Skip to content

MTProto proxy explained

Telegram's own protocol, designed specifically to get around blocking.

What MTProto actually is

MTProto is Telegram's own transport protocol. An MTProto proxy is a small relay that speaks it: your app wraps traffic in MTProto, hands it to the relay, and the relay forwards it to a Telegram data centre. Everything stays encrypted end to end between your app and Telegram — the relay never sees message contents.

That is the important difference from an ordinary VPN or SOCKS5 proxy. It carries only Telegram traffic, it needs no login, and it was designed from the start to be hard to recognise on the wire.

The three secret types

The secret is not just a password — its first bytes tell your app which masking mode to use.

  • Classic (32 hex characters, no prefix) — the original obfuscation. Fast, but a determined filter can fingerprint it.
  • dd — padded — adds random bytes to every packet so that characteristic packet lengths no longer give the protocol away.
  • ee — FakeTLS — the strongest one. The proxy performs a complete, convincing TLS handshake and impersonates a real HTTPS website; the cover domain is encoded in the secret itself. To anyone watching the connection, you are simply browsing a website.

How we verify these servers

A port that answers is not a working proxy. Our checker performs the real handshake:

  • For classic and dd secrets it builds the 64-byte obfuscated handshake, derives the AES-CTR keys from the secret, sends a req_pq_multi request and waits for the Telegram data centre to reply with resPQ echoing our nonce. Nothing but a genuinely working proxy can produce that answer.
  • For ee secrets it sends a FakeTLS ClientHello whose random field carries an HMAC of the message itself, then verifies the HMAC the proxy writes into its own server random. Matching it proves the server holds the advertised secret — a proxy with a stale secret silently forwards you to the real cover website instead, and the signature does not match.
  • That signature alone only proves ownership of the secret, not that Telegram is reachable behind the proxy, so the checker continues: it wraps the same obfuscated handshake and req_pq_multi request in TLS ApplicationData records and waits for resPQ. A server that knows the secret but can no longer reach a data centre fails here, exactly as it should.

Only servers that pass end up on the list.

MTProto versus VPN

A VPN routes everything through a tunnel — useful, but heavier on battery, and it changes your apparent location for every app. An MTProto proxy touches Telegram only. If your goal is simply to make Telegram work, the proxy is lighter, faster to switch and does not need an app to be installed.