Telegram tdata Accounts: Formats and Taking Over the Session

A Telegram tdata account is not a username and a password. It is a copy of the data a signed-in Telegram Desktop keeps on disk, handed over as a folder, and the other format PVAVRT ships — a session string — is the same idea squeezed into one line of text. Either one opens the account without a code. That is the whole point of them, and it is also the reason the first few minutes after delivery matter more than the format debate: a file that logs you in without asking anything will do exactly the same for anybody else who kept a copy of it.

This page explains both formats in plain terms, what that property means for control, the order to secure a delivered account in, the four grades and list prices, the Telegram rules that still apply to an account you did not create, and the cases where a bot token is the better tool.

Telegram tdata account vs session string: the two delivery formats

A tdata folder: Telegram Desktop’s signed-in data

Telegram Desktop stores the state of a signed-in account locally, in a directory named tdata — a name that appears on no Telegram help page, because it comes from the official Telegram Desktop client, whose source creates that folder inside the app’s working directory. That state is an authorisation, not a reminder of your password — it is why the app reopens into your chats instead of asking who you are. When an account is sold in this shape, what changes hands is a copy of that directory. Hand it to the desktop client and the client is signed in; there is no code to receive and no password to type, because as far as Telegram is concerned the session already exists.

A session string or session file: a login that client libraries read

The same authorisation can be carried as text. Telethon, the Python client library, documents its session files as holding the information required to talk to Telegram’s servers, including the authorization key used to encrypt messages, and says such a file holds enough to log in without re-sending the code. Its string session is that material written as a single line, which the docs describe as taking only a string to be able to login without asking for your phone and code. Pyrogram reads a string of its own the same way: the official Pyrogram client documents an option that loads a session in memory from such a string, and an export call that produces one. Those two libraries are the usual readers of the format, which is all the format is: a login in a form a program can hold.

The same price for either format

Nothing about the price depends on the shape. Each grade on the Telegram grades and list prices page carries one figure per account, and the format is a line in the order brief rather than an add-on. Choose the format before you pay: it decides what gets pasted into the Telegram thread at delivery. Anything beyond what the brief asked for is agreed in the Telegram thread rather than promised on a page.

Whoever holds the file holds the login

Why a tdata folder or session string works like a password

A password can be changed, which ends every use of the old one. An authorised session cannot be unsaid that way. Telethon’s own documentation puts the warning bluntly for its string format: anyone with this string can use it to login into your account and do anything they want to. A copied tdata folder carries the same risk. Telegram’s FAQ also notes that you can be logged in from as many devices as you like and use them at the same time, so two holders of the same material can both be inside the account without either one tripping over the other.

Why ending other sessions isn’t enough on its own

Here is the trap that catches careful buyers. If you load the delivered folder or string and then close every other session, you have ended the seller’s separate logins — but a copy of what you were given is not another session, it is the same one. Terminating from inside it cannot cut off a duplicate someone else kept. Ending that session has to happen from a different login, one you create yourself on your own device. Until that is done, a retained copy still works.

Two more facts follow from that. A brand-new login is not allowed to close older sessions straight away, and that limit is Telegram’s own: its API reference for resetting other authorisations lists the error FRESH_RESET_AUTHORISATION_FORBIDDEN, described there as not being able to log out other sessions if less than 24 hours have passed since you logged on the current session. The step-by-step side of it is in our guide to ending old Telegram sessions and the 24-hour lock. And the registered phone number stays with whoever controls it, so no seller can promise you codes on that number. The two-step verification password is the thing that makes a code alone useless.

Taking over the session on arrival

Your own two-step verification password, and a recovery email you control

Do this before the device list, because no waiting period applies to it. Telegram’s FAQ puts the control under Settings, then Privacy and Security, then 2-Step Verification, and says that once it is enabled, logging in takes an SMS code and a password. The same answer points out that a recovery email address helps if the password is ever forgotten, so set one you own. Telegram has offered this since its April 8, 2015 announcement of the password alongside the session list, which describes the password as something required on every login from a device the account has not seen before.

End every other session under Settings > Devices

Telegram’s FAQ gives this path as Settings, then Devices, or Privacy and Security, then Active Sessions. The 2015 announcement presents the screen as an inventory of logged-in devices with IP details, and tells you to shut the entries that look stale or wrong. Read every row before you use the control that clears all but your current one, so you know what you removed.

Sign in on your own device, then end the delivered session once Telegram allows it

A login of your own needs a code, and that code need not come by SMS. Telegram’s FAQ says that if you have recently used one of its apps on another device, it may send the login code via Telegram instead of SMS — which means the code for your new device can land as a message inside the session you were handed. That is exactly why the delivered session is ended last: end it first and you have closed the only place a code can reach you, since the number itself is not yours. A fresh login is also the only route onto a phone, because the folder format opens in Telegram Desktop and the string format is read by client libraries, and neither one loads into a mobile app.

Now deal with the session you were handed. Sign in on a device of your own — phone, desktop, whichever you plan to keep the account on — and from that login close the delivered one. If Telegram refuses because your login is too new, the refusal is the waiting period, not a fault in the account. The password you set in the first step is what holds the line in the meantime.

