Telegram proxy secret is invalid
The secret is the key that lets the app talk to an MTProto proxy. If it is cut short, mistyped or does not match how the server was set up, Telegram either rejects it or connects to nothing. Its length alone tells you a lot.
What you see
| Where | On screen |
|---|---|
| Telegram Desktop | “This proxy link uses invalid secret parameter. Please contact the proxy provider…” |
| Telegram for Android | “The proxy you are using is not configured correctly and will be disabled. Please find another one.” |
| Any app | No message: the proxy just keeps connecting |
What it usually means
- The secret was shortened when copied. A plain secret is 32 hexadecimal characters, a dd secret 34, and a FakeTLS secret is longer because a domain name is encoded at its end.
- A “dd” or “ee” prefix was added or removed by hand. The prefix tells the app how to disguise traffic, and a server may accept only the form it was set up with.
- The proxy owner changed the secret. Old links then stop working at once.
- The server runs old or misconfigured proxy software. That is what Telegram Desktop’s message asks the provider to fix.
Check it step by step
- Count the characters of the secret.
32 hex characters: plain. 34 starting with dd: dd. Longer and starting with ee: FakeTLS. Any other hex length usually means the secret was cut.
- Paste the whole link into the proxy link checker.
It converts base64 secrets to hex, names the type and, for FakeTLS, shows the disguise domain. A domain that comes out as unreadable symbols means the secret is damaged.
- Do not add or delete the dd or ee prefix yourself.
Use the secret exactly as the proxy owner published it.
- If you typed the proxy in by hand, enter it again.
A missing character at the end of a long secret is easy to overlook on a phone keyboard.
- If Telegram disabled the proxy, take a different server.
The Android message means the app gave up on this configuration. A fresh, checked server is quicker than debugging someone else’s setup.
Try a server that passed our last check
These servers passed a full MTProto handshake from our checker. List built 18 October 2026 at 14:51 UTC; it is rebuilt every 20 minutes. A server that works for our checker can still be blocked on your network.
- Of the 200 working proxies in our list on 9 October 2026, 114 used plain secrets, 76 dd and 10 FakeTLS.
- Right now the live list holds 109 plain, 76 dd and 15 FakeTLS servers. What each type does: plain, dd and FakeTLS secrets.
Questions
Can a secret be written in base64 instead of hex?
Yes, links use both forms. The link checker converts base64 to hex, so you can compare two links that look different.
What does the domain at the end of a FakeTLS secret do?
The proxy makes its traffic look like an ordinary encrypted connection to that site. The domain is part of the secret, so cutting or changing it breaks the secret.
Which secret type works best?
FakeTLS is the hardest for a network to recognise, dd comes next and plain is the easiest to block.