. The same is true of any telegram two step verification bulk change, whoever makes the tool: nothing can replace a password it does not know.
When a password is lost anyway
Telegram leaves two ways back. Its FAQ suggests a recovery email when you turn the password on. The module does not set one, because a recovery email has to be confirmed with a code sent to that inbox, once per account. Without an email, the API docs describe a reset that works only from a session that is still logged in: account.resetPassword starts a seven-day timer, and the account can cancel it during that week. If every session is gone and nobody knows the password, the only option left is deleting the account and signing up again with the same number, which wipes its data. The password is also checked for some account actions, such as passing channel ownership to another account, so losing it blocks more than logins.
Sessions, self-destruct timers and the 24-hour rule
The security block holds the settings that end logins. Terminate all other sessions signs out every other device on the account while the session the module uses keeps working. Telegram refuses this from a new login. The auth.resetAuthorizations reference lists FRESH_RESET_AUTHORISATION_FORBIDDEN, which means the current session has to be at least 24 hours old. Accounts signed in the same day come back with that error in the report. The fix is to run the step again the next day.
Auto-terminate old sessions sets how long an unused login survives, anywhere from a week to a year. Disconnect all websites revokes every Log in with Telegram session on outside sites. Clear payment and shipping info deletes the cards and addresses Telegram has saved for the account.
Delete account if away for is the one to treat with care. Telegram's FAQ says an account that does not come online for at least 18 months is deleted with its messages, media and contacts, and that the period can be changed in settings. The module offers periods from one month to two years. A one-month timer on a reserve account that sits idle for a few weeks will delete that account. For accounts kept in storage, the long setting is the safe one.
Which settings will Telegram refuse on some accounts?
A bulk run rarely succeeds everywhere, and a tool that reports success without checking is worse than no tool. Ours reads changed values back where Telegram returns them, and it writes one row per setting per account: done, skipped or refused, with the reason in Telegram's words.
| Setting | What comes back | Why |
|---|---|---|
| Voice messages restricted | Refused on accounts without Premium | Telegram reserves it for Premium |
| Hide sponsored messages | Refused on accounts without Premium | A Premium feature |
| Only Premium users may message me | Refused on accounts without Premium | Needs Premium on the account itself |
| Who can message me for free | Refused | Only accounts Telegram has enabled paid messages for |
| Sensitive content allowed | Read back unchanged | Telegram does not let every account unlock it |
| Find me by number set to Nobody | Applied as My contacts | Telegram offers no Nobody for this key |
| Terminate other sessions | FRESH_RESET_AUTHORISATION_FORBIDDEN | The session is under 24 hours old |
| Change or remove a password | Stopped | The current password is not in the account file |
| Any setting | Flood wait | Telegram asked the client to slow down |
Flood waits get one patient retry. If Telegram asks for a pause of up to five minutes, the module waits it out once. A longer wait is logged as a failure on that setting, and the account moves on. Between two changes on the same account it waits two seconds by default, adjustable up to a minute, and several accounts run side by side up to the panel's thread limit.
The safest first run changes nothing.
Read only mode connects every account, reads every setting and writes the HTML report to the module's log folder. For a telegram security settings bulk audit that is often the whole job: it shows which accounts have no password, which still show their number and which keep sessions nobody remembers opening.
Is a telegram settings manager software run within Telegram's rules?
Changing your own account's settings is ordinary use, and every Telegram client does it. We have found nothing in Telegram's documentation that treats a privacy or password change as a spam signal. The risk sits in what the accounts do next. The Terms of Service forbid spam and scams from any client. Closed privacy does not shield an account during a mass DM run and what it really delivers, and open privacy does not make a report sent from dozens of accounts count for more.
The same tool turns up under many names: a telegram privacy manager, a telegram account settings tool, a telegram privacy settings tool, a telegram bulk privacy settings tool, plain telegram settings automation or a telegram account settings bulk editor. Under any of them the test is short. Does it change only what you picked, does it read the result back, and does it write a password down before it sets one?
Some things no telegram account privacy tool can do, ours included. It does not make an account harder to ban, raise a Telegram limit, recover a lost password or set a recovery email. As of October 2026, Telegram's privacy page lists a fourteenth key, for saved music, that the form does not offer yet. And the module works only on accounts you already hold as signed-in sessions. It never asks for codes, and it never sends your files anywhere.