If the first login fails, say so inside the window

A login that does not work at all is the one failure PVAVRT commits to fixing: tell @pvavrt in the thread, no later than 7 days from delivery, and that account is swapped for another free of charge — PVAVRT states that a swap usually follows within an hour of the report reaching that thread. PVAVRT states it tests the login on accounts before they go out, which is not a guarantee, so open every account in a batch the day it reaches you.

Buy Telegram session or tdata accounts: grades and list prices

Four grades, four prices, and either format available on each. The longer buyer’s walk-through of fresh, aged and username Telegram grades goes further into choosing between them; what follows is the format-relevant version.

EU + SEA Mix, $3

The listing dates this grade at 1 to 14 days old across EU and South-East Asian geos. It is the cheapest row on the page, and the wide geo is the trade-off: pick it when the listed region does not matter to you.

New (Fresh PVA), $3.50

Listed at 1 to 7 days, mixed geo — the newest creation window on the page. The format choice applies to it like any other row: ask for a tdata folder or a session string in the brief.

USA tdata (Aged 30+), $7

Listed at 30 days or more, USA. The word tdata is part of the grade’s name, not a restriction on the format: ask for a session string on this row and it ships as a session string, at the same price.

Aged 90-Day with Username, $14

Listed at 90 days, USA or EU, with a @username already set. The username comes with the account you are taking over, so treat it as part of what you inherit: if you want a different one, change it yourself after the password and the device list are settled.

Minimum order of 5 and list-price totals

The minimum order on this product is 5, whichever grade you pick, so the cheapest order at list is five of the $3 row — $15. Larger counts are not published: bulk pricing is quoted per product on Telegram.

Telegram’s rules for accounts and API use

Telegram’s Terms ban spam and scams

Telegram’s Terms of Service tell users plainly not to “send spam or scam users”, and warn that not complying with the terms can end in a ban, temporary or permanent. That reaches the account in your hands whatever route it took to get there.

Flooding or spamming through the API means a permanent ban

Telegram’s developer page on obtaining an api_id is unusually direct: use the Telegram API for flooding, spamming or faking subscriber and view counters of channels, it says, and you will be banned forever. That is Telegram’s own rule, written on Telegram’s own documentation, and it is worth reading as a statement of what the platform will not host rather than a threshold to work near.

Accounts on unofficial API clients are placed under observation

The same page states that all accounts that log in using unofficial Telegram API clients are automatically put under observation. Any session string driven by a client library falls in that description. Nothing about that is hidden from you, and nothing about it changes with the grade you buy.

Telegram’s terms don’t address account sales, and bans still apply

Buying accounts runs against the published terms of most platforms. Telegram is the odd one out: its terms are silent on account sales in both directions, so treat anyone who claims Telegram bans them, or blesses them, as guessing. Silence is not permission, either — the spam and scam rules above still reach an account you bought, and Telegram can close any account at any time. PVAVRT sells accounts only for legitimate marketing, automation, QA testing and account-management work, refuses orders it believes are intended for fraud, harassment, impersonation or illegal activity, and leaves each buyer responsible for the platform’s terms and the laws where they operate.

When a bot token is the right tool instead

Bots from @BotFather need no phone number

If what you actually want is automated messaging, Telegram already supplies the sanctioned instrument. Telegram’s bot documentation explains that a bot is registered by messaging @BotFather, which returns an authentication token, and it is explicit that bots do not need a phone number. There is no account to buy, no session to secure and no number held by somebody else — and the token should be guarded as closely as any delivered session, since whoever holds it drives the bot.

Bots can’t start conversations

The limit is in the documentation too: a bot also can’t start conversations with users, so a person has to message it or add it to a group first. Treated as a limitation, that looks like a wall. Read honestly, it is the line between messaging people who asked to hear from you and messaging people who did not. Unsolicited direct messages are not something PVAVRT will help with, whatever format the login arrives in.

Jobs a bot does better than a user account

Answering inbound questions, posting to a channel you own, running commands for group members, moderating, and collecting form-style replies all suit a bot better than a bought account, because none of them needs a human identity and none of them depends on a session somebody else once held. User accounts earn their place elsewhere: holding admin rights on a group or channel that is yours, which is the context for the rules in our guide to Telegram channel ownership transfer, and exercising a bot you wrote from the other side of the conversation.

Ordering Telegram tdata or session accounts from PVAVRT

What to send: grade, quantity, and tdata or session string

Three things make a complete brief: the grade name from the Telegram grades and list prices page, the quantity, and whether you want tdata folders or session strings. Credentials arrive in the Telegram chat as one or the other, which is also where the ETA is confirmed before you pay. Common questions on ordering are answered in PVAVRT’s ordering FAQ.

Delivery windows: standard, 500-plus and custom orders

PVAVRT states that a standard order usually leaves inside 4 hours of payment clearing, with the delivery ETA settled in chat beforehand. Bulk Telegram orders of 500 or more typically deliver within 24 hours. A custom specification on this product runs 7 to 14 business days, and the price and timing of anything custom are settled on Telegram before payment rather than promised on a page.

Payment, contact and the 7-day replacement

Message PVAVRT on Telegram @pvavrt or WhatsApp +1 (310) 460-9890 with the Telegram grade, the quantity — the minimum is 5 — and whether you want tdata or a session string. Payment is crypto, or card by invoice (payment options for your order are confirmed on Telegram). Any account that will not complete a first login is swapped free, provided the report reaches that thread no more than 7 days after delivery. If you would rather start somewhere else, every way to reach PVAVRT is listed on one page.