The telnet URI designates an interactive service rather than a data object. Because remote interactive services vary widely in how they allow remote logins, the <user> and <password> supplied in the URI are advisory only: clients merely advise the user of the suggested username and password.

This document was created solely to preserve the telnet URI scheme on the standards track after RFC 1738 was made obsolete. The scheme definition is copied directly from RFC 1738 without substantive change.

process

Many RFCs have added authentication and encryption services to the Telnet protocol but have not specified new URI schemes for those services (analogous to how 'https' differs from 'http'). Some modern telnet clients attempt to invoke more-secure Telnet versions when resolving a 'telnet' URL, but others do not.

security

The telnet URI scheme takes the form telnet://<user>:<password>@<host>:<port>/. The final '/' may be omitted. If :<port> is omitted, the port defaults to 23. The :<password> and the whole <user>:<password> part may also be omitted.

http

The Telnet protocol normally transmits passwords in the clear and offers no privacy; both the user's identity and password are exposed without protection, as is the entire session content. Users cannot rely on more-secure Telnet extensions being invoked unless explicitly enabled and the results of security negotiation are verified.

security