What Is Telnet, How Does It Work and Why Is It Insecure?
Telnet is an early remote-terminal protocol built around a network virtual terminal. Its classic design does not provide the encryption and identity verification expected for internet administration today.
What is Telnet?
Telnet is a client-server protocol for interactive text communication with a remote system. Its common default TCP port is 23, although a service can be configured on another port.
The protocol defines a network virtual terminal and a way for peers to negotiate options such as echo behavior or terminal type. Classic Telnet does not include modern cryptographic confidentiality, integrity or strong server identity verification.
How does a Telnet session work?
- 1Open a TCP connection
The client connects to the Telnet service. Port 23 is common but not mandatory.
- 2Negotiate terminal options
Client and server may agree on echo, terminal type and other session behavior.
- 3Send login details
The server may request a username and password; traditional Telnet sends them without encryption.
- 4Start the text session
Commands and output continue across the same unencrypted TCP stream.
Telnet vs SSH
| Feature | Telnet | SSH |
|---|---|---|
| Common port | 23 | 22 |
| Encryption | None in classic use | Encrypted session |
| Server identity | No modern cryptographic verification | Host-key verification |
| User authentication | May expose a plain-text password | Password, public key and other methods |
| Recommended over the internet | No | Yes, with correct configuration |
Why is Telnet risky?
An observer on the network path may see usernames, passwords, commands and output.
There is no built-in equivalent of modern SSH host-key verification.
Without cryptographic integrity protection, a session is exposed to manipulation.
Older Telnet-managed equipment may also have weak passwords and unpatched software flaws.
Avoid sensitive credentials in Telnet sessions. Migrate to SSH whenever the server or device supports it.
Where is Telnet still encountered?
Older network devices, industrial systems or specialized services that do not support SSH.
Restricted test networks where the traffic cannot leave the controlled environment and the risk is accepted.
A Telnet client is sometimes used to inspect plain-text TCP services, although nc or service-specific tools are often better.
Temporary access while a system moves to SSH, a secure management gateway or replacement hardware.
How to reduce risk when Telnet is unavoidable
Do not expose Telnet directly to the internet; place it on a separate management network or behind a controlled VPN.
Allow connections only from specific management addresses at the firewall.
Do not use a shared high-privilege password or one that protects other systems.
Set a path toward SSH-capable firmware, a secure gateway or device replacement.
Put the guide into practice.
Review the related Varkuna product or open its detailed user guide.