Why Discord Accounts Are Worth Stealing
Discord isn't just chat. Stolen accounts are used to spread malware to your friends ("try my game!"), run crypto scams in servers you belong to, and hijack servers where you hold admin roles. Nitro subscriptions and connected payment methods sweeten the deal for attackers. The common attack paths are fake login pages, poisoned QR codes, and malware that grabs your Discord token straight from your computer.
Two-factor authentication shuts down the password based attacks, and Discord additionally requires 2FA for admins in many larger servers, so moderators often need it just to keep their roles.
How to Turn On Discord 2FA
- Open Discord and click the gear icon (User Settings) next to your username.
- Go to My Account.
- Under Password and Authentication, click Enable Authenticator App.
- Enter your password when prompted.
- Discord shows a QR code. Scan it with Google Authenticator, Authy, or any TOTP app. You can also copy the key manually.
- Type the six digit code from your app to finish.
From now on, logins need your password plus a fresh code from your app. If you're curious what that QR code contains, it's a standard otpauth URI with a Base32 secret. You can decode any QR with our free QR decoder and generate codes from the secret with our 2FA code generator.
Download Your Backup Codes Immediately
After enabling 2FA, Discord gives you backup codes. Discord is notoriously strict about 2FA lockouts: lose your authenticator and your backup codes, and support usually cannot restore access. There is no "verify with your ID" fallback like some platforms have.
- In My Account, under Password and Authentication, click View Backup Codes.
- Save them in your password manager or print them.
Treat these codes like cash. Our backup codes guide covers storage strategies that survive a lost phone.
Add a Security Key for Maximum Protection
Once an authenticator app is active, Discord lets you register a hardware security key (YubiKey and similar) as an additional method. Keys are phishing proof: a fake Discord login page can't extract anything from them. If you admin large servers or hold a valuable handle, it's a worthwhile upgrade. New to hardware keys? Read our hardware security key guide.
What 2FA Does Not Protect Against on Discord
Honesty time: Discord has an attack class that walks straight past 2FA.
- Token theft: Malware on your computer can steal your session token, which lets attackers act as you without ever logging in. 2FA never triggers. Defence: don't run untrusted downloads, especially "game betas" sent by friends whose accounts may already be stolen.
- Malicious QR logins: Scammers ask you to scan a QR code that actually logs them into your account. Discord shows a confirmation screen, so read it before approving. Never scan login QR codes you didn't request.
- Fake Nitro links: Free Nitro offers are phishing, close to 100% of the time.
If your Discord friend suddenly sends you a download link with casual wording that doesn't sound like them, assume their account is compromised and verify through another channel.
For Server Owners and Moderators
- Enable the server-wide 2FA requirement for moderation (Server Settings → Safety Setup). Moderators without 2FA lose access to destructive actions like bans and channel deletion.
- Audit your admin roles. Every admin without 2FA is a potential server takeover.
- Use webhooks and bots with minimal permissions, so a stolen admin account has a smaller blast radius.
Frequently Asked Questions
I lost my authenticator and my backup codes. Can Discord support help?
Usually not. Discord's policy is strict because a support recovery path would itself be an attack vector. In most cases the account is unrecoverable. This is unusual among big platforms, which is exactly why saving backup codes for Discord matters more than almost anywhere else.
Does Discord support SMS 2FA?
Discord offers SMS as a backup method in some regions after an authenticator app is set up, not as a standalone method. The authenticator app remains the primary, which is good: SMS is the weakest 2FA form.
Will enabling 2FA log out my other sessions?
No, existing sessions stay active. If you're enabling 2FA because you suspect a breach, also change your password, which does invalidate other sessions.
Why does my code keep getting rejected?
Nine times out of ten it's clock drift. TOTP codes are time based, so enable automatic date and time on your phone. Also make sure you're reading the code for the right account entry in your app.
Can I move my Discord 2FA to a new phone?
Yes. Either transfer your authenticator app's accounts to the new phone (most apps support export), or use a backup code to log in, disable 2FA, and re-enable it with the new device. Our guide on transferring Google Authenticator walks through the export process.
