Decoding Telegram MTProto proxy links

A Telegram proxy link is a small URL with three fields, and most "the proxy does not connect" problems come from one of those fields being wrong. This post takes a link apart, explains the three secret types you will meet, and shows what a snapshot of 200 working proxies looks like. If you would rather paste a link and get a verdict, there is a Telegram proxy link checker that does the parsing in your browser.

The anatomy of a link

An MTProto proxy link comes in two spellings that carry the same query string:

tg://proxy?server=203.0.113.10&port=8443&secret=dd0123456789abcdef0123456789abcdef
https://t.me/proxy?server=203.0.113.10&port=8443&secret=dd0123456789abcdef0123456789abcdef

(The address is from the documentation range; the secret is a placeholder.)

• server is an IP address or a domain name.
• port is a TCP port, 1 to 65535.
• secret is a hex string (or base64) that the client and the proxy share. It is what makes the proxy an MTProto proxy rather than an open relay, and it decides how the traffic is disguised.

Our checker also accepts SOCKS5 links, which carry a username and password instead of a secret, and the bare server:port:secret form.

Parsing it takes a few lines:

from urllib.parse import urlparse, parse_qs

def parse_proxy(link: str) -> dict:
    q = parse_qs(urlparse(link).query)
    server = q.get("server", [""])[0]
    port = int(q.get("port", ["0"])[0] or 0)
    secret = q.get("secret", [""])[0]
    return {"server": server, "port": port, "secret": secret}

The three secret types

After the transport prefix, the secret is 16 bytes, which is 32 hex characters. The prefix tells you the type:

Secret	Looks like	What it means
plain	32 hex characters	The original format: the traffic is obfuscated but does not imitate anything
dd	dd + 32 hex	Adds random padding to packet sizes to make length analysis harder
FakeTLS (ee)	ee + 32 hex + the domain in hex	The connection looks like a TLS handshake to a real website, named in the secret

For FakeTLS the tail of the secret is hex-encoded text. Decode it and you get the site the proxy pretends to be:

def fake_tls_domain(secret_hex: str) -> str | None:
    if not secret_hex.lower().startswith("ee"):
        return None
    tail = bytes.fromhex(secret_hex[2 + 32:])
    return tail.decode("ascii", errors="replace")

The checker does the same and shows the disguise domain next to the server and port. Secrets can also arrive base64-encoded, so a decoder should try both.

Why a proxy does not connect

The problems we see come back to the link itself more often than to the server:

• A cut-off secret. Copying from a chat sometimes drops the last characters, so the secret is no longer a whole number of bytes. A quick length check catches it.
• A missing or wrong port. An empty port= or a value outside the valid range.
• A server that is not a valid address. A stray character, a trailing dot or a space from a line break.
• A dead server. The link is well-formed, but the proxy has stopped. This one a parser cannot tell you, only a real connection test can.

Our checker flags the first three before you open the link. It does not connect to the proxy from the browser, because a web page cannot open the kind of connection MTProto needs, and the link you paste is not sent to us. A longer list of symptoms and fixes is in the proxy errors guide.

What 200 working proxies look like

To see what works in practice we took the 200 best-ranked proxies from our checker on 9 October 2026. Every one had answered at least 90% of checks. This is the best of what circulates, not the average.

• Hosting is concentrated. 57% ran in Germany and 50.5% with a single provider. 29.5% ran on servers inside Iran, where Telegram has been blocked since 2018.
• Ports. Only 17.5% used 443. 53.5% used 8443, and 76% were on the alternative HTTPS ports 8443, 8880, 2096 and 2053.
• Secrets. 57% plain, 38% dd, 5% FakeTLS. None of the 59 Iranian-hosted proxies used FakeTLS.
• Names. 39 were published under a domain instead of an IP, and 27 of those names carried an "ir" label. A random subdomain costs nothing, so when one name lands on a block list the operator publishes another one pointing at the same server.

The practical reading: a proxy on a port that web traffic already uses and a padded secret is the common shape, and FakeTLS stays rare because it needs a believable domain and ideally port 443. The full tables are in our proxy statistics write-up.

A note on safety

Your messages stay encrypted the whole way, so a proxy owner cannot read them, but they can see your IP address. Treat a free proxy as a way to keep Telegram reachable, not as privacy. If you need a fresh server, the live list of free MTProto proxies is rechecked every 20 minutes with a real MTProto handshake, not a ping.