plain, dd and FakeTLS: Telegram proxy secrets explained
Every MTProto proxy link carries a secret. Its first two characters tell you how the proxy disguises your traffic, and how likely it is to keep working on a network that hunts for proxies.
What the secret is
The secret is 16 random bytes that the proxy owner generates once and shares with everyone who uses the proxy, written as 32 hexadecimal characters. It has nothing to do with your Telegram account and gives no one access to it. The app uses it to prove it may use this proxy and to scramble the traffic, so that from the outside it does not look like Telegram.
The three types
| Type | Format | Length | How it hides traffic | Share of working proxies |
|---|---|---|---|---|
| plain | 32 hex characters | 32 | Obfuscated so it does not look like ordinary MTProto, but packet sizes still give it away. | 57% |
| dd | dd + 32 hex characters | 34 | Adds random padding to every packet, so sizes no longer follow a pattern. | 38% |
| FakeTLS (ee) | ee + 32 hex characters + a domain name in hex | 36 and up | Wraps traffic in fake TLS 1.3 records that look like a visit to a real website. | 5% |
Shares are from the 200 working proxies in our checker on 9 October 2026.
plain
The original format. Traffic is obfuscated, so a firewall looking for the MTProto protocol will not match it directly, but the lengths of the packets follow a recognisable pattern. Networks that inspect traffic closely learned to spot that pattern years ago. Plain proxies still work wherever no one is looking for them, which is why they are the most common type: 57% of our list.
dd: random padding
Putting dd in front of the secret tells the app to add random padding to each packet, so the sizes stop looking like Telegram. The server must support it; most current proxy software does. It is a cheap upgrade, and 38% of working proxies use it.
FakeTLS: ee
A secret that starts with ee switches the app to FakeTLS. The connection begins with what looks like a normal TLS 1.3 handshake to a real website, and all Telegram traffic then travels inside fake TLS records. The website's domain is written into the end of the secret. If someone connects with the wrong secret, for example a censor probing the server, a well-configured proxy passes them through to the real website, so the server looks like an ordinary HTTPS host.
Here is a FakeTLS secret from our list, taken apart:
| Prefix | ee FakeTLS |
| Key | 6402cca17cd080e3f6473be451b705ee |
| Domain | 73746f726167652e676f6f676c65617069732e636f6d = storage.googleapis.com |
FakeTLS is the hardest type to block and the rarest: 10 of 200 working proxies. Of those, 6 ran on port 443, the real HTTPS port, which is what a disguise as a website needs. Plain proxies mostly sat on port 8443.
Base64 secrets
Some servers hand out the same secret in base64 instead of hex. A base64 FakeTLS secret starts with 7 and a base64 dd secret with 3, because that is how the bytes ee and dd encode. Telegram accepts both forms. The proxy link checker converts them and shows the hidden domain.
- The FakeTLS proxies in our list pretended to be: ya.ru, 1c.ru, www.citilink.ru, mt.skotobaz.ru, storage.googleapis.com, www.bing.com, www.cloudflare.com, smetanka.click, example.com.
- Four of the nine are .ru domains, including Yandex (ya.ru) and the retailer Citilink. Blocking traffic that looks like a visit to a popular domestic service risks breaking that service, which is the whole point of the disguise.
- One proxy used example.com, the placeholder domain from setup guides. Its owner never changed the default.
- None of the 59 working proxies hosted inside Iran used FakeTLS (0 of 59); all were plain or dd.
Which one to pick
If a plain proxy works on your network, it is fine. Where operators actively hunt for proxies, as in Iran, Russia, China or Turkmenistan, try them in this order: FakeTLS, then dd, then plain. Because FakeTLS proxies are scarce, the realistic choice is usually dd. If a proxy of any type will not connect, see proxy not connecting.