free-mtproto-proxies

What Your MTProto Proxy Operator Can Actually See (and How to Verify a Free Proxy)

You paste a proxy link into Telegram. The gray cloud turns green. Messages flow again. That's the whole interaction for most users — but there's a quiet assumption buried in that click: that the proxy is safe.

MTProto is Telegram's custom transport protocol. It's not the same as using a VPN or even Telegram's own end-to-end encrypted Secret Chats. Understanding what the proxy operator sees, and what they don't, is essential if you rely on free proxies in a censored region.

The MTProto Security Model, Briefly

MTProto encrypts the connection between your Telegram client and Telegram's server. The proxy sits in the middle, handling the transport layer. The proxy cannot decrypt the actual message content — that requires Telegram's server-side decryption keys, which the proxy doesn't have.

What the proxy *can* see:

- Your IP address (the proxy knows where you are connecting from)

- The fact that you are connecting to Telegram (the proxy sees destination IPs belonging to Telegram)

- The timing and size of your traffic (metadata like how long you're connected, how many packets you send)

- The TLS handshake (if using fake-TLS, the proxy sees a disguised HTTPS connection, but the SNI field can still leak the target domain)

What the proxy *cannot* see:

- Message text, media, or file contents (these are encrypted end-to-end between client and Telegram server)

- Your Telegram account credentials

- Who you are messaging (the proxy only sees encrypted packets, not user IDs or chat IDs)

**Critical nuance**: This applies to default MTProto connections. If you use Telegram's Secret Chats (end-to-end encrypted), the proxy still sits outside that layer — it can't read Secret Chat messages either. But the proxy can still tell that you are using Telegram and when you are active.

The Real Risks of Free Proxies

Free MTProto proxies are usually run by volunteers, but not always. Some operators log connection metadata. Some inject malicious responses (though the protocol includes integrity checks, attacks are rare). The biggest risk isn't data theft — it's censorship bypass failure.

A proxy that looks legitimate could be:

- **A honey pot** set up by a government or ISP to identify users who bypass blocks

- **A misconfigured proxy** that leaks your real IP to Telegram's servers

- **A short-lived proxy** that disappears after a few days, disrupting your connection

The most common problem with free proxies is that they get blocked quickly. An operator in Iran or Russia might run a proxy for a week before the local DPI detects it. You need fresh, verified proxies regularly.

How to Verify a Proxy's Authenticity

You can't fully audit a proxy without controlling the server. But you can reduce risk:

1. **Check the proxy's origin**: Where did you get this proxy link? A random Twitter post is less trustworthy than a community-maintained list that's been tested.

2. **Use a proxy that supports fake-TLS**: Fake-TLS makes your connection look like normal HTTPS traffic to DPI. The [free-mtproto-proxies repository](https://github.com/dubblebyte/free-mtproto-proxies) explicitly filters for proxies that advertise fake-TLS support, and the live web listing shows connection status.

3. **Cross-check with multiple sources**: If a proxy appears in the same scraping pool across several independent lists, it's more likely to be genuine.

4. **Test the proxy with a burner account first**: If you're particularly cautious, create a temporary Telegram account and run the proxy for a few minutes. Monitor whether you receive unusual login notifications.

5. **Look for transparency from the proxy operator**: The repo maintainer publishes the scraping script and the full list of proxies, so you can see which IPs were collected and when. That's more trustable than a closed-source proxy app.

Why This Repo Is Different

Most proxy lists are outdated or manually maintained. The [free-mtproto-proxies](https://github.com/dubblebyte/free-mtproto-proxies) repository automates scraping from public Telegram channels and publishes the results as a plain text list and a web page. Because the source is open, you can verify:

- The scraping logic (no hidden filters that favor certain operators)

- The update frequency (the list refreshes every few hours)

- The proxy format (tg:// links with port, secret, and optional fake-TLS parameters)

If you've read the practical guide on [finding and adding working proxies](https://pastebin.com/iBbgfHBV), you know that most free proxies vanish within 48 hours. This repo's automated lifecycle keeps a live pool.

Practical Tip: Verify the Proxy's Secret

When you add an MTProto proxy, you provide a "secret." For fake-TLS proxies, the secret includes a special prefix. A valid fake-TLS secret starts with `ee` (hex) or the base64 equivalent. If the secret is just a random 32-character hex string without `ee`, it's likely a plain MTProto proxy — which is easier for DPI to fingerprint. The repo's listing shows which secrets are authenticated.

To add a proxy manually: open Telegram, go to Settings > Data and Storage > Proxy Settings, tap "Add Proxy," select MTProto, then paste a link like:

tg://proxy?server=185.xxx.xxx.xxx&port=443&secret=eee465...

If the proxy is legitimate, Telegram will show "Connected" and the cloud icon turns green. If it fails repeatedly, move on.

The Bottom Line

Free MTProto proxies are a stopgap, not a long-term solution. They do not expose your message contents, but they do expose your metadata. Use them to bypass censorship, not to hide from Telegram itself. Verify the proxy source, prefer fake-TLS, and rotate frequently. A community-checked, open-source list like the one at the repository above gives you a transparent baseline — no black-box secrets, no hidden operators.

For a broader comparison of MTProto proxies versus VPNs, see the [detailed analysis on Dev.to](https://dev.to/humja_jaan_fca09049ae97d5/telegram-proxies-that-actually-work-a-practical-guide-for-censored-regions-48o6). The short version: proxies are lighter on battery and easier to set up, but VPNs offer full-device protection. Choose based on your threat model.