Server security · Checked October 12, 2026

Lock down your own Discord account

Most server takeovers start with one staff account. Secure yours first: 2FA, backup codes, QR scams and apps you’ve authorised.

Open in Kipp’s docs

1. 1. Turn on two-factor authentication

   User Settings › My Account › Enable Two-Factor Auth. Discord offers passkeys or security keys (phishing-resistant, and the best choice), an authenticator app (a code that changes every 30 seconds) and SMS. Discord doesn’t recommend SMS on its own because text messages can be intercepted or a number taken over, and you can only add SMS after an authenticator app.

2. 2. Save your backup codes somewhere safe

   Each backup code works once. Save them as soon as you turn 2FA on (User Settings › My Account › View Backup Codes) and keep them offline, for example in a password manager or printed. Without them, losing your phone can lock you out of your account and your server.

3. 3. Never scan a QR code you didn’t make

   A QR code that offers “free Nitro” or a prize is a login request: scanning it with the Discord app logs the scammer into your account, without your password or 2FA. Only approve a QR login you started yourself on your own computer.

4. 4. Never share your password or token

   Nobody needs your token, and Discord staff never contact you through Discord DMs for support. If a link asks you to log in, close it and go to discord.com yourself. Watch for look-alike domains such as “dlscord”.

5. 5. If something looks wrong, change your password

   Changing your password resets your account token and signs out every device, which ends a scammer’s session. Then turn 2FA on (or reset it), remove apps you don’t recognise under User Settings › Authorized Apps, and run a virus scan. Discord’s hacked-account form is at dis.gd/hackedaccount.

6. 6. Ask your staff to do the same

   Your server is only as safe as its least careful moderator. Share this guide with your team, then turn on the server’s 2FA requirement (next guide).

   Learn more