TDATA, .session and .json: What You Actually Received

The archive opens and there is a folder called tdata, or a .session file sitting next to a .json. No username, no password, nothing that looks like credentials. The first instinct is that the seller sent the wrong thing.

They almost certainly did not. Around eighty per cent of Telegram listings deliver this way, because a Telegram account in this market is normally handed over as a live session rather than as a login.

What each one is on disk

• TDATA is a directory, not a file. It is where Telegram Desktop keeps its local state, including the authorisation that makes the client open already signed in. You are receiving a copy of that directory. Inside you will find files with names like key_data and a subdirectory whose name is a long hex string; that structure is normal and you should not rearrange it.
• A .session file is a small SQLite database. It holds the authorisation key and the datacentre address the session was established against. Libraries such as Telethon and Pyrogram read this directly and connect without a login step.
• The .json beside it is plain text metadata: the API id and hash the session was created under, usually the device model, app version and platform string as well. Open it in any text editor. It authorises nothing on its own.

Which one your tool needs, and why it matters more than it sounds

These are not interchangeable and choosing wrong is the most common way to waste money here.

• Telegram Desktop wants TDATA. You close the client, replace its data directory, reopen it.
• Telethon, Pyrogram and tools built on them want the .session file, and most want the JSON too so they can present the same API identity the session was created with.
• Mobile clients want neither. There is no supported way to import either format into a phone app, which is worth knowing before you buy for a phone workflow.

There is no price difference between the formats on this shelf, so there is nothing to gain by compromising. Buy the one your tool reads.

Converting between them

Converter tools exist and this is one of the most searched things about TDATA, so it is worth being precise. Extracting a usable session from a TDATA directory is the direction that generally works, because the authorisation key is there to be read. The reverse, building a working TDATA directory from a session file, is more fragile, because a desktop installation expects a good deal of local state beyond the key itself.

Two cautions that matter more than the mechanics. Conversion tools take your authorisation key as input, which means running an unfamiliar one is handing over the account, so treat that choice the way you would treat any credential. And an account can generally hold several live sessions at once, so converting does not usually invalidate the original; whoever else has a copy still has one.

What to check before you trust the files

Three checks, in this order, and all of them fit inside a twelve-hour warranty window:

1. Completeness. A TDATA directory should not be a handful of stray files, and neither a .session nor a .json should be zero bytes. Open the JSON and confirm it actually contains an API id and hash rather than empty fields.
2. That it connects, in the tool you intend to use, from a clean environment. A virtual machine or a separate profile is worth the two minutes, because it keeps the test from mixing with anything else you have signed in.
3. The active sessions list. This is the check people skip and it is the important one. Once you are in, look at the list of authorised devices. It tells you who else is currently holding this account, which is a fact about your purchase you cannot learn any other way.

The conflict problem, which is really a timing problem

A copy of a session can be used from more than one place. If the seller or a previous buyer still has the same files loaded somewhere, both of you are signed in simultaneously, and your activity may trigger security prompts or push someone else's client off.

Nothing in the file format prevents this, and the obvious response is not available. Telegram will not let a session log out any other session until it has itself been signed in for twenty-four hours, and it refuses with an error saying so. The refusal covers ending one device, ending all the others, and setting the session lifetime, so you cannot even ask for a short expiry and let the other copies lapse on their own.

That is worth sitting with, because it inverts the usual advice. The warranty window on this shelf is twelve hours at the median, so on most listings the moment you can finally clear the strangers out arrives after the moment you could still raise a claim. Speed does not solve it. Nothing solves it.

What you can do on the first day is two things, and they are the ones worth planning around. Read the device list and record what is in it, because that record is your evidence while the window is still open and it costs a minute. Then change the two-step password and set your own recovery address, which has no waiting period attached. That will not evict a copy that is already loaded somewhere, but it does stop another one being added, which is the half of the problem you can actually close. Clearing the list itself is a job for the following day.

Why there is no password

Because there is nothing to type. A session is an already-completed authorisation, which is why no code arrives on a phone when you import one. It also means the phone number attached to the account is a separate question: about thirty-five per cent of listings are marked SMS-verified, which tells you a number was used at registration, not that it is reachable now. If Telegram asks for a code later, that number decides whether you can answer.

Similarly, a two-factor password is a separate field again. It is set on just under sixty per cent of listings, and where it is set you need whatever the seller passes you in order to change it.

Current stock with the format tags filterable is on the Telegram accounts shelf. The wider buying guide covers what the other listing fields mean.