How to secure your Discord account

Passkeys, security keys and authenticator apps on Discord

Discord supports three types of Multi-Factor Authentication (MFA): Security Keys (including passkeys), an Authenticator App, and SMS. It recommends setting up a Security Key, and you can combine methods. Whatever you choose, you get Backup Codes for when you lose your device.

Passkeys are encrypted digital keys created with your fingerprint, face or screen lock. They can be stored in a password manager so you can sign in on other devices. Discord describes them as simple, backed up in the cloud and, most importantly, phishing resistant. Once registered, you can tap 'Or, sign in with Passkey instead' to log in without a password. You can have up to 16 security keys or passkeys at once.

To register one on desktop, select the cogwheel next to your username to open User Settings, stay on My Account, and under the Password and Authentication section select Register a Security Key. On mobile, tap your avatar, then the cogwheel, then Account, then Security Keys, then Add. A physical security key works as a second step after your password rather than as a one-step login.

An authenticator app gives you a new code every 30 seconds. Discord warns that not all authenticator apps back up or sync, so losing your phone without backup codes could lock you out.

Why Discord can't remove MFA for you

This is the part people miss. Discord's help article states that the Discord Support team is not able to remove MFA from an account. If you lose your phone and your passkeys and you don't have your backup codes, you may not get back in.

Backup codes are one-time codes Discord gives you when you set up MFA. Discord suggests keeping them in a password manager, or printing them and storing them somewhere safe. If you didn't save them, you can still get them: open User Settings, make sure you're on My Account, and select View Backup Codes. Once you've used some, generate a fresh set.

SMS is available as a backup, but Discord is unusually frank about it: SMS MFA is better than no MFA, but not by a lot, because attackers can take over phone numbers through a SIM swap with the mobile network. Discord only lets you add SMS after you've set up an authenticator app.

Authorized Apps and the scams that spread through friends

Bots and connected apps can be given access to your Discord account. If something is stealing messages or posting from your account, it may be an app you authorised without realising. To check on desktop, open User Settings and select Authorized Apps, then Deauthorize anything unwanted. On mobile, tap your avatar, the cogwheel, then Authorized Apps, and tap the x next to anything you don't recognise.

Discord names two main threats. Suspicious links or files often look like games or "free Nitro" but are built to steal your login. Social engineering is someone manipulating you into sharing information, such as a scammer pretending to be Discord staff offering to appeal action on your account, or asking for card details for a giveaway. Discord says its staff will never contact you directly in the app about support matters.

Because a taken-over account looks like your real friend, these scams spread fast. Read our guides to 'test my game' malware, the accidental report scam and fake giveaways for what they look like.

Reporting a hacked Discord account the right way

Discord's hacked-account article starts with your inbox. If someone changed your account email, Discord sends a 'Discord Email Address changed' email to the old address, and a link in it lets you temporarily change the email back. Check your spam folder too.

Next, reset your password, make sure MFA is on, remove unknown Authorized Apps and, on Windows, run a Windows Defender scan. If you still need help, submit a ticket at dis.gd/hackedaccount and give all the information it asks for, including any unauthorised transactions.

Two cautions from Discord's own pages. First, its Terms of Service make you responsible for your account's security, and it says it may be unable to help recover an account that wasn't secured. Second, if you see charges after losing control of your account, Discord asks you to report them through its form; filing a chargeback directly with your bank may lead to the account being suspended while Discord investigates. Our hacked account triage page walks through the order.

When a Discord passkey stops working

Passkeys usually just work, but Discord's help article has a fix for when one doesn't. First, try signing in with your username and password, then use your passkey on the Multi-Factor Authentication screen that follows.

If that fails, Discord suggests starting fresh:

1. Have your Discord backup codes to hand, then remove the Discord passkey from your password manager.
2. Complete the sign-in challenge with another MFA method, or one of your saved backup codes.
3. In your account settings, register a new passkey and give it a name you'll recognise.
4. Delete the old passkey from your Discord account.

Doing it in this order keeps your remaining backup codes valid while you set up the new passkey. It's also a good reason to have at least two MFA methods: if one stops working, you can still get in without spending backup codes.

Reporting abusive messages inside Discord

Securing your own account is half the job. The other half is reporting the accounts and messages that try to trick you, so Discord can act on them.

Discord's steps: select the message you want to report (hold it down on mobile, or right-click on desktop or browser), choose Report Message, then select the type of abuse. You can also report user profiles. If the scam came from a friend's account, it has probably been taken over; tell them through another app or in person so they can start their own recovery.

For UK-wide reporting routes beyond Discord, such as reporting fraud, see our scams hub